Google Cloud Storage

provider "google" {
  project = "<PROJECT_ID>"
}
 
data "google_project" "project" {}
 
# GCS バケット（既存バケットを使う場合は不要）
resource "google_storage_bucket" "bucket" {
  name     = "<BUCKET_NAME>"
  location = "asia-northeast1"
 
  uniform_bucket_level_access = true
}
 
# ベースマキナが権限借用するサービスアカウント
resource "google_service_account" "sa" {
  account_id   = "<SA_NAME>"
  display_name = "<SA_NAME>"
}
 
# サービスアカウントにバケットの読み書き権限を付与
resource "google_storage_bucket_iam_member" "object_admin" {
  bucket = google_storage_bucket.bucket.name
  role   = "roles/storage.objectAdmin"
  member = "serviceAccount:${google_service_account.sa.email}"
}
 
# Workload Identity Federation Pool
resource "google_iam_workload_identity_pool" "pool" {
  workload_identity_pool_id = "basemachina"
  display_name              = "BaseMachina"
}
 
# Workload Identity Federation Pool Provider
resource "google_iam_workload_identity_pool_provider" "provider" {
  workload_identity_pool_id          = google_iam_workload_identity_pool.pool.workload_identity_pool_id
  workload_identity_pool_provider_id = "basemachina"
  display_name                       = "BaseMachina"
 
  oidc {
    issuer_uri = "https://idp.basemachina.com"
  }
 
  attribute_mapping = {
    "google.subject"       = "assertion.sub"
    "attribute.project_id" = "assertion.project_id"
  }
}
 
# サービスアカウントの権限借用を許可
resource "google_service_account_iam_member" "workload_identity_user" {
  service_account_id = google_service_account.sa.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "principalSet://iam.googleapis.com/projects/${data.google_project.project.number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.pool.workload_identity_pool_id}/*"
}
 
# 署名付き URL 発行用の signBlob 権限（最小権限のカスタムロール）
resource "google_project_iam_custom_role" "sign_blob" {
  role_id     = "customSignBlob"
  title       = "Custom Sign Blob"
  description = "Allows signing blobs with service account keys"
  permissions = ["iam.serviceAccounts.signBlob"]
}
 
resource "google_service_account_iam_member" "sign_blob" {
  service_account_id = google_service_account.sa.name
  role               = "projects/${data.google_project.project.project_id}/roles/${google_project_iam_custom_role.sign_blob.role_id}"
  member             = "serviceAccount:${google_service_account.sa.email}"
}