test

terraform/modules/iam/main.tf

@@ -1,51 +1,28 @@
-############################################
-# 1. COMPTE DE SERVICE TERRAFORM
-############################################
 
-resource "google_service_account" "terraform_sa" {
-  account_id   = "terraform-sa"
-  display_name = "Terraform Service Account"
-  project      = var.project_id
+resource "google_service_account" "service_account" {
+  account_id   = "terraform"
+  display_name = "terraform"
 }
 
-############################################
-# 2. CLÉ DU COMPTE DE SERVICE
-############################################
-
-resource "google_service_account_key" "terraform_sa_key" {
-  service_account_id = google_service_account.terraform_sa.name
+resource "google_service_account_key" "mykey" {
+  service_account_id = google_service_account.service_account.name
+  public_key_type    = "TYPE_X509_PEM_FILE"
 }
 
-############################################
-# 3. RÔLES IAM
-############################################
+resource "google_project_iam_binding" "custom_service_account" {
+  project = var.project_id
+  role    = "roles/viewer"
 
-# Liste des rôles nécessaires au déploiement
-locals {
-  terraform_roles = [
-    "roles/compute.admin",
-    "roles/iam.serviceAccountUser",
-    "roles/iam.serviceAccountAdmin",
-    "roles/storage.admin",
-    "roles/compute.networkAdmin",
-    "roles/compute.securityAdmin"
+  members = [
+    "serviceAccount:${google_service_account.service_account.email}",
   ]
 }
 
-resource "google_project_iam_member" "terraform_sa_roles" {
-  for_each = toset(local.terraform_roles)
-
-  project = var.project_id
-  role    = each.value
-  member  = "serviceAccount:${google_service_account.terraform_sa.email}"
+data "google_client_openid_userinfo" "me" {
 }
 
-############################################
-# 4. OS LOGIN + CLÉ SSH
-############################################
-
-resource "google_os_login_ssh_public_key" "oslogin_ssh_key" {
+resource "google_os_login_ssh_public_key" "cache" {
+  user =  data.google_client_openid_userinfo.me.email
   project = var.project_id
-  user    = google_service_account.terraform_sa.email
-  key     = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCwvtrSp4IaaEFQ3u9xcyKKlWpucIeZFyXguamjg3+MOwBZmHBptnNd1i/2hv4q+ezA1Jq1SEqZ4uNeKB9P76Q43Nv+pqYkPxm8lfueU/ZrEomjpseEZEHipHyD5WQd+idrbrHqqcISkIktyyFvSEbDELqfe4+IvvR1zvsHXA/onisJ6lCwoDKSXwFp/wWhuzEILpzE5EGXsX4E/lbieWradVLDbvF0QNDBlcYc1zfuYQ8BG4rKcvw7xwqr243UzPBKWndd63IqbNOBfi8V1jqj96mP6kddohxl+Caz5lsh66Pp97GDnSAn9jNk8HAI3Ws0K540PSII5AqgdRJEbuI1Y0saUP3p1uDkysosYSqJU/SAxux00E/2/rLfdvaf7czEwHECAvEcLdvmceOqHJrKh2pSgb5MZ1oq3E6jMvCAiJNT0n6i+iRalGarl46CY6rQakEq3d84pgt7lH1mN3ZstKWJocppFMZRaCPdwgtTwbBTDPJm8TZ85QbtfyZumZU= julian_gallego180105_gmail_com"
-}
+  key = file("~/.ssh/id_ed25519.pub")
+}

terraform/modules/iam/outputs.tf

@@ -1,18 +1,11 @@
-############################################
-# 1. EMAIL DU COMPTE DE SERVICE
-############################################
 
 output "service_account_email" {
-  description = "Email du service account utilisé par Terraform."
-  value       = google_service_account.terraform_sa.email
+  description = "Service account email."
+  value = google_service_account.service_account.email
 }
 
-############################################
-# 2. CLÉ DU COMPTE DE SERVICE
-############################################
-
 output "service_account_key" {
-  description = "Clé privée du service account (JSON)."
-  value       = google_service_account_key.terraform_sa_key.private_key
+  description = "Service account key."
   sensitive   = true
-}
+  value       = google_service_account_key.mykey.private_key
+}

terraform/modules/iam/variables.tf

@@ -1,5 +1,5 @@
-variable "project_id" {
-  type        = string
-  description = "ID du projet GCP."
-}
 
+variable "project_id" {
+  description = "ID du projet"
+  type        = string
+}