Added change for default service account deprivilege setting

GoogleCloudPlatform · Sep 29, 2022 · 5a245c4 · 5a245c4
1 parent 46f8cb1
commit 5a245c4
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/modules/project/service-accounts.tf b/modules/project/service-accounts.tf
@@ -140,3 +140,11 @@ resource "google_kms_crypto_key_iam_member" "service_identity_cmek" {
     data.google_storage_project_service_account.gcs_sa,
   ]
 }
+
+resource "google_project_default_service_accounts" "default_service_accounts" {
+  count          = upper(var.default_service_account) == "KEEP" ? 0 : 1
+  action         = upper(var.default_service_account)
+  project        = local.project.project_id
+  restore_policy = "REVERT_AND_IGNORE_FAILURE"
+  depends_on     = [google_project_service.project_services]
+}
diff --git a/modules/project/variables.tf b/modules/project/variables.tf
@@ -46,6 +46,12 @@ variable "descriptive_name" {
   default     = null
 }
 
+variable "default_service_account" {
+  description = "Project default service account setting: can be one of `delete`, `deprivilege`, `disable`, or `keep`."
+  default     = "keep"
+  type        = string
+}
+
 variable "group_iam" {
   description = "Authoritative IAM binding for organization groups, in {GROUP_EMAIL => [ROLES]} format. Group emails need to be static. Can be used in combination with the `iam` variable."
   type        = map(list(string))