docs: Add CMEK for Eventarc #827
Conversation
Per b/404495162
|
Here is the summary of changes. You are about to add 5 region tags.
This comment is generated by snippet-bot.
|
eventarc/use_cmek/main.tf
Outdated
| resource "google_kms_crypto_key_iam_member" "default" { | ||
| crypto_key_id = google_kms_crypto_key.default.id | ||
| role = "roles/cloudkms.cryptoKeyEncrypterDecrypter" | ||
| member = "serviceAccount:service-${data.google_project.default.number}@gcp-sa-eventarc.iam.gserviceaccount.com" |
There was a problem hiding this comment.
Tests are failing due to this service account not existing. IIRC this might be due to the eventual setup of eventarc, and since we're using a brand new project for tests, this is something that may not affect docs consumers.
Other eventarc samples due a dedicated service account rather than the product service account. It doesn't look like other samples on the intended page use the product service account, so I suggest adapting the setup from https://github.com/terraform-google-modules/terraform-docs-samples/blob/main/eventarc/basic/main.tf that usesgoogle_service_account to create the service account, then reference it here.
There was a problem hiding this comment.
Thanks, Katie! I've added using google_project_service_identity to generate the Eventarc SA....hopefully, that passes muster.
camiekim
added
waiting-for-codeowners
and removed
waiting-response
* docs: Create main.tf Per b/404495162 * docs: Support generation of Eventarc SA * doc: Use email attribute instead of member for google_project_service_identity --------- Co-authored-by: Eric Dong <[email protected]>
3 participants
Description
Fixes b/404495162
Enable CMEK support for Eventarc through Terraform
Note: If you are not associated with Google, open an issue for discussion before submitting a pull request.
Checklist
Readiness
Style
guide
Testing
[x ] I have performed tests described in the Contributing guide:
terraform applyterraform fmtcheckIntended location
[ x] Yes, this sample will be (or already is) included on cloud.google.com
Location(s): https://cloud.google.com/eventarc/docs/use-cmek
No, this sample won't be included on cloud.google.com
Reason:
API enablement
Review