iam

tp-cloud/terraform/modules/iam/main.tf

@@ -1,31 +1,25 @@
 resource "google_service_account" "terraform_sa" {
-  account_id   = "terraform-admin"
-  display_name = "Terraform Administrative Service Account"
+  account_id   = "terraform"
+  display_name = "Terraform Automation Service Account"
 }
 
-# 2. Clé du compte de service
 resource "google_service_account_key" "terraform_sa_key" {
   service_account_id = google_service_account.terraform_sa.name
-  public_key_type = "TYPE_X509_PEM_FILE"
+  public_key_type    = "TYPE_X509_PEM_FILE"
 }
 
-resource "google_project_iam_member" "terraform_roles" {
-  for_each = toset([
-    "roles/compute.admin",
-    "roles/iam.serviceAccountUser",
-    "roles/resourcemanager.projectIamAdmin",
-    "roles/compute.osLogin",
-    "roles/compute.networkAdmin",
-  ])
-
+resource "google_project_iam_binding" "terraform_viewer" {
   project = var.project_id
-  role    = each.value
-  member  = "serviceAccount:${google_service_account.terraform_sa.email}"
+  role    = "roles/viewer"
+
+  members = [
+    "serviceAccount:${google_service_account.terraform_sa.email}"
+  ]
 }
 
-resource "google_compute_project_metadata" "oslogin" {
-  metadata = {
-    enable-oslogin = "TRUE"
-    ssh-keys       = "student:${file("~/.ssh/id_ed25519.pub")}"
-  }
+data "google_client_openid_userinfo" "me" {}
+
+resource "google_os_login_ssh_public_key" "user_ssh_key" {
+  user = data.google_client_openid_userinfo.me.email
+  key  = file("~/.ssh/id_ed25519.pub")
 }