Reworked SA roles for old-projects cleanup.

terraform-google-modules · Nov 8, 2019 · b83b1e9 · b83b1e9
1 parent 4c6c87c
commit b83b1e9
Showing 1 changed file with 15 additions and 1 deletion.
diff --git a/modules/project_cleanup/main.tf b/modules/project_cleanup/main.tf
@@ -24,9 +24,23 @@ resource "google_service_account" "project_cleaner_function" {
   display_name = "Project Cleaner Function"
 }
 
+module "sa-organization-roles" {
+  source        = "terraform-google-modules/iam/google//modules/organizations_iam"
+  version       = "4.0.0"
+  organizations = [var.organization_id]
+  mode          = "additive"
+
+  bindings = {
+    "roles/resourcemanager.projectDeleter" = ["serviceAccount:${google_service_account.project_cleaner_function.email}"]
+    "roles/resourcemanager.folderViewer"   = ["serviceAccount:${google_service_account.project_cleaner_function.email}"]
+    "roles/resourcemanager.lienModifier"   = ["serviceAccount:${google_service_account.project_cleaner_function.email}"]
+  }
+}
+
 resource "google_organization_iam_member" "project_owner" {
+  count  = length(local.org_roles)
   org_id = var.organization_id
-  role   = "roles/owner"
+  role   = local.org_roles[count.index]
   member = "serviceAccount:${google_service_account.project_cleaner_function.email}"
 }