[修正] secretAccessorの紐づけ先をexternal secret operatorのSAに変更

[xpadev-net]

#35 の修正漏れ

[github-actions]

⚠️⚠️⚠️terraform/iam⚠️⚠️⚠️

Terraform Format and Style 🖌success

Terraform Plan 📖success

Show Plan

```terraform google_iam_workload_identity_pool.github-action-pool: Refreshing state... [id=projects/mitou-jr/locations/global/workloadIdentityPools/github-action] google_iam_workload_identity_pool_provider.github-action-pool-provider: Refreshing state... [id=projects/mitou-jr/locations/global/workloadIdentityPools/github-action/providers/github-action-provider] google_project_iam_custom_role.tfplanner: Refreshing state... [id=projects/mitou-jr/roles/tfplanner] google_service_account.sa-ga-basic-applier: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]] google_service_account.sa-ga-iam-applier: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]] google_storage_bucket_iam_binding.secret-bucket-access-binding: Refreshing state... [id=b/mitou-jr-secret/roles/storage.objectAdmin] google_project_iam_binding.monitoring-pubsub: Refreshing state... [id=mitou-jr/roles/pubsub.publisher] google_project_iam_binding.iam-binding-k8s-operation: Refreshing state... [id=mitou-jr/roles/container.developer] google_service_account.wi-secret-mattermost-primary: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]] google_service_account.sa-ga-planner: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]] google_service_account.wi-mattermost-primary: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]] google_project_iam_binding.secret-manager: Refreshing state... [id=mitou-jr/roles/secretmanager.secretAccessor] google_service_account_iam_binding.workload_identity_binding-basic: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]/roles/iam.workloadIdentityUser] google_project_iam_binding.iam-binding-basic-applier["roles/compute.networkAdmin"]: Refreshing state... [id=mitou-jr/roles/compute.networkAdmin] google_project_iam_binding.iam-binding-basic-applier["roles/cloudsql.admin"]: Refreshing state... [id=mitou-jr/roles/cloudsql.admin] google_project_iam_binding.iam-binding-basic-applier["roles/container.admin"]: Refreshing state... [id=mitou-jr/roles/container.admin] google_project_iam_binding.iam-binding-basic-applier["roles/storage.admin"]: Refreshing state... [id=mitou-jr/roles/storage.admin] google_project_iam_binding.iam-binding-iam-applier["roles/iam.securityAdmin"]: Refreshing state... [id=mitou-jr/roles/iam.securityAdmin] google_service_account_iam_binding.workload_identity_binding-iam: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]/roles/iam.workloadIdentityUser] google_service_account_iam_binding.workload_identity_binding-planner: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]/roles/iam.workloadIdentityUser] google_service_account_iam_binding.wi-bindings["mattermost/mattermost-primary"]: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]/roles/iam.workloadIdentityUser] google_service_account_iam_binding.wi-bindings["mattermost/secret-mattermost-primary"]: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]/roles/iam.workloadIdentityUser] google_storage_bucket_iam_binding.main-bucket-access-binding: Refreshing state... [id=b/mitou-jr/roles/storage.objectAdmin] google_storage_bucket_iam_binding.basic-tf-bucket-sa-binding: Refreshing state... [id=b/mitou-jr-tf-basic/roles/storage.objectAdmin] google_project_iam_binding.kms-key-users: Refreshing state... [id=mitou-jr/roles/cloudkms.cryptoKeyEncrypterDecrypter] google_storage_bucket_iam_binding.iam-tf-bucket-sa-binding: Refreshing state... [id=b/mitou-jr-tf-iam/roles/storage.objectAdmin] google_project_iam_binding.viewers: Refreshing state... [id=mitou-jr/roles/viewer] google_project_iam_binding.tf-planners: Refreshing state... [id=mitou-jr/projects/mitou-jr/roles/tfplanner]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply":

google_project_iam_binding.viewers has been changed

~ resource "google_project_iam_binding" "viewers" {
~ etag = "BwYXCiLlmVI=" -> "BwYXCk9pQCs="
id = "mitou-jr/roles/viewer"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.iam-binding-iam-applier["roles/iam.securityAdmin"] has been changed

~ resource "google_project_iam_binding" "iam-binding-iam-applier" {
~ etag = "BwYXCiLlmVI=" -> "BwYXCk9pQCs="
id = "mitou-jr/roles/iam.securityAdmin"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.tf-planners has been changed

~ resource "google_project_iam_binding" "tf-planners" {
~ etag = "BwYXCiLlmVI=" -> "BwYXCk9pQCs="
id = "mitou-jr/projects/mitou-jr/roles/tfplanner"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.iam-binding-basic-applier["roles/storage.admin"] has been changed

~ resource "google_project_iam_binding" "iam-binding-basic-applier" {
~ etag = "BwYXCiLlmVI=" -> "BwYXCk9pQCs="
id = "mitou-jr/roles/storage.admin"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.iam-binding-basic-applier["roles/cloudsql.admin"] has been changed

~ resource "google_project_iam_binding" "iam-binding-basic-applier" {
~ etag = "BwYXCiLlmVI=" -> "BwYXCk9pQCs="
id = "mitou-jr/roles/cloudsql.admin"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.iam-binding-basic-applier["roles/compute.networkAdmin"] has been changed

~ resource "google_project_iam_binding" "iam-binding-basic-applier" {
~ etag = "BwYXCiLlmVI=" -> "BwYXCk9pQCs="
id = "mitou-jr/roles/compute.networkAdmin"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.iam-binding-basic-applier["roles/container.admin"] has been changed

~ resource "google_project_iam_binding" "iam-binding-basic-applier" {
~ etag = "BwYXCiLlmVI=" -> "BwYXCk9pQCs="
id = "mitou-jr/roles/container.admin"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.kms-key-users has been changed

~ resource "google_project_iam_binding" "kms-key-users" {
~ etag = "BwYXCiLlmVI=" -> "BwYXCk9pQCs="
id = "mitou-jr/roles/cloudkms.cryptoKeyEncrypterDecrypter"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.iam-binding-k8s-operation has been changed

~ resource "google_project_iam_binding" "iam-binding-k8s-operation" {
~ etag = "BwYXCiLlmVI=" -> "BwYXCk9pQCs="
id = "mitou-jr/roles/container.developer"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.monitoring-pubsub has been changed

~ resource "google_project_iam_binding" "monitoring-pubsub" {
~ etag = "BwYXCiLlmVI=" -> "BwYXCk9pQCs="
id = "mitou-jr/roles/pubsub.publisher"
# (3 unchanged attributes hidden)
}

Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:

• create

• destroy

Terraform will perform the following actions:

google_service_account_iam_binding.wi-bindings["default/external-secrets"] will be created

• resource "google_service_account_iam_binding" "wi-bindings" {
  • etag = (known after apply)
  • id = (known after apply)
  • members = [
    • "serviceAccount:mitou-jr.svc.id.goog[default/external-secrets]",
      ]
  • role = "roles/iam.workloadIdentityUser"
  • service_account_id = "projects/mitou-jr/serviceAccounts/[email protected]"
    }

google_service_account_iam_binding.wi-bindings["mattermost/secret-mattermost-primary"] will be destroyed

• resource "google_service_account_iam_binding" "wi-bindings" {
  • etag = "BwYXCioUUKU=" -> null
  • id = "projects/mitou-jr/serviceAccounts/[email protected]/roles/iam.workloadIdentityUser" -> null
  • members = [
    • "serviceAccount:mitou-jr.svc.id.goog[mattermost/secret-mattermost-primary]",
      ] -> null
  • role = "roles/iam.workloadIdentityUser" -> null
  • service_account_id = "projects/mitou-jr/serviceAccounts/[email protected]" -> null
    }

Plan: 1 to add, 0 to change, 1 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

</details>