remove owner role

Author: q2w

metadata.yaml

@@ -333,8 +333,11 @@ spec:
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/storage.admin
+          - roles/compute.admin
+          - roles/run.admin
+          - roles/iam.serviceAccountUser
+          - roles/certificatemanager.owner
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

modules/backend/metadata.yaml

@@ -300,8 +300,11 @@ spec:
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/storage.admin
+          - roles/compute.admin
+          - roles/run.admin
+          - roles/iam.serviceAccountUser
+          - roles/certificatemanager.owner
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

modules/dynamic_backends/metadata.yaml

@@ -325,8 +325,11 @@ spec:
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/storage.admin
+          - roles/compute.admin
+          - roles/run.admin
+          - roles/iam.serviceAccountUser
+          - roles/certificatemanager.owner
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

modules/frontend/metadata.yaml

@@ -214,8 +214,11 @@ spec:
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/storage.admin
+          - roles/compute.admin
+          - roles/run.admin
+          - roles/iam.serviceAccountUser
+          - roles/certificatemanager.owner
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

modules/serverless_negs/metadata.yaml

@@ -289,8 +289,11 @@ spec:
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/storage.admin
+          - roles/compute.admin
+          - roles/run.admin
+          - roles/iam.serviceAccountUser
+          - roles/certificatemanager.owner
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

test/setup/iam.tf

@@ -16,8 +16,11 @@
 
 locals {
   int_required_project_roles = [
-    "roles/owner",
-    "roles/storage.admin"
+    "roles/storage.admin",
+    "roles/compute.admin",
+    "roles/run.admin",
+    "roles/iam.serviceAccountUser",
+    "roles/certificatemanager.owner"
   ]
   int_required_folder_roles = [
     "roles/compute.xpnAdmin"