NSEC and GCVE Service Account names are too long in tenant

[dobikrisz]

Describe the bug
When enabling the fast features 'nsec' and 'gcve' on a fast-enabled tenant using the resman stage, I am running into a naming error when trying to generate the read service accounts for the stages, even though every user defined name (e.g.: prefixes) are within the documentation defined limits.

To Reproduce

1. Execute Bootstrap stage on a fresh organization and give a prefix that is 7 characters long (officially 9 is the max) - in my case this is "found01"
2. Run the tenant factory stage and create a tenant with a prefix which is the maximum 3 characters long - in my example it is "f01"
3. run the Resman stage on the tenant with fast-features nsec and gcve enabled

Expected behavior
The stage to perform the action

Result

│ Error: "account_id" ("found01-f01-prod-resman-gcve-0r") doesn't match regexp "^[a-z](?:[-a-z0-9]{4,28}[a-z0-9])$"
│ 
│   with module.branch-gcve-prod-r-sa[0].google_service_account.service_account[0],
│   on .terraform/modules/branch-gcve-prod-r-sa/iam-service-account/main.tf line 74, in resource "google_service_account" "service_account":
│   74:   account_id   = "${local.prefix}${local.name}"
│ 
╵
╷
│ Error: "account_id" ("found01-f01-prod-resman-nsec-0r") doesn't match regexp "^[a-z](?:[-a-z0-9]{4,28}[a-z0-9])$"
│ 
│   with module.branch-nsec-r-sa[0].google_service_account.service_account[0],
│   on .terraform/modules/branch-nsec-r-sa/iam-service-account/main.tf line 74, in resource "google_service_account" "service_account":
│   74:   account_id   = "${local.prefix}${local.name}"
│ 
╵

Here, the tenant prefix is exactly 11 characters long (with the "-" included) which is the maximum lenght allowed in the documentation. However the SA names are still too long.

Additional context
I don't think this issue can be "fixed" so the documentation should be updated to only allow 10 character long prefixes for tenants.

[juliocc]

Thanks for catching this @dobikrisz. Would you mind sending a PR to update the docs?

[ludoo]

Closing this as service account names are now configurable since #2769 was merged, and can be tweaked to work around length issues.