Fix service agent context interpolation in project factory sub-resources (GoogleCloudPlatform#4095)

* Fix service agent context interpolation in project factory sub-resources

* Address review: fix example agent refs, aspect-types/taxonomies _self_ agents, per-path test guards

Author: sruffilli

modules/project-factory/README.md

@@ -281,8 +281,8 @@ Assuming keys of the form `my_folder`, `my_project`, `my_sa`, etc. this is an ex
 - `$folder_ids:my_folder`
 - `$iam_principals:my_principal`
 - `$iam_principals:service_accounts/my_project/my_sa`
-- `$iam_principals:service_agents/_self_/my_api`
-- `$iam_principals:service_agents/my_project/my_api`
+- `$iam_principals:service_agents/_self_/my_api` *only resolves for agents whose API is enabled in the project*
+- `$iam_principals:service_agents/my_project/my_api` *only resolves for agents whose API is enabled in the target project*
 - `$iam_principalsets:service_accounts/all`
 - `$kms_keys:my_key`
 - `$log_buckets:my_project/my_bucket`
@@ -664,7 +664,7 @@ service_accounts:
       roles/iam.serviceAccountUser:
         - $iam_principals:service_accounts/_self_/app-0-fe
         - $iam_principals:service_agents/_self_/compute
-        - $iam_principals:service_agents/dev-tb-app0-0/compute
+        - $iam_principals:service_agents/dev-tb-app0-0/storage
     iam_bindings_additive:
       test:
         role: roles/iam.serviceAccountUser
@@ -694,6 +694,11 @@ billing_budgets:
 buckets:
   app-0-bucket-a:
     location: europe-west8
+    iam:
+      roles/storage.objectViewer:
+        - $iam_principals:service_agents/_self_/compute
+      roles/storage.legacyObjectReader:
+        - $iam_principals:service_agents/dev-tb-app0-0/storage
     tag_bindings:
       context: $tag_values:context/gke
   app-0-bucket-b:
@@ -730,6 +735,8 @@ pubsub_topics:
     iam:
       roles/pubsub.subscriber:
         - group:team-a-admins@example.org
+      roles/pubsub.viewer:
+        - $iam_principals:service_agents/_self_/pubsub
   app-0-topic-b:
     subscriptions:
       app-0-topic-b-sub: {}

modules/project-factory/aspect-types.tf

@@ -33,8 +33,9 @@ module "aspect-types" {
   context = merge(local.ctx, {
     iam_principals = merge(
       local.ctx_iam_principals,
-      lookup(local.self_sas_iam_emails, each.key, {}),
-      local.projects_service_agents
+      local.projects_service_agents,
+      lookup(local.per_project_service_agents, each.key, {}),
+      lookup(local.self_sas_iam_emails, each.key, {})
     )
     project_ids = merge(
       local.ctx.project_ids,

modules/project-factory/projects-bigquery.tf

@@ -59,6 +59,8 @@ module "bigquery-datasets" {
       local.ctx.iam_principals,
       local.projects_sas_iam_emails,
       local.automation_sas_iam_emails,
+      local.projects_service_agents,
+      lookup(local.per_project_service_agents, each.value.project_key, {}),
       lookup(local.self_sas_iam_emails, each.value.project_key, {})
     )
     kms_keys    = merge(local.ctx.kms_keys, local.kms_keys, local.kms_autokeys)

modules/project-factory/projects-buckets.tf

@@ -81,6 +81,8 @@ module "buckets" {
       local.ctx.iam_principals,
       local.projects_sas_iam_emails,
       local.automation_sas_iam_emails,
+      local.projects_service_agents,
+      lookup(local.per_project_service_agents, each.value.project_key, {}),
       lookup(local.self_sas_iam_emails, each.value.project_key, {})
     )
     kms_keys        = merge(local.ctx.kms_keys, local.kms_keys, local.kms_autokeys)

modules/project-factory/projects-kms.tf

@@ -76,8 +76,9 @@ module "kms" {
       local.ctx.iam_principals,
       local.projects_sas_iam_emails,
       local.automation_sas_iam_emails,
-      lookup(local.self_sas_iam_emails, each.value.project_key, {}),
-      local.projects_service_agents
+      local.projects_service_agents,
+      lookup(local.per_project_service_agents, each.value.project_key, {}),
+      lookup(local.self_sas_iam_emails, each.value.project_key, {})
     )
     locations   = local.ctx.locations
     project_ids = local.ctx_project_ids

modules/project-factory/projects-log-buckets.tf

@@ -51,6 +51,8 @@ module "log-buckets" {
       local.ctx.iam_principals,
       local.projects_sas_iam_emails,
       local.automation_sas_iam_emails,
+      local.projects_service_agents,
+      lookup(local.per_project_service_agents, each.value.project_key, {}),
       lookup(local.self_sas_iam_emails, each.value.project_key, {})
     )
     kms_keys    = merge(local.ctx.kms_keys, local.kms_keys, local.kms_autokeys)

modules/project-factory/projects-pubsub.tf

@@ -47,6 +47,8 @@ module "pubsub" {
       local.ctx.iam_principals,
       local.projects_sas_iam_emails,
       local.automation_sas_iam_emails,
+      local.projects_service_agents,
+      lookup(local.per_project_service_agents, each.value.project_key, {}),
       lookup(local.self_sas_iam_emails, each.value.project_key, {})
     )
     kms_keys    = merge(local.ctx.kms_keys, local.kms_keys, local.kms_autokeys)

modules/project-factory/taxonomies.tf

@@ -35,8 +35,9 @@ module "taxonomies" {
   context = merge(local.ctx, {
     iam_principals = merge(
       local.ctx_iam_principals,
-      lookup(local.self_sas_iam_emails, each.key, {}),
-      local.projects_service_agents
+      local.projects_service_agents,
+      lookup(local.per_project_service_agents, each.key, {}),
+      lookup(local.self_sas_iam_emails, each.key, {})
     )
     project_ids = merge(
       local.ctx.project_ids,

tests/modules/project_factory/examples/example.yaml

@@ -197,6 +197,24 @@ values:
     uniform_bucket_level_access: true
     versioning:
     - enabled: false
+  ? module.project-factory.module.buckets["dev-ta-app0-be/app-0-bucket-a"].google_storage_bucket_iam_binding.authoritative["roles/storage.legacyObjectReader"]
+  : bucket: test-pf-dev-ta-app0-be-app-0-bucket-a
+    condition: []
+    # members must be unknown at plan time: the cross-project service agent
+    # reference resolves to an email embedding the project number, while an
+    # unresolved reference would be passed through as a known literal
+    members: __missing__
+    role: roles/storage.legacyObjectReader
+    timeouts: null
+  ? module.project-factory.module.buckets["dev-ta-app0-be/app-0-bucket-a"].google_storage_bucket_iam_binding.authoritative["roles/storage.objectViewer"]
+  : bucket: test-pf-dev-ta-app0-be-app-0-bucket-a
+    condition: []
+    # members must be unknown at plan time: the _self_ service agent
+    # reference resolves to an email embedding the project number, while an
+    # unresolved reference would be passed through as a known literal
+    members: __missing__
+    role: roles/storage.objectViewer
+    timeouts: null
   module.project-factory.module.buckets["dev-ta-app0-be/app-0-bucket-a"].google_tags_location_tag_binding.binding["context"]:
     deletion_policy: DELETE
     location: europe-west8
@@ -870,6 +888,14 @@ values:
     - group:team-a-admins@example.org
     project: test-pf-dev-ta-app0-be
     role: roles/pubsub.subscriber
+  ? module.project-factory.module.pubsub["dev-ta-app0-be/app-0-topic-a"].google_pubsub_topic_iam_binding.authoritative["roles/pubsub.viewer"]
+  : condition: []
+    # members must be unknown at plan time: the _self_ service agent
+    # reference resolves to an email embedding the project number, while an
+    # unresolved reference would be passed through as a known literal
+    members: __missing__
+    project: test-pf-dev-ta-app0-be
+    role: roles/pubsub.viewer
   ? module.project-factory.module.pubsub["dev-ta-app0-be/app-0-topic-b"].google_pubsub_subscription.default["app-0-topic-b-sub"]
   : bigquery_config: []
     cloud_storage_config: []
@@ -1065,20 +1091,20 @@ counts:
   google_project_service_identity: 5
   google_pubsub_subscription: 1
   google_pubsub_topic: 2
-  google_pubsub_topic_iam_binding: 1
+  google_pubsub_topic_iam_binding: 2
   google_service_account: 6
   google_service_account_iam_binding: 2
   google_service_account_iam_member: 3
   google_storage_bucket: 3
-  google_storage_bucket_iam_binding: 2
+  google_storage_bucket_iam_binding: 4
   google_storage_project_service_account: 4
   google_tags_location_tag_binding: 2
   google_tags_tag_binding: 3
   google_tags_tag_key: 1
   google_tags_tag_value: 2
   google_tags_tag_value_iam_binding: 1
   modules: 39
-  resources: 122
+  resources: 125
   terraform_data: 2
 
 outputs: {}