ajout iam

terraform/environments/dev/main.tf

@@ -39,4 +39,5 @@ module "compute" {
 module "iam" {
   source        ="../../modules/iam"
   project_id    = var.project_id
-}
+  ssh_public_key_path = var.ssh_public_key_path
+}

terraform/environments/dev/variables.tf

@@ -52,4 +52,10 @@ variable "zone" {
   description = "Nom de la zone"
   type = string
   default = "europe-west9-b"
-}
+}
+
+variable "ssh_public_key_path" {
+  type        = string
+  description = "Chemin vers la clé publique SSH"
+  default     = "~/.ssh/id_ed25519.pub"
+}

terraform/modules/iam/main.tf

@@ -3,12 +3,12 @@ resource "google_service_account" "service_account" {
   display_name = "terraform"
 }
 
-resource "google_service_account_key" "mykey" {
+resource "google_service_account_key" "key" {
   service_account_id = google_service_account.service_account.name
   public_key_type    = "TYPE_X509_PEM_FILE"
 }
 
-resource "google_project_iam_binding" "custom_service_account" {
+resource "google_project_iam_binding" "sa_viewer" {
   project = var.project_id
   role    = "roles/viewer"
 
@@ -17,11 +17,11 @@ resource "google_project_iam_binding" "custom_service_account" {
   ]
 }
 
-data "google_client_openid_userinfo" "me" {
+# Ajout sécurité : OS Login
-}
+data "google_client_openid_userinfo" "me" {}
 
-resource "google_os_login_ssh_public_key" "cache" {
+resource "google_os_login_ssh_public_key" "ssh_key" {
-  user =  data.google_client_openid_userinfo.me.email
+  user    = data.google_client_openid_userinfo.me.email
   project = var.project_id
-  key = file("~/.ssh/id_ed25519.pub")
+  key     = file(var.ssh_public_key_path)
-}
+}

terraform/modules/iam/outputs.tf

@@ -1,9 +1,10 @@
 output "service_account_email" {
+  value       = google_service_account.service_account.email
   description = "Email du service account créé"
-  value       = google_service_account.sa.email
 }
 
-output "custom_role_name" {
+output "service_account_key" {
-  description = "Nom du rôle IAM personnalisé"
+  value       = google_service_account_key.key.private_key
-  value       = google_project_iam_custom_role.custom_role.name
+  sensitive   = true
+  description = "Clé privée du service account"
 }

terraform/modules/iam/variables.tf

@@ -1,4 +1,9 @@
 variable "project_id" {
-  description = "ID du projet GCP"
   type        = string
+  description = "ID du projet GCP"
+}
+
+variable "ssh_public_key_path" {
+  type        = string
+  description = "Chemin vers la clé publique SSH"
 }