fix

Author: adela-bytebase

tutorials/7-1-workspace-iam.tf

@@ -0,0 +1,48 @@
+resource "bytebase_iam_policy" "workspace_iam" {
+  depends_on = [
+    bytebase_user.workspace_admin,
+    bytebase_user.tf_service_account,
+    bytebase_user.workspace_dba1,
+    bytebase_user.workspace_dba2,
+    bytebase_group.qa
+  ]
+
+  parent = "workspaces/-"
+
+  iam_policy {
+
+    binding {
+      role = "roles/workspaceAdmin"
+      members = [
+        format("user:%s", bytebase_user.workspace_admin.email),
+        format("user:%s", bytebase_user.tf_service_account.email),
+      ]
+    }
+
+    binding {
+      role = "roles/workspaceDBA"
+      members = [
+        format("user:%s", bytebase_user.workspace_dba1.email),
+        format("user:%s", bytebase_user.workspace_dba2.email)
+      ]
+    }
+
+    binding {
+      role = "roles/workspaceMember"
+      members = [
+        format("user:%s", bytebase_user.dev1.email),
+        format("user:%s", bytebase_user.dev2.email),
+        format("user:%s", bytebase_user.dev3.email),
+        format("user:%s", bytebase_user.qa1.email),
+        format("user:%s", bytebase_user.qa2.email)
+      ]
+    }
+
+    binding {
+      role = "roles/projectViewer"
+      members = [
+        format("group:%s", bytebase_group.qa.email),
+      ]
+    }
+  }
+}

tutorials/7-2-project-iam.tf

@@ -0,0 +1,42 @@
+resource "bytebase_iam_policy" "project_iam" {
+  depends_on = [
+    bytebase_group.developers,
+    bytebase_user.workspace_dba1,
+    bytebase_user.workspace_dba2
+  ]
+
+  parent = bytebase_project.project-two.name
+
+  iam_policy {
+
+    binding {
+      role = "roles/projectOwner"
+      members = [
+        format("user:%s", bytebase_user.workspace_dba1.email),
+        format("user:%s", bytebase_user.workspace_dba2.email)
+      ]
+    }
+
+    binding {
+      role = "roles/projectDeveloper"
+      members = [
+        "allUsers",
+        format("group:%s", bytebase_group.developers.email)
+      ]
+    }
+
+    binding {
+      role = "roles/sqlEditorUser"
+      members = [
+        format("group:%s", bytebase_group.developers.email)
+      ]
+      condition {
+        database         = "instances/prod-sample-instance/databases/hr_prod"
+        schema           = "public"
+        tables           = ["employee","salary"]
+        expire_timestamp = "2027-07-10T16:17:49Z"
+      }
+    }
+
+  }
+}