From fdbbfdb0ad89248114e3cd89b6e6f733d36ae1dc Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Sun, 26 Apr 2026 11:18:50 -0500 Subject: [PATCH] iam: grant ci-pusher serviceAccountUser on all Cloud Run runtime SAs --- servers/gcp/artifact-registry.tf | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/servers/gcp/artifact-registry.tf b/servers/gcp/artifact-registry.tf index e7e5833..6a1ba5f 100644 --- a/servers/gcp/artifact-registry.tf +++ b/servers/gcp/artifact-registry.tf @@ -97,6 +97,28 @@ resource "google_project_iam_member" "ci_pusher_run_developer" { member = "serviceAccount:${google_service_account.ci_pusher.email}" } +# The CI SA must be able to impersonate each Cloud Run runtime SA when deploying +# new revisions. gcloud run services update requires iam.serviceaccounts.actAs +# on the target service account. Grant serviceAccountUser on each runtime SA. + +resource "google_service_account_iam_member" "ci_pusher_act_as_marketing" { + service_account_id = google_service_account.marketing.name + role = "roles/iam.serviceAccountUser" + member = "serviceAccount:${google_service_account.ci_pusher.email}" +} + +resource "google_service_account_iam_member" "ci_pusher_act_as_accounts" { + service_account_id = google_service_account.accounts.name + role = "roles/iam.serviceAccountUser" + member = "serviceAccount:${google_service_account.ci_pusher.email}" +} + +resource "google_service_account_iam_member" "ci_pusher_act_as_api" { + service_account_id = google_service_account.api.name + role = "roles/iam.serviceAccountUser" + member = "serviceAccount:${google_service_account.ci_pusher.email}" +} + # ── CI pusher JSON key (download once, store in Vault/Secret Manager) ───────── # After `terraform apply`, create a key and save it to GCP Secret Manager: # gcloud iam service-accounts keys create /tmp/ci-pusher.json \