How to properly create gcp service-account with roles in terraform

Question

Here is the terraform code I have used to create a service account and bind a role to it:

resource "google_service_account" "sa-name" {
  account_id = "sa-name"
  display_name = "SA"
}

resource "google_project_iam_binding" "firestore_owner_binding" {
  role               = "roles/datastore.owner"
  members = [
    "serviceAccount:sa-name@${var.project}.iam.gserviceaccount.com",
  ]
  depends_on = [google_service_account.sa-name]
}

Above code worked great... except it removed the datastore.owner from any other service account in the project that this role was previously assigned to. We have a single project that many teams use and there are service accounts managed by different teams. My terraform code would only have our team's service accounts and we could end up breaking other teams service accounts.

Is there another way to do this in terraform?

This of course can be done via GCP UI or gcloud cli without any issue or affecting other SAs.

Answer 1

From terraform docs, "google_project_iam_binding" is Authoritative. Sets the IAM policy for the project and replaces any existing policy already attached. That means that it replaces completely members for a given role inside it.

To just add a role to a new service account, without editing everybody else from that role, you should use the resource "google_project_iam_member":

resource "google_service_account" "sa-name" {
  account_id = "sa-name"
  display_name = "SA"
}

resource "google_project_iam_member" "firestore_owner_binding" {
  project = <your_gcp_project_id_here>
  role    = "roles/datastore.owner"
  member  = "serviceAccount:${google_service_account.sa-name.email}"
}

Extra change from your sample: the use of service account resource email generated attribute to remove the explicit depends_on. You don't need the depends_on if you do it like this and you avoid errors with bad configuration.

Terraform can infer the dependency from the use of a variable from another resource. Check the docs here to understand this behavior better.

Answer 2

It's an usual problem with Terraform. Either you do all with it, or nothing. If you are between, unexpected things can happen!!

If you want to use terraform, you have to import the existing into the tfstate. Here the doc for the bindind, and, of course, you have to add all the account in the Terraform file. If not, the binding will be removed, but this time, you will see the deletion in the tf plan.