addressing comment

Author: Zheng Qin

modules/backend/metadata.yaml

@@ -331,16 +331,19 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/run.admin
+          - roles/compute.networkAdmin
           - roles/iap.admin
           - roles/iam.serviceAccountUser
           - roles/iam.serviceAccountAdmin
           - roles/compute.admin
           - roles/storage.admin
-          - roles/run.admin
-          - roles/compute.networkAdmin
     services:
       - cloudresourcemanager.googleapis.com
       - compute.googleapis.com
+      - run.googleapis.com
+      - storage-api.googleapis.com
+      - vpcaccess.googleapis.com
     providerVersions:
       - source: hashicorp/google
         version: ">= 6.0, < 7"

modules/dynamic_backends/metadata.yaml

@@ -328,13 +328,13 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/storage.admin
+          - roles/compute.admin
           - roles/run.admin
           - roles/iam.serviceAccountUser
           - roles/certificatemanager.owner
           - roles/vpcaccess.admin
           - roles/iam.serviceAccountAdmin
-          - roles/storage.admin
-          - roles/compute.admin
     services:
       - certificatemanager.googleapis.com
       - cloudresourcemanager.googleapis.com

modules/frontend/metadata.yaml

@@ -244,13 +244,16 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/certificatemanager.owner
-          - roles/iam.serviceAccountUser
           - roles/compute.admin
+          - roles/storage.admin
           - roles/iap.admin
+          - roles/certificatemanager.owner
+          - roles/iam.serviceAccountUser
     services:
       - certificatemanager.googleapis.com
       - compute.googleapis.com
+      - run.googleapis.com
+      - storage-api.googleapis.com
     providerVersions:
       - source: hashicorp/google
         version: ">= 6.0, < 7"

modules/serverless_negs/metadata.yaml

@@ -292,13 +292,13 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/vpcaccess.admin
+          - roles/iam.serviceAccountAdmin
           - roles/storage.admin
           - roles/compute.admin
           - roles/run.admin
           - roles/iam.serviceAccountUser
           - roles/certificatemanager.owner
-          - roles/vpcaccess.admin
-          - roles/iam.serviceAccountAdmin
     services:
       - certificatemanager.googleapis.com
       - cloudresourcemanager.googleapis.com

test/setup/iam.tf

@@ -45,6 +45,7 @@ locals {
     ]
     frontend = [
       "roles/compute.admin",
+      "roles/storage.admin",
       "roles/iap.admin",
       "roles/certificatemanager.owner",
       "roles/iam.serviceAccountUser"

test/setup/main.tf

@@ -28,6 +28,9 @@ locals {
     ]
     backend = [
       "compute.googleapis.com",
+      "run.googleapis.com",
+      "storage-api.googleapis.com",
+      "vpcaccess.googleapis.com",
       "cloudresourcemanager.googleapis.com",
     ]
     dynamic_backends = [
@@ -42,6 +45,8 @@ locals {
     ]
     frontend = [
       "compute.googleapis.com",
+      "storage-api.googleapis.com",
+      "run.googleapis.com",
       "certificatemanager.googleapis.com",
     ]
     serverless_negs = [