fix: grant_registry_access gate serviceUsageConsumer (#2266)

terraform-google-modules · Feb 6, 2025 · 69eca65 · 69eca65
1 parent 637c2aa
commit 69eca65
Show file tree

Hide file tree

Showing 10 changed files with 10 additions and 10 deletions.
diff --git a/autogen/main/sa.tf.tmpl b/autogen/main/sa.tf.tmpl
@@ -82,7 +82,7 @@ resource "google_project_iam_member" "cluster_service_account_artifact_registry"
 }
 
 resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
-  for_each = var.create_service_account {% if autopilot_cluster != true %}&& var.enable_gcfs {% endif %}? toset(local.registry_projects_list) : []
+  for_each = var.create_service_account && var.grant_registry_access {% if autopilot_cluster != true %}&& var.enable_gcfs {% endif %}? toset(local.registry_projects_list) : []
   project  = each.key
   role     = "roles/serviceusage.serviceUsageConsumer"
   member   = "serviceAccount:${google_service_account.cluster_service_account[0].email}"

diff --git a/modules/beta-autopilot-private-cluster/sa.tf b/modules/beta-autopilot-private-cluster/sa.tf
@@ -82,7 +82,7 @@ resource "google_project_iam_member" "cluster_service_account_artifact_registry"
 }
 
 resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
-  for_each = var.create_service_account ? toset(local.registry_projects_list) : []
+  for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
   project  = each.key
   role     = "roles/serviceusage.serviceUsageConsumer"
   member   = "serviceAccount:${google_service_account.cluster_service_account[0].email}"

diff --git a/modules/beta-autopilot-public-cluster/sa.tf b/modules/beta-autopilot-public-cluster/sa.tf
@@ -82,7 +82,7 @@ resource "google_project_iam_member" "cluster_service_account_artifact_registry"
 }
 
 resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
-  for_each = var.create_service_account ? toset(local.registry_projects_list) : []
+  for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
   project  = each.key
   role     = "roles/serviceusage.serviceUsageConsumer"
   member   = "serviceAccount:${google_service_account.cluster_service_account[0].email}"

diff --git a/modules/beta-private-cluster-update-variant/sa.tf b/modules/beta-private-cluster-update-variant/sa.tf
@@ -82,7 +82,7 @@ resource "google_project_iam_member" "cluster_service_account_artifact_registry"
 }
 
 resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
-  for_each = var.create_service_account && var.enable_gcfs ? toset(local.registry_projects_list) : []
+  for_each = var.create_service_account && var.grant_registry_access && var.enable_gcfs ? toset(local.registry_projects_list) : []
   project  = each.key
   role     = "roles/serviceusage.serviceUsageConsumer"
   member   = "serviceAccount:${google_service_account.cluster_service_account[0].email}"

diff --git a/modules/beta-private-cluster/sa.tf b/modules/beta-private-cluster/sa.tf
@@ -82,7 +82,7 @@ resource "google_project_iam_member" "cluster_service_account_artifact_registry"
 }
 
 resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
-  for_each = var.create_service_account && var.enable_gcfs ? toset(local.registry_projects_list) : []
+  for_each = var.create_service_account && var.grant_registry_access && var.enable_gcfs ? toset(local.registry_projects_list) : []
   project  = each.key
   role     = "roles/serviceusage.serviceUsageConsumer"
   member   = "serviceAccount:${google_service_account.cluster_service_account[0].email}"

diff --git a/modules/beta-public-cluster-update-variant/sa.tf b/modules/beta-public-cluster-update-variant/sa.tf
@@ -82,7 +82,7 @@ resource "google_project_iam_member" "cluster_service_account_artifact_registry"
 }
 
 resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
-  for_each = var.create_service_account && var.enable_gcfs ? toset(local.registry_projects_list) : []
+  for_each = var.create_service_account && var.grant_registry_access && var.enable_gcfs ? toset(local.registry_projects_list) : []
   project  = each.key
   role     = "roles/serviceusage.serviceUsageConsumer"
   member   = "serviceAccount:${google_service_account.cluster_service_account[0].email}"

diff --git a/modules/beta-public-cluster/sa.tf b/modules/beta-public-cluster/sa.tf
@@ -82,7 +82,7 @@ resource "google_project_iam_member" "cluster_service_account_artifact_registry"
 }
 
 resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
-  for_each = var.create_service_account && var.enable_gcfs ? toset(local.registry_projects_list) : []
+  for_each = var.create_service_account && var.grant_registry_access && var.enable_gcfs ? toset(local.registry_projects_list) : []
   project  = each.key
   role     = "roles/serviceusage.serviceUsageConsumer"
   member   = "serviceAccount:${google_service_account.cluster_service_account[0].email}"

diff --git a/modules/private-cluster-update-variant/sa.tf b/modules/private-cluster-update-variant/sa.tf
@@ -82,7 +82,7 @@ resource "google_project_iam_member" "cluster_service_account_artifact_registry"
 }
 
 resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
-  for_each = var.create_service_account && var.enable_gcfs ? toset(local.registry_projects_list) : []
+  for_each = var.create_service_account && var.grant_registry_access && var.enable_gcfs ? toset(local.registry_projects_list) : []
   project  = each.key
   role     = "roles/serviceusage.serviceUsageConsumer"
   member   = "serviceAccount:${google_service_account.cluster_service_account[0].email}"

diff --git a/modules/private-cluster/sa.tf b/modules/private-cluster/sa.tf
@@ -82,7 +82,7 @@ resource "google_project_iam_member" "cluster_service_account_artifact_registry"
 }
 
 resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
-  for_each = var.create_service_account && var.enable_gcfs ? toset(local.registry_projects_list) : []
+  for_each = var.create_service_account && var.grant_registry_access && var.enable_gcfs ? toset(local.registry_projects_list) : []
   project  = each.key
   role     = "roles/serviceusage.serviceUsageConsumer"
   member   = "serviceAccount:${google_service_account.cluster_service_account[0].email}"

diff --git a/sa.tf b/sa.tf
@@ -82,7 +82,7 @@ resource "google_project_iam_member" "cluster_service_account_artifact_registry"
 }
 
 resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
-  for_each = var.create_service_account && var.enable_gcfs ? toset(local.registry_projects_list) : []
+  for_each = var.create_service_account && var.grant_registry_access && var.enable_gcfs ? toset(local.registry_projects_list) : []
   project  = each.key
   role     = "roles/serviceusage.serviceUsageConsumer"
   member   = "serviceAccount:${google_service_account.cluster_service_account[0].email}"