feat!: Use user defined SA for cb triggers

[amandakarina]

Hey folks,

This pull request adds the user-defines service account in cloud build trigger.

This pull request is a requirements for terraform-google-modules/terraform-example-foundation#546

[bharathkkb]

Thanks for the PR @amandakarina
Can we also remove this since TF SA will be used and not CB SA?

terraform-google-bootstrap/modules/cloudbuild/main.tf

Lines 226 to 249 in 953241e

	resource "google_service_account_iam_member" "cloudbuild_terraform_sa_impersonate_permissions" {
	count = local.impersonation_enabled_count
	service_account_id = var.terraform_sa_name
	role = "roles/iam.serviceAccountTokenCreator"
	member = "serviceAccount:${module.cloudbuild_project.project_number}@cloudbuild.gserviceaccount.com"
	}
	resource "google_organization_iam_member" "cloudbuild_serviceusage_consumer" {
	count = local.impersonation_enabled_count
	org_id = var.org_id
	role = "roles/serviceusage.serviceUsageConsumer"
	member = "serviceAccount:${module.cloudbuild_project.project_number}@cloudbuild.gserviceaccount.com"
	}
	# Required to allow cloud build to access state with impersonation.
	resource "google_storage_bucket_iam_member" "cloudbuild_state_iam" {
	count = local.impersonation_enabled_count
	bucket = var.terraform_state_bucket
	role = "roles/storage.admin"
	member = "serviceAccount:${module.cloudbuild_project.project_number}@cloudbuild.gserviceaccount.com"
	}

We should also update the docs on new IAM permissions needed.

[bharathkkb]

Marking as breaking since existing workflows leveraging TF SA impersonation will need updates.

[amandakarina]

Cloud build, currently, does not support using a service account from another project.

[github-actions]

This PR is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days

[bharathkkb]

This should be unblocked now https://cloud.google.com/build/docs/securing-builds/configure-user-specified-service-accounts#cross-project_set_up
@daniel-cit Could you test if this is WAI?

[daniel-cit]

This should be unblocked now https://cloud.google.com/build/docs/securing-builds/configure-user-specified-service-accounts#cross-project_set_up @daniel-cit Could you test if this is WAI?

Hi @bharathkkb I will test it

[daniel-cit]

it is necessary to add

logsBucket: 'gs://$_LOGS_BUCKET_NAME'

at the end of cloud build files to use the logging bucket

[comment-bot-dev]

@amandakarina
Thanks for the PR! 🚀
✅ Lint checks have passed.