using roles/certificatemanager.owner role in frontend module

Author: Zheng Qin

metadata.yaml

@@ -336,13 +336,13 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/storage.admin
-          - roles/compute.admin
           - roles/run.admin
           - roles/iam.serviceAccountUser
           - roles/certificatemanager.owner
           - roles/vpcaccess.admin
           - roles/iam.serviceAccountAdmin
+          - roles/storage.admin
+          - roles/compute.admin
     services:
       - certificatemanager.googleapis.com
       - cloudresourcemanager.googleapis.com

modules/backend/metadata.yaml

@@ -323,13 +323,13 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/iap.admin
+          - roles/iam.serviceAccountUser
+          - roles/iam.serviceAccountAdmin
           - roles/compute.admin
           - roles/storage.admin
           - roles/run.admin
           - roles/compute.networkAdmin
-          - roles/iap.admin
-          - roles/iam.serviceAccountUser
-          - roles/iam.serviceAccountAdmin
     services:
       - cloudresourcemanager.googleapis.com
       - compute.googleapis.com

modules/dynamic_backends/metadata.yaml

@@ -328,13 +328,13 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/run.admin
+          - roles/iam.serviceAccountUser
+          - roles/certificatemanager.owner
           - roles/vpcaccess.admin
           - roles/iam.serviceAccountAdmin
           - roles/storage.admin
           - roles/compute.admin
-          - roles/run.admin
-          - roles/iam.serviceAccountUser
-          - roles/certificatemanager.owner
     services:
       - certificatemanager.googleapis.com
       - cloudresourcemanager.googleapis.com

modules/frontend/metadata.yaml

@@ -236,9 +236,10 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/certificatemanager.owner
+          - roles/iam.serviceAccountUser
           - roles/compute.admin
           - roles/iap.admin
-          - roles/iam.serviceAccountUser
     services:
       - certificatemanager.googleapis.com
       - compute.googleapis.com

test/setup/iam.tf

@@ -46,6 +46,7 @@ locals {
     frontend = [
       "roles/compute.admin",
       "roles/iap.admin",
+      "roles/certificatemanager.owner",
       "roles/iam.serviceAccountUser"
     ]
     serverless_negs = [