fix: removed owner roles and added service specific roles

Author: pawan1210

metadata.yaml

@@ -340,7 +340,8 @@ spec:
           - roles/run.admin
           - roles/iam.serviceAccountUser
           - roles/certificatemanager.owner
-          - roles/owner
+          - roles/vpcaccess.admin
+          - roles/iam.serviceAccountCreator
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

modules/backend/metadata.yaml

@@ -307,7 +307,8 @@ spec:
           - roles/run.admin
           - roles/iam.serviceAccountUser
           - roles/certificatemanager.owner
-          - roles/owner
+          - roles/vpcaccess.admin
+          - roles/iam.serviceAccountCreator
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

modules/dynamic_backends/metadata.yaml

@@ -332,7 +332,8 @@ spec:
           - roles/run.admin
           - roles/iam.serviceAccountUser
           - roles/certificatemanager.owner
-          - roles/owner
+          - roles/vpcaccess.admin
+          - roles/iam.serviceAccountCreator
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

modules/frontend/metadata.yaml

@@ -229,7 +229,8 @@ spec:
           - roles/run.admin
           - roles/iam.serviceAccountUser
           - roles/certificatemanager.owner
-          - roles/owner
+          - roles/vpcaccess.admin
+          - roles/iam.serviceAccountCreator
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

modules/serverless_negs/metadata.yaml

@@ -296,7 +296,8 @@ spec:
           - roles/run.admin
           - roles/iam.serviceAccountUser
           - roles/certificatemanager.owner
-          - roles/owner
+          - roles/vpcaccess.admin
+          - roles/iam.serviceAccountCreator
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

test/setup/iam.tf

@@ -19,9 +19,10 @@ locals {
     "roles/storage.admin",
     "roles/compute.admin",
     "roles/run.admin",
-    "roles/iam.serviceAccountUser",
+    "roles/iam.serviceAccountUser",    
     "roles/certificatemanager.owner",
-    "roles/owner"
+    "roles/vpcaccess.admin",
+    "roles/iam.serviceAccountCreator"
   ]
   int_required_folder_roles = [
     "roles/compute.xpnAdmin"