Terraform Service Account

We use Terraform service acccounts for applying our Terraform configurations.

Troubleshooting

There is a TODO ticket for this problem: Create a new minimal permissions custom role for Terraform SA to fix 403 on KMS IAM policies (https://app.clickup.com/t/86by0w774) Keywords: 1. Error applying IAM policy for KMS CryptoKey 2. Error setting IAM policy for KMS CryptoKey 3. Error 403: Permission 'cloudkms.cryptoKeys.setIamPolicy' denied on resource

│ Error: Error applying IAM policy for KMS CryptoKey "projects/attracs-logistics-nightly-6519/locations/europe-north1/keyRings/road-cc-keyring-nightly/cryptoKeys/road-cc-disk-cryptokey-nightly": Error setting IAM policy for KMS CryptoKey "projects/attracs-logistics-nightly-6519/locations/europe-north1/keyRings/road-cc-keyring-nightly/cryptoKeys/road-cc-disk-cryptokey-nightly": googleapi: Error 403: Permission 'cloudkms.cryptoKeys.setIamPolicy' denied on resource 'projects/attracs-logistics-nightly-6519/locations/europe-north1/keyRings/road-cc-keyring-nightly/cryptoKeys/road-cc-disk-cryptokey-nightly' (or it may not exist)., forbidden
│ 
│   with google_kms_crypto_key_iam_member.road_cc_disk,
│   on create-kms.tf line 21, in resource "google_kms_crypto_key_iam_member" "road_cc_disk":
│   21: resource "google_kms_crypto_key_iam_member" "road_cc_disk" {

Fix

Give the Terraform service account roles/iam.securityadmin role to fix this issue. TODO create a new role with only the minimal permissions (probably cloudkms.cryptoKeys.setIamPolicy is enough)