File tree Expand file tree Collapse file tree 3 files changed +22
-3
lines changed Expand file tree Collapse file tree 3 files changed +22
-3
lines changed Original file line number Diff line number Diff line change @@ -35,6 +35,8 @@ resource "google_secret_manager_secret" "snyk_token" {
35
35
resource "google_secret_manager_secret_version" "snyk_token_version" {
36
36
secret = google_secret_manager_secret. snyk_token . id
37
37
secret_data = var. SNYK_TOKEN
38
+
39
+ depends_on = [google_secret_manager_secret . snyk_token ]
38
40
}
39
41
40
42
# Pipelines
@@ -47,6 +49,7 @@ module "gcp_python_fastapi_pipeline" {
47
49
cloudbuild_trigger_name = " gcp-python-fastapi"
48
50
description = " Cloud Build Trigger for GCP Python FastAPI"
49
51
github_repo_name = " gcp-python-fastapi"
52
+ secret_id = google_secret_manager_secret. snyk_token . secret_id
50
53
51
54
depends_on = [
52
55
google_artifact_registry_repository . default ,
Original file line number Diff line number Diff line change @@ -13,15 +13,26 @@ resource "google_project_iam_member" "cloud_build_roles" {
13
13
" roles/source.admin" ,
14
14
" roles/storage.admin" ,
15
15
" roles/logging.logWriter" ,
16
- " roles/iam.serviceAccountUser" ,
17
- " roles/secretmanager.admin" ,
18
- " roles/secretmanager.secretAssessor"
16
+ " roles/iam.serviceAccountUser"
19
17
])
20
18
project = var. project_id
21
19
role = each. value
22
20
member = " serviceAccount:${ google_service_account . cloudbuild_service_account . email } "
23
21
}
24
22
23
+ resource "google_secret_manager_secret_iam_binding" "secret_manager_binding" {
24
+ for_each = toset ([
25
+ " roles/secretmanager.secretAccessor" ,
26
+ " roles/secretmanager.admin"
27
+ ])
28
+
29
+ project = var. project_id
30
+ secret_id = var. secret_id
31
+ role = each. value
32
+
33
+ members = [" serviceAccount:${ google_service_account . cloudbuild_service_account . email } " ]
34
+ }
35
+
25
36
resource "google_cloudbuild_trigger" "build_trigger" {
26
37
name = " gh-trigger-${ var . cloudbuild_trigger_name } "
27
38
description = var. description
Original file line number Diff line number Diff line change @@ -27,4 +27,9 @@ variable "project_id" {
27
27
variable "region" {
28
28
description = " Region where the Cloud Build trigger will be created"
29
29
type = string
30
+ }
31
+
32
+ variable "secret_id" {
33
+ description = " ID of the secret to be injected into the Cloud Build"
34
+ type = string
30
35
}
You can’t perform that action at this time.
0 commit comments