resource "google_service_account" "terraform_sa" {
  project      = var.project_id
  account_id   = var.service_account_name
  display_name = "Terraform Deployment SA"
}

resource "google_project_iam_member" "sa_roles" {
  for_each = toset([
    "roles/compute.admin",
    "roles/iam.serviceAccountUser"
  ])
  project = var.project_id
  role    = each.key
  member  = "serviceAccount:${google_service_account.terraform_sa.email}"
}

resource "google_project_iam_member" "oslogin_roles" {
  for_each = toset([
    "roles/compute.osLogin",
    "roles/iam.serviceAccountUser"
  ])
  project = var.project_id
  role    = each.key
  member  = "user:${var.gcp_user_email}"
}

resource "google_os_login_ssh_public_key" "user_ssh_key" {
  user     = var.gcp_user_email
  key      = var.ssh_public_key
}