GCP Service Account

Creates GCP service accounts with role bindings and custom roles.

Use this module when a Rabbit service needs dedicated identities - runtime service accounts for Cloud Run or GKE workloads, caller accounts for cross-service auth, or custom least-privilege roles.

Supported Features

• Multiple service accounts per module instance via the service_accounts map.
• Project role bindings per account, including custom role references (custom: prefix).
• Custom role definitions with explicit permission lists.
• IAM bindings on the service account itself, such as workloadIdentityUser for GitHub Actions WIF.
• Adopt pre-existing service accounts (create: false + service_account_email) to manage their bindings without recreating the account.

Prerequisites

• GCP credentials with permission to manage service accounts, custom roles, and project IAM policy (roles/iam.serviceAccountAdmin, roles/iam.roleAdmin, roles/resourcemanager.projectIamAdmin).
• The iam.googleapis.com API enabled on the project (enabled automatically via google_api_name).

Important Notes

• Service account keys are intentionally not supported; use Workload Identity Federation for external authentication.
• project_roles entries prefixed with custom: reference a key in the custom_roles map and resolve to projects/<project>/roles/<role_id>. Custom roles are created before any bindings that reference them.
• create: false adopts a pre-existing SA: the module manages its project_roles and iam_bindings but never creates, modifies, or destroys the account. service_account_email is required when create is false.
• Deleted service account names cannot be reused for 30 days; deleted custom role IDs cannot be reused for 7 days.
• Bindings use google_project_iam_member (additive, non-authoritative) - existing bindings on the same role are not disturbed.

Minimal Example

services:
  - name: "Service Accounts"
    module: "gcp-service-account"
    id: "my-service-accounts"
    configurations:
      service_accounts:
        api-service:
          account_id: "sa-api-service"
          project_roles:
            - "roles/pubsub.publisher"

Outputs

Output	Description
service_account_emails	Map of service account keys to email addresses.
service_account_ids	Map of service account keys to fully-qualified resource names.
custom_role_ids	Map of custom role keys to fully-qualified role IDs.

Full Configuration Schema

configurations:
  # Map of service accounts to create or adopt. Keys are stable identifiers
  # used in state addressing and outputs; renaming a key recreates the account.
  service_accounts:
    <key>:
      account_id: ""            # Required when create is true. 6-30 chars.
      create: true              # Optional. Set false to adopt a pre-existing SA.
      service_account_email: "" # Required when create is false.
      display_name: ""          # Optional. Defaults to account_id.
      description: ""           # Optional. Defaults to "Managed by Rabbit".
      disabled: false           # Optional. Disable the account without deleting it.
      project_roles: []         # Optional. Roles granted to this SA on the project.
                                #   - "roles/pubsub.publisher"          (predefined role)
                                #   - "custom:<custom_roles key>"       (custom role below)
      iam_bindings: []          # Optional. IAM bindings ON this service account.
        # - role: "roles/iam.workloadIdentityUser"
        #   member: "principalSet://iam.googleapis.com/projects/<num>/locations/global/workloadIdentityPools/<pool>/attribute.repository/<org>/<repo>"

  # Map of custom project roles to create.
  custom_roles:
    <key>:
      role_id: ""               # Required. CamelCase role ID, unique per project.
      title: ""                 # Required. Human-readable title.
      description: ""           # Optional. Defaults to "Managed by Rabbit".
      permissions: []           # Required. Explicit permission list.