Will Anderson
131 lines
4.7 KiB
Terraform
131 lines
4.7 KiB
Terraform
# ── Service Accounts ──────────────────────────────────────────────────────────
|
|
|
|
resource "google_service_account" "marketing" {
|
|
account_id = "neuron-marketing-sa"
|
|
display_name = "Neuron Marketing Cloud Run SA"
|
|
description = "Service account for the neurontechnologies.ai marketing site on Cloud Run"
|
|
project = var.project_id
|
|
}
|
|
|
|
resource "google_service_account" "accounts" {
|
|
account_id = "neuron-accounts-sa"
|
|
display_name = "Neuron Accounts Cloud Run SA"
|
|
description = "Service account for the accounts service (auth, billing, marketplace)"
|
|
project = var.project_id
|
|
}
|
|
|
|
resource "google_service_account" "api" {
|
|
account_id = "neuron-api-sa"
|
|
display_name = "Neuron REST API Cloud Run SA"
|
|
description = "Service account for the neuron-rest API service"
|
|
project = var.project_id
|
|
}
|
|
|
|
# ── IAM — Secret Manager ──────────────────────────────────────────────────────
|
|
|
|
resource "google_project_iam_member" "marketing_secret_accessor" {
|
|
project = var.project_id
|
|
role = "roles/secretmanager.secretAccessor"
|
|
member = "serviceAccount:${google_service_account.marketing.email}"
|
|
}
|
|
|
|
resource "google_project_iam_member" "accounts_secret_accessor" {
|
|
project = var.project_id
|
|
role = "roles/secretmanager.secretAccessor"
|
|
member = "serviceAccount:${google_service_account.accounts.email}"
|
|
}
|
|
|
|
resource "google_project_iam_member" "api_secret_accessor" {
|
|
project = var.project_id
|
|
role = "roles/secretmanager.secretAccessor"
|
|
member = "serviceAccount:${google_service_account.api.email}"
|
|
}
|
|
|
|
# ── IAM — Cloud SQL ───────────────────────────────────────────────────────────
|
|
# Only accounts connects to Cloud SQL; API and marketing don't need DB access.
|
|
|
|
resource "google_project_iam_member" "accounts_sql_client" {
|
|
project = var.project_id
|
|
role = "roles/cloudsql.client"
|
|
member = "serviceAccount:${google_service_account.accounts.email}"
|
|
}
|
|
|
|
# ── IAM — Public invocation (Cloud Run → LB) ──────────────────────────────────
|
|
# allUsers invoker allows the global HTTP(S) load balancer's health checks
|
|
# and traffic to reach the services without additional auth headers.
|
|
|
|
# Marketing
|
|
resource "google_cloud_run_v2_service_iam_member" "prod_us_public" {
|
|
project = var.project_id
|
|
location = "us-central1"
|
|
name = google_cloud_run_v2_service.prod_us.name
|
|
role = "roles/run.invoker"
|
|
member = "allUsers"
|
|
}
|
|
|
|
resource "google_cloud_run_v2_service_iam_member" "prod_eu_public" {
|
|
project = var.project_id
|
|
location = "europe-west1"
|
|
name = google_cloud_run_v2_service.prod_eu.name
|
|
role = "roles/run.invoker"
|
|
member = "allUsers"
|
|
}
|
|
|
|
resource "google_cloud_run_v2_service_iam_member" "prod_apac_public" {
|
|
project = var.project_id
|
|
location = "asia-northeast1"
|
|
name = google_cloud_run_v2_service.prod_apac.name
|
|
role = "roles/run.invoker"
|
|
member = "allUsers"
|
|
}
|
|
|
|
# Accounts
|
|
resource "google_cloud_run_v2_service_iam_member" "accounts_us_public" {
|
|
project = var.project_id
|
|
location = "us-central1"
|
|
name = google_cloud_run_v2_service.accounts_us.name
|
|
role = "roles/run.invoker"
|
|
member = "allUsers"
|
|
}
|
|
|
|
resource "google_cloud_run_v2_service_iam_member" "accounts_eu_public" {
|
|
project = var.project_id
|
|
location = "europe-west1"
|
|
name = google_cloud_run_v2_service.accounts_eu.name
|
|
role = "roles/run.invoker"
|
|
member = "allUsers"
|
|
}
|
|
|
|
resource "google_cloud_run_v2_service_iam_member" "accounts_apac_public" {
|
|
project = var.project_id
|
|
location = "asia-northeast1"
|
|
name = google_cloud_run_v2_service.accounts_apac.name
|
|
role = "roles/run.invoker"
|
|
member = "allUsers"
|
|
}
|
|
|
|
# API
|
|
resource "google_cloud_run_v2_service_iam_member" "api_us_public" {
|
|
project = var.project_id
|
|
location = "us-central1"
|
|
name = google_cloud_run_v2_service.api_us.name
|
|
role = "roles/run.invoker"
|
|
member = "allUsers"
|
|
}
|
|
|
|
resource "google_cloud_run_v2_service_iam_member" "api_eu_public" {
|
|
project = var.project_id
|
|
location = "europe-west1"
|
|
name = google_cloud_run_v2_service.api_eu.name
|
|
role = "roles/run.invoker"
|
|
member = "allUsers"
|
|
}
|
|
|
|
resource "google_cloud_run_v2_service_iam_member" "api_apac_public" {
|
|
project = var.project_id
|
|
location = "asia-northeast1"
|
|
name = google_cloud_run_v2_service.api_apac.name
|
|
role = "roles/run.invoker"
|
|
member = "allUsers"
|
|
}
|