GCP Service Account キーを使わない Terraform

的にはキー作るな感があった

Terraform doc

案内はある、一方で

Using Terraform-specific service accounts to authenticate with GCP is the recommended practice when using Terraform.

サービスアカウントを分けるが認証情報は

First, authenticate with GCP. The easiest way to do this is to run gcloud auth application-default login, if you already have gcloud installed. If you don't already have it, you can install it from here.

Quota project "your-project" was added to ADC which can be used by Google client libraries for billing and quota.

が出るのを確認する

impersonate

最初にどうするか

↑ を terraform に書いておきたいが...

最初は gcloud ユーザで実行する

code:impersonate.tf

# なりすまされるサービスアカウント

resource "google_service_account" "terraform" {

account_id = "terraform"

}

# そのサービスアカウントになりすませるようにユーザー(グループ)に TokenCreator を付与

resource "google_service_account_iam_binding" "token_creator_terraform" {

service_account_id = data.google_service_account.terraform.name

role = "roles/iam.serviceAccountTokenCreator"

members = [

"group:my-team@hatena.ne.jp",

]

}

? backend でも渡す必要があるか確認