iam: grant ci-pusher serviceAccountUser on all Cloud Run runtime SAs

2026-04-26 11:18:50 -05:00
parent 66bffc5a4b
commit fdbbfdb0ad
1 changed files with 22 additions and 0 deletions
@@ -97,6 +97,28 @@ resource "google_project_iam_member" "ci_pusher_run_developer" {
  member  = "serviceAccount:${google_service_account.ci_pusher.email}"
 }

+# The CI SA must be able to impersonate each Cloud Run runtime SA when deploying
+# new revisions. gcloud run services update requires iam.serviceaccounts.actAs
+# on the target service account. Grant serviceAccountUser on each runtime SA.
+
+resource "google_service_account_iam_member" "ci_pusher_act_as_marketing" {
+  service_account_id = google_service_account.marketing.name
+  role               = "roles/iam.serviceAccountUser"
+  member             = "serviceAccount:${google_service_account.ci_pusher.email}"
+}
+
+resource "google_service_account_iam_member" "ci_pusher_act_as_accounts" {
+  service_account_id = google_service_account.accounts.name
+  role               = "roles/iam.serviceAccountUser"
+  member             = "serviceAccount:${google_service_account.ci_pusher.email}"
+}
+
+resource "google_service_account_iam_member" "ci_pusher_act_as_api" {
+  service_account_id = google_service_account.api.name
+  role               = "roles/iam.serviceAccountUser"
+  member             = "serviceAccount:${google_service_account.ci_pusher.email}"
+}
+
 # ── CI pusher JSON key (download once, store in Vault/Secret Manager) ─────────
 # After `terraform apply`, create a key and save it to GCP Secret Manager:
 #   gcloud iam service-accounts keys create /tmp/ci-pusher.json \