update docs in terraform.yaml

GoogleCloudPlatform · Dec 9, 2019 · 1d08495 · 1d08495
1 parent b931bc6
commit 1d08495
Showing 1 changed file with 12 additions and 9 deletions.
diff --git a/products/compute/terraform.yaml b/products/compute/terraform.yaml
@@ -408,25 +408,28 @@ overrides: !ruby/object:Overrides::ResourceOverrides
         name: "kmsKeySelfLink"
         description: |
           The self link of the encryption key used to encrypt the disk. Also called KmsKeyName
-          in the cloud console. In order to use this additional
-          IAM permissions need to be set on the Compute Engine Service Agent. See
-          https://cloud.google.com/compute/docs/disks/customer-managed-encryption#encrypt_a_new_persistent_disk_with_your_own_keys
+          in the cloud console. Your project's Compute Engine System service account
+          (`service-{{PROJECT_NUMBER}}@compute-system.iam.gserviceaccount.com`) must have
+          `roles/cloudkms.cryptoKeyEncrypterDecrypter` to use this feature.
+          See https://cloud.google.com/compute/docs/disks/customer-managed-encryption#encrypt_a_new_persistent_disk_with_your_own_keys
       sourceSnapshotEncryptionKey.kmsKeyName: !ruby/object:Overrides::Terraform::PropertyOverride
         diff_suppress_func: 'compareSelfLinkRelativePaths'
         name: "kmsKeySelfLink"
         description: |
           The self link of the encryption key used to encrypt the disk. Also called KmsKeyName
-          in the cloud console. In order to use this additional
-          IAM permissions need to be set on the Compute Engine Service Agent. See
-          https://cloud.google.com/compute/docs/disks/customer-managed-encryption#encrypt_a_new_persistent_disk_with_your_own_keys
+          in the cloud console. Your project's Compute Engine System service account
+          (`service-{{PROJECT_NUMBER}}@compute-system.iam.gserviceaccount.com`) must have
+          `roles/cloudkms.cryptoKeyEncrypterDecrypter` to use this feature.
+          See https://cloud.google.com/compute/docs/disks/customer-managed-encryption#encrypt_a_new_persistent_disk_with_your_own_keys
       sourceImageEncryptionKey.kmsKeyName: !ruby/object:Overrides::Terraform::PropertyOverride
         diff_suppress_func: 'compareSelfLinkRelativePaths'
         name: "kmsKeySelfLink"
         description: |
           The self link of the encryption key used to encrypt the disk. Also called KmsKeyName
-          in the cloud console. In order to use this additional
-          IAM permissions need to be set on the Compute Engine Service Agent. See
-          https://cloud.google.com/compute/docs/disks/customer-managed-encryption#encrypt_a_new_persistent_disk_with_your_own_keys
+          in the cloud console. Your project's Compute Engine System service account
+          (`service-{{PROJECT_NUMBER}}@compute-system.iam.gserviceaccount.com`) must have
+          `roles/cloudkms.cryptoKeyEncrypterDecrypter` to use this feature.
+          See https://cloud.google.com/compute/docs/disks/customer-managed-encryption#encrypt_a_new_persistent_disk_with_your_own_keys
       physicalBlockSizeBytes: !ruby/object:Overrides::Terraform::PropertyOverride
         default_from_api: true
       resourcePolicies: !ruby/object:Overrides::Terraform::PropertyOverride