Support serviceAccount field for AppEngine flex (#6391) (#4653)

* Support serviceAccount field for AppEngine flex * Add service account example * Update account_id * Use vars instead of test env vars * Move account id to right tf example * Update mmv1/templates/terraform/examples/app_engine_flexible_app_version.tf.erb Co-authored-by: Stephen Lewis (Burrows) <[email protected]> * Add logs writer and network user role * Update mmv1/templates/terraform/examples/app_engine_flexible_app_version.tf.erb Co-authored-by: Stephen Lewis (Burrows) <[email protected]> * Add objectViewer role Co-authored-by: Stephen Lewis (Burrows) <[email protected]> Signed-off-by: Modular Magician <[email protected]> Signed-off-by: Modular Magician <[email protected]> Co-authored-by: Stephen Lewis (Burrows) <[email protected]>
hashicorp · Sep 2, 2022 · 724c9f3 · 724c9f3
1 parent f3ec793
commit 724c9f3
Show file tree

Hide file tree

Showing 4 changed files with 77 additions and 2 deletions.
diff --git a/.changelog/6391.txt b/.changelog/6391.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+appengine: Added field `serviceAccount` to `app_engine_flexible_app_version`
+```
diff --git a/google-beta/resource_app_engine_flexible_app_version.go b/google-beta/resource_app_engine_flexible_app_version.go
@@ -801,6 +801,12 @@ Substitute '<language>' with 'python', 'java', 'php', 'ruby', 'go' or 'nodejs'.`
 				Optional:    true,
 				Description: `The path or name of the app's main executable.`,
 			},
+			"service_account": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Description: `The identity that the deployed version will run as. Admin API will use the App Engine Appspot service account as
+default if this field is neither provided in app.yaml file nor through CLI flag.`,
+			},
 			"serving_status": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -936,6 +942,12 @@ func resourceAppEngineFlexibleAppVersionCreate(d *schema.ResourceData, meta inte
 	} else if v, ok := d.GetOkExists("runtime_main_executable_path"); !isEmptyValue(reflect.ValueOf(runtimeMainExecutablePathProp)) && (ok || !reflect.DeepEqual(v, runtimeMainExecutablePathProp)) {
 		obj["runtimeMainExecutablePath"] = runtimeMainExecutablePathProp
 	}
+	serviceAccountProp, err := expandAppEngineFlexibleAppVersionServiceAccount(d.Get("service_account"), d, config)
+	if err != nil {
+		return err
+	} else if v, ok := d.GetOkExists("service_account"); !isEmptyValue(reflect.ValueOf(serviceAccountProp)) && (ok || !reflect.DeepEqual(v, serviceAccountProp)) {
+		obj["serviceAccount"] = serviceAccountProp
+	}
 	apiConfigProp, err := expandAppEngineFlexibleAppVersionApiConfig(d.Get("api_config"), d, config)
 	if err != nil {
 		return err
@@ -1148,6 +1160,9 @@ func resourceAppEngineFlexibleAppVersionRead(d *schema.ResourceData, meta interf
 	if err := d.Set("runtime_main_executable_path", flattenAppEngineFlexibleAppVersionRuntimeMainExecutablePath(res["runtimeMainExecutablePath"], d, config)); err != nil {
 		return fmt.Errorf("Error reading FlexibleAppVersion: %s", err)
 	}
+	if err := d.Set("service_account", flattenAppEngineFlexibleAppVersionServiceAccount(res["serviceAccount"], d, config)); err != nil {
+		return fmt.Errorf("Error reading FlexibleAppVersion: %s", err)
+	}
 	if err := d.Set("api_config", flattenAppEngineFlexibleAppVersionApiConfig(res["apiConfig"], d, config)); err != nil {
 		return fmt.Errorf("Error reading FlexibleAppVersion: %s", err)
 	}
@@ -1270,6 +1285,12 @@ func resourceAppEngineFlexibleAppVersionUpdate(d *schema.ResourceData, meta inte
 	} else if v, ok := d.GetOkExists("runtime_main_executable_path"); !isEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, runtimeMainExecutablePathProp)) {
 		obj["runtimeMainExecutablePath"] = runtimeMainExecutablePathProp
 	}
+	serviceAccountProp, err := expandAppEngineFlexibleAppVersionServiceAccount(d.Get("service_account"), d, config)
+	if err != nil {
+		return err
+	} else if v, ok := d.GetOkExists("service_account"); !isEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, serviceAccountProp)) {
+		obj["serviceAccount"] = serviceAccountProp
+	}
 	apiConfigProp, err := expandAppEngineFlexibleAppVersionApiConfig(d.Get("api_config"), d, config)
 	if err != nil {
 		return err
@@ -1778,6 +1799,10 @@ func flattenAppEngineFlexibleAppVersionRuntimeMainExecutablePath(v interface{},
 	return v
 }
 
+func flattenAppEngineFlexibleAppVersionServiceAccount(v interface{}, d *schema.ResourceData, config *Config) interface{} {
+	return v
+}
+
 func flattenAppEngineFlexibleAppVersionApiConfig(v interface{}, d *schema.ResourceData, config *Config) interface{} {
 	if v == nil {
 		return nil
@@ -2836,6 +2861,10 @@ func expandAppEngineFlexibleAppVersionRuntimeMainExecutablePath(v interface{}, d
 	return v, nil
 }
 
+func expandAppEngineFlexibleAppVersionServiceAccount(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
+	return v, nil
+}
+
 func expandAppEngineFlexibleAppVersionApiConfig(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
 	l := v.([]interface{})
 	if len(l) == 0 || l[0] == nil {

diff --git a/google-beta/resource_app_engine_flexible_app_version_generated_test.go b/google-beta/resource_app_engine_flexible_app_version_generated_test.go
@@ -71,10 +71,28 @@ resource "google_project_service" "service" {
   disable_dependent_services = false
 }
 
+resource "google_service_account" "custom_service_account" {
+  project      = google_project_service.service.project
+  account_id   = "tf-test-my-account%{random_suffix}"
+  display_name = "Custom Service Account"
+}
+
 resource "google_project_iam_member" "gae_api" {
   project = google_project_service.service.project
   role    = "roles/compute.networkUser"
-  member  = "serviceAccount:service-${google_project.my_project.number}@gae-api-prod.google.com.iam.gserviceaccount.com"
+  member  = "serviceAccount:${google_service_account.custom_service_account.email}"
+}
+
+resource "google_project_iam_member" "logs_writer" {
+  project = google_project_service.service.project
+  role    = "roles/logging.logWriter"
+  member  = "serviceAccount:${google_service_account.custom_service_account.email}"
+}
+
+resource "google_project_iam_member" "storage_viewer" {
+  project = google_project_service.service.project
+  role    = "roles/storage.objectViewer"
+  member  = "serviceAccount:${google_service_account.custom_service_account.email}"
 }
 
 resource "google_app_engine_flexible_app_version" "myapp_v1" {
@@ -125,6 +143,7 @@ resource "google_app_engine_flexible_app_version" "myapp_v1" {
   }
 
   noop_on_destroy = true
+  service_account = google_service_account.custom_service_account.email
 }
 
 resource "google_storage_bucket" "bucket" {

diff --git a/website/docs/r/app_engine_flexible_app_version.html.markdown b/website/docs/r/app_engine_flexible_app_version.html.markdown
@@ -58,10 +58,28 @@ resource "google_project_service" "service" {
   disable_dependent_services = false
 }
 
+resource "google_service_account" "custom_service_account" {
+  project      = google_project_service.service.project
+  account_id   = "my-account"
+  display_name = "Custom Service Account"
+}
+
 resource "google_project_iam_member" "gae_api" {
   project = google_project_service.service.project
   role    = "roles/compute.networkUser"
-  member  = "serviceAccount:service-${google_project.my_project.number}@gae-api-prod.google.com.iam.gserviceaccount.com"
+  member  = "serviceAccount:${google_service_account.custom_service_account.email}"
+}
+
+resource "google_project_iam_member" "logs_writer" {
+  project = google_project_service.service.project
+  role    = "roles/logging.logWriter"
+  member  = "serviceAccount:${google_service_account.custom_service_account.email}"
+}
+
+resource "google_project_iam_member" "storage_viewer" {
+  project = google_project_service.service.project
+  role    = "roles/storage.objectViewer"
+  member  = "serviceAccount:${google_service_account.custom_service_account.email}"
 }
 
 resource "google_app_engine_flexible_app_version" "myapp_v1" {
@@ -112,6 +130,7 @@ resource "google_app_engine_flexible_app_version" "myapp_v1" {
   }
 
   noop_on_destroy = true
+  service_account = google_service_account.custom_service_account.email
 }
 
 resource "google_storage_bucket" "bucket" {
@@ -272,6 +291,11 @@ The following arguments are supported:
   (Optional)
   The path or name of the app's main executable.
 
+* `service_account` -
+  (Optional)
+  The identity that the deployed version will run as. Admin API will use the App Engine Appspot service account as
+  default if this field is neither provided in app.yaml file nor through CLI flag.
+
 * `api_config` -
   (Optional)
   Serving configuration for Google Cloud Endpoints.