chore: use less privileged roles for deploying bigquery module

Author: ayushmjain

metadata.display.yaml

@@ -22,7 +22,7 @@ spec:
   info:
     title: terraform-google-bigquery
     source:
-      repo: https://github.com/ayushmjain/terraform-google-bigquery
+      repo: https://github.com/terraform-google-modules/terraform-google-bigquery
       sourceType: git
   ui:
     input:

metadata.yaml

@@ -22,9 +22,9 @@ spec:
   info:
     title: terraform-google-bigquery
     source:
-      repo: https://github.com/ayushmjain/terraform-google-bigquery
+      repo: https://github.com/terraform-google-modules/terraform-google-bigquery
       sourceType: git
-    version: 1.0.4
+    version: 9.0.0
     actuationTool:
       flavor: Terraform
       version: ">= 1.3"
@@ -382,8 +382,6 @@ spec:
       - level: Project
         roles:
           - roles/bigquery.admin
-          - roles/cloudkms.cryptoKeyEncrypterDecrypter
-          - roles/owner
     services:
       - cloudkms.googleapis.com
       - cloudresourcemanager.googleapis.com

modules/authorization/metadata.yaml

@@ -94,8 +94,6 @@ spec:
       - level: Project
         roles:
           - roles/bigquery.admin
-          - roles/cloudkms.cryptoKeyEncrypterDecrypter
-          - roles/owner
     services:
       - cloudkms.googleapis.com
       - cloudresourcemanager.googleapis.com

modules/data_warehouse/metadata.yaml

@@ -136,8 +136,6 @@ spec:
       - level: Project
         roles:
           - roles/bigquery.admin
-          - roles/cloudkms.cryptoKeyEncrypterDecrypter
-          - roles/owner
     services:
       - cloudkms.googleapis.com
       - cloudresourcemanager.googleapis.com

modules/scheduled_queries/metadata.yaml

@@ -60,8 +60,6 @@ spec:
       - level: Project
         roles:
           - roles/bigquery.admin
-          - roles/cloudkms.cryptoKeyEncrypterDecrypter
-          - roles/owner
     services:
       - cloudkms.googleapis.com
       - cloudresourcemanager.googleapis.com

modules/udf/metadata.yaml

@@ -64,8 +64,6 @@ spec:
       - level: Project
         roles:
           - roles/bigquery.admin
-          - roles/cloudkms.cryptoKeyEncrypterDecrypter
-          - roles/owner
     services:
       - cloudkms.googleapis.com
       - cloudresourcemanager.googleapis.com

test/setup/iam.tf

@@ -16,9 +16,7 @@
 
 locals {
   int_required_roles = [
-    "roles/bigquery.admin",
-    "roles/cloudkms.cryptoKeyEncrypterDecrypter",
-    "roles/owner" // TODO: Descope
+    "roles/bigquery.admin"
   ]
 }