Spanner IAM

transparency-dev · Aug 16, 2024 · e249c37 · e249c37
1 parent 93c0815
commit e249c37
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 5 deletions.
diff --git a/deployment/modules/example-gcp/main.tf b/deployment/modules/example-gcp/main.tf
@@ -29,10 +29,15 @@ resource "google_project_iam_member" "iam_metrics_writer" {
   role    = "roles/monitoring.metricWriter"
   member  = "serviceAccount:${google_service_account.cloudrun_service_account.email}"
 }
-resource "google_project_iam_member" "iam_spanner_database_user" {
-  project = var.project_id
-  role    = "roles/spanner.databaseUser"
-  member  = "serviceAccount:${google_service_account.cloudrun_service_account.email}"
+resource "google_spanner_database_iam_binding" "iam_spanner_database_user" {
+  project  = var.project_id
+  instance = module.gcp.log_spanner.name
+  database = module.gcp.log_db.name
+  role     = "roles/spanner.databaseUser"
+
+  members = [
+    "serviceAccount:${google_service_account.cloudrun_service_account.email}"
+  ]
 }
 resource "google_project_iam_member" "iam_service_agent" {
   project = var.project_id

diff --git a/deployment/modules/gcp/main.tf b/deployment/modules/gcp/main.tf
@@ -48,7 +48,7 @@ resource "google_storage_bucket_iam_binding" "log_bucket_writer" {
 resource "google_spanner_instance" "log_spanner" {
   name             = var.base_name
   config           = "regional-${var.location}"
-  display_name     = "${var.base_name} Spanner Instance"
+  display_name     = var.base_name
   processing_units = 100
 }