Spanner IAM

transparency-dev · Aug 16, 2024 · d603227 · d603227
1 parent 93c0815
commit d603227
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 8 deletions.
diff --git a/deployment/modules/example-gcp/main.tf b/deployment/modules/example-gcp/main.tf
@@ -29,10 +29,15 @@ resource "google_project_iam_member" "iam_metrics_writer" {
   role    = "roles/monitoring.metricWriter"
   member  = "serviceAccount:${google_service_account.cloudrun_service_account.email}"
 }
-resource "google_project_iam_member" "iam_spanner_database_user" {
-  project = var.project_id
-  role    = "roles/spanner.databaseUser"
-  member  = "serviceAccount:${google_service_account.cloudrun_service_account.email}"
+resource "google_spanner_database_iam_binding" "iam_spanner_database_user" {
+  project  = var.project_id
+  instance = module.gcp.log_spanner_instance.name
+  database = module.gcp.log_spanner_db.name
+  role     = "roles/spanner.databaseUser"
+
+  members = [
+    "serviceAccount:${google_service_account.cloudrun_service_account.email}"
+  ]
 }
 resource "google_project_iam_member" "iam_service_agent" {
   project = var.project_id
@@ -54,7 +59,7 @@ resource "google_cloud_run_v2_service" "default" {
         "--logtostderr",
         "--v=1",
         "--bucket=${module.gcp.log_bucket.id}",
-        "--spanner=${module.gcp.log_spanner.id}",
+        "--spanner=${module.gcp.log_spanner_database.id}",
         "--project=${var.project_id}",
         "--signer=./testgcp.sec",
       ]
@@ -82,8 +87,8 @@ resource "google_cloud_run_v2_service" "default" {
   depends_on = [
     google_project_iam_member.iam_act_as,
     google_project_iam_member.iam_metrics_writer,
-    google_project_iam_member.iam_spanner_database_user,
     google_project_iam_member.iam_service_agent,
+    google_spanner_database_iam_binding.iam_spanner_database_user,
   ]
 }
 

diff --git a/deployment/modules/gcp/main.tf b/deployment/modules/gcp/main.tf
@@ -48,7 +48,7 @@ resource "google_storage_bucket_iam_binding" "log_bucket_writer" {
 resource "google_spanner_instance" "log_spanner" {
   name             = var.base_name
   config           = "regional-${var.location}"
-  display_name     = "${var.base_name} Spanner Instance"
+  display_name     = var.base_name
   processing_units = 100
 }
 

diff --git a/deployment/modules/gcp/outputs.tf b/deployment/modules/gcp/outputs.tf
@@ -3,11 +3,16 @@ output "log_bucket" {
   value       = google_storage_bucket.log_bucket
 }
 
-output "log_spanner" {
+output "log_spanner_db" {
   description = "Log Spanner database"
   value       = google_spanner_database.log_db
 }
 
+output "log_spanner_instance" {
+  description = "Log Spanner instance"
+  value       = google_spanner_database.log_spanner
+}
+
 output "service_account_name" {
   description = "Name of the service account with write permission for storage"
   value       = google_service_account.log_writer.member