google-cloud-platform - 如何使用 Terraform 在云运行中添加 allUsers 成员

Question

我想使用 Terraform 自动将allUsers成员添加到具有 Cloud Run Invoker 角色的成员。google_cloud_run_service

要解决这个问题：

此服务只允许经过身份验证的调用。要允许未经身份验证的调用，请将“allUsers”添加为成员并为其分配“Cloud Run 调用者”角色。

allUsers我手动添加成员并将角色设置为 Cloud Run Invoker没有任何问题。

但我希望这可以通过 Terraform 完成。

我尝试了以下方法：

data "google_iam_policy" "noauth" {
  binding {
    role = "roles/run.invoker"
    members = [
      "allUsers",
    ]
  }
}
# Enable public access on Cloud Run service
resource "google_cloud_run_service_iam_policy" "noauth" {
  location = google_cloud_run_service.default.location
  project = google_cloud_run_service.default.project
  service = google_cloud_run_service.default.name
  policy_data = data.google_iam_policy.noauth.policy_data
}

allUsers但是在应用terraform planand之后似乎没有创建成员terraform apply。

更新：

主文件

terraform {
  required_version = "= 0.14.7"
  backend "gcs" {
    bucket = "mybucket-terraform-test"
    prefix = "backend"
  }
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 3.42.0"
    }
  }
}

脚.tf

resource "google_service_account" "service_account" {
  account_id   = "project_name-cloudrun"
}

resource "google_service_account_iam_binding" "admin-account-iam" {
  service_account_id = google_service_account.service_account.name
  role               = "roles/iam.serviceAccountUser"

  members = [
    "user:[e-mail]",
  ]
}

resource "google_cloud_run_service" "default" {
  name     = "myproject-backend"
  location = "us-central1"

  template {
    spec {
      service_account_name = "[e-mail]"
      containers {
        image = "us.gcr.io/myproject-dev/myproject/myproject-backend@sha256:abc123"
      }
    }
  }
}

## not working as expected ##

data "google_iam_policy" "noauth" {
  binding {
    role = "roles/run.invoker"
    members = [
      "allUsers",
    ]
  }
}

resource "google_cloud_run_service_iam_policy" "noauth" {
  location    = google_cloud_run_service.default.location
  project     = google_cloud_run_service.default.project
  service     = google_cloud_run_service.default.name
  policy_data = data.google_iam_policy.noauth.policy_data
}

##

标签： google-cloud-platformterraformcloudterraform-provider-gcp