Reworked SA roles for old-projects cleanup.

modules/project_cleanup/main.tf

@@ -16,6 +16,11 @@
 
 locals {
   target_included_labels = var.target_tag_name != "" && var.target_tag_value != "" ? merge({ "${var.target_tag_name}" = "${var.target_tag_value}" }, var.target_included_labels) : var.target_included_labels
+  org_roles              = [
+    "roles/resourcemanager.projectDeleter",
+    "roles/resourcemanager.folderViewer",
+    "roles/resourcemanager.lienModifier"
+  ]
 }
 
 resource "google_service_account" "project_cleaner_function" {
@@ -25,8 +30,9 @@ resource "google_service_account" "project_cleaner_function" {
 }
 
 resource "google_organization_iam_member" "project_owner" {
+  count  = length(local.org_roles)
   org_id = var.organization_id
-  role   = "roles/owner"
+  role   = local.org_roles[count.index]
   member = "serviceAccount:${google_service_account.project_cleaner_function.email}"
 }