The storage.googleapis.com service identity should use google_storage_project_service_account

[strongishllama]

TL;DR

Currently, when the activate_api_identities variable contains an object where the api property is set to storage.googleapis.com it will attempt to use the google_project_service_identity resource to activate the service idedentity. It instead should use the google_storage_project_service_account data resource, similar to how the compute.googleapis.com is handled.

Expected behavior

The service identity under the storage.googleapis.com is created and any roles passed are bound to it.

Observed behavior

A failed deployment when passing in the following object to the activate_api_identities variable.

{
    api = "storage.googleapis.com"
    roles = [
        "roles/pubsub.publisher"
    ]
}

Terraform Configuration

module "project" {
  source  = "terraform-google-modules/project-factory/google"
  version = "~> 13.0.0"

  activate_api_identities = [
    {
      api = "storage.googleapis.com"
      roles = [
        "roles/pubsub.publisher"
      ]
    }
  ]
  auto_create_network                = false
  billing_account                    = "BILLING_ACCOUNT"
  default_service_account            = "disable"
  folder_id                          = "FOLDER_ID"
  grant_services_security_admin_role = false
  labels                             = {}
  name                               = "PROJECT_NAME"
  org_id                             = "ORG_ID"
  random_project_id                  = false
}

Terraform Version

Terraform v1.3.3
on darwin_amd64

Additional information

No response

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days

[strongishllama]

bump

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days