Fix and cleanup trust-relationship from service-principal module (#5)

Author: ravinadhruve10

modules/services/service-principal/main.tf

@@ -5,24 +5,24 @@
 resource "google_service_account" "sa" {
   project      = var.project_id
   account_id   = var.service_account_name
-  display_name = "Service account for trust-relationship"
+  display_name = "Service account for secure posture management"
 }
 
 #---------------------------------
 # role permissions for onboarding
 #---------------------------------
-resource "google_project_iam_member" "onboarding_role" {
+resource "google_project_iam_member" "browser" {
   count = var.is_organizational ? 0 : 1
 
   project = var.project_id
   role    = "roles/browser"
   member  = "serviceAccount:${google_service_account.sa.email}"
 }
 
-#--------------------------------------------------------------------------------------
-# role permissions for CSPM (GCP Predefined Roles for Sysdig Cloud Trust Relationship)
-#--------------------------------------------------------------------------------------
-resource "google_project_iam_member" "trust_relationship_role" {
+#---------------------------------------------------------------------------------------------
+# role permissions for CSPM (GCP Predefined Roles for Sysdig Cloud Secure Posture Management)
+#---------------------------------------------------------------------------------------------
+resource "google_project_iam_member" "cloudasset_viewer" {
   for_each = var.is_organizational ? [] : toset(["roles/cloudasset.viewer"])
 
   project = var.project_id
@@ -33,7 +33,7 @@ resource "google_project_iam_member" "trust_relationship_role" {
 #---------------------------------------------------------------------------------------
 # role permissions for CIEM (GCP Predefined Roles for Sysdig Cloud Identity Management)
 #---------------------------------------------------------------------------------------
-resource "google_project_iam_member" "identity_mgmt_role" {
+resource "google_project_iam_member" "identity_mgmt" {
   for_each = var.is_organizational ? [] : toset(["roles/recommender.viewer", "roles/iam.serviceAccountViewer", "roles/iam.roleViewer"])
 
   project = var.project_id

modules/services/service-principal/organizational.tf

@@ -14,18 +14,18 @@ data "google_organization" "org" {
 #---------------------------------
 # role permissions for onboarding
 #---------------------------------
-resource "google_organization_iam_member" "onboarding_role" {
+resource "google_organization_iam_member" "browser" {
   count = var.is_organizational ? 1 : 0
 
   org_id = data.google_organization.org[0].org_id
   role   = "roles/browser"
   member = "serviceAccount:${google_service_account.sa.email}"
 }
 
-#--------------------------------------------------------------------------------------
-# role permissions for CSPM (GCP Predefined Roles for Sysdig Cloud Trust Relationship)
-#--------------------------------------------------------------------------------------
-resource "google_organization_iam_member" "trust_relationship_role" {
+#---------------------------------------------------------------------------------------------
+# role permissions for CSPM (GCP Predefined Roles for Sysdig Cloud Secure Posture Management)
+#---------------------------------------------------------------------------------------------
+resource "google_organization_iam_member" "cloudasset_viewer" {
   for_each = var.is_organizational ? toset(["roles/cloudasset.viewer"]) : []
 
   org_id = data.google_organization.org[0].org_id
@@ -36,7 +36,7 @@ resource "google_organization_iam_member" "trust_relationship_role" {
 #---------------------------------------------------------------------------------------
 # role permissions for CIEM (GCP Predefined Roles for Sysdig Cloud Identity Management)
 #---------------------------------------------------------------------------------------
-resource "google_organization_iam_member" "identity_mgmt_role" {
+resource "google_organization_iam_member" "identity_mgmt" {
   for_each = var.is_organizational ? toset(["roles/recommender.viewer", "roles/iam.serviceAccountViewer", "roles/iam.organizationRoleViewer"]) : []
 
   org_id = data.google_organization.org[0].org_id