addressing comments

Author: Zheng Qin

metadata.yaml

@@ -387,10 +387,12 @@ spec:
       - level: Project
         roles:
           - roles/bigquery.admin
-          - roles/iam.serviceAccountAdmin
-          - roles/resourcemanager.projectIamAdmin
+          - roles/storage.admin
+          - roles/cloudkms.cryptoKeyEncrypterDecrypter
     services:
       - bigquery.googleapis.com
+      - bigquerystorage.googleapis.com
+      - cloudkms.googleapis.com
       - cloudresourcemanager.googleapis.com
       - iam.googleapis.com
     providerVersions:

modules/authorization/metadata.yaml

@@ -93,20 +93,20 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/run.invoker
+          - roles/storage.admin
           - roles/workflows.admin
+          - roles/bigquery.admin
+          - roles/aiplatform.admin
           - roles/cloudfunctions.admin
           - roles/dataform.admin
-          - roles/datalineage.viewer
-          - roles/iam.serviceAccountAdmin
           - roles/iam.serviceAccountTokenCreator
           - roles/iam.serviceAccountUser
           - roles/logging.configWriter
-          - roles/resourcemanager.projectIamAdmin
-          - roles/bigquery.admin
-          - roles/aiplatform.admin
-          - roles/run.invoker
           - roles/serviceusage.serviceUsageAdmin
-          - roles/storage.admin
+          - roles/datalineage.viewer
+          - roles/iam.serviceAccountAdmin
+          - roles/resourcemanager.projectIamAdmin
     services:
       - bigquery.googleapis.com
       - bigqueryconnection.googleapis.com

modules/data_warehouse/metadata.yaml

@@ -135,20 +135,20 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/storage.admin
+          - roles/aiplatform.admin
+          - roles/cloudfunctions.admin
           - roles/dataform.admin
+          - roles/iam.serviceAccountUser
+          - roles/serviceusage.serviceUsageAdmin
+          - roles/workflows.admin
+          - roles/bigquery.admin
           - roles/datalineage.viewer
+          - roles/iam.serviceAccountAdmin
           - roles/iam.serviceAccountTokenCreator
           - roles/logging.configWriter
-          - roles/run.invoker
-          - roles/workflows.admin
-          - roles/aiplatform.admin
-          - roles/iam.serviceAccountAdmin
-          - roles/iam.serviceAccountUser
           - roles/resourcemanager.projectIamAdmin
-          - roles/serviceusage.serviceUsageAdmin
-          - roles/storage.admin
-          - roles/bigquery.admin
-          - roles/cloudfunctions.admin
+          - roles/run.invoker
     services:
       - bigquery.googleapis.com
       - bigqueryconnection.googleapis.com

modules/scheduled_queries/metadata.yaml

@@ -60,19 +60,19 @@ spec:
       - level: Project
         roles:
           - roles/cloudfunctions.admin
-          - roles/iam.serviceAccountAdmin
-          - roles/serviceusage.serviceUsageAdmin
-          - roles/storage.admin
-          - roles/workflows.admin
-          - roles/aiplatform.admin
           - roles/dataform.admin
           - roles/datalineage.viewer
-          - roles/iam.serviceAccountTokenCreator
-          - roles/iam.serviceAccountUser
-          - roles/logging.configWriter
           - roles/resourcemanager.projectIamAdmin
           - roles/run.invoker
+          - roles/workflows.admin
           - roles/bigquery.admin
+          - roles/aiplatform.admin
+          - roles/iam.serviceAccountAdmin
+          - roles/iam.serviceAccountTokenCreator
+          - roles/iam.serviceAccountUser
+          - roles/logging.configWriter
+          - roles/serviceusage.serviceUsageAdmin
+          - roles/storage.admin
     services:
       - bigquery.googleapis.com
       - bigqueryconnection.googleapis.com

modules/udf/metadata.yaml

@@ -63,20 +63,20 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/dataform.admin
           - roles/iam.serviceAccountAdmin
+          - roles/iam.serviceAccountTokenCreator
           - roles/iam.serviceAccountUser
           - roles/resourcemanager.projectIamAdmin
+          - roles/serviceusage.serviceUsageAdmin
+          - roles/bigquery.admin
+          - roles/cloudfunctions.admin
+          - roles/logging.configWriter
           - roles/run.invoker
+          - roles/storage.admin
           - roles/workflows.admin
-          - roles/bigquery.admin
           - roles/aiplatform.admin
+          - roles/dataform.admin
           - roles/datalineage.viewer
-          - roles/iam.serviceAccountTokenCreator
-          - roles/logging.configWriter
-          - roles/serviceusage.serviceUsageAdmin
-          - roles/storage.admin
-          - roles/cloudfunctions.admin
     services:
       - bigquery.googleapis.com
       - bigqueryconnection.googleapis.com

test/setup/iam.tf

@@ -18,8 +18,8 @@ locals {
   per_module_roles = {
     root = [
       "roles/bigquery.admin",
-      "roles/iam.serviceAccountAdmin",
-      "roles/resourcemanager.projectIamAdmin",
+      "roles/storage.admin",
+      "roles/cloudkms.cryptoKeyEncrypterDecrypter",
     ]
     authorization = [
       "roles/bigquery.admin",

test/setup/main.tf

@@ -16,9 +16,11 @@
 locals {
   per_module_services = {
     root = [
+      "iam.googleapis.com",
+      "cloudkms.googleapis.com",
       "cloudresourcemanager.googleapis.com",
       "bigquery.googleapis.com",
-      "iam.googleapis.com",
+      "bigquerystorage.googleapis.com",
     ]
     authorization = [
       "cloudkms.googleapis.com",