小编Ani*_*ket的帖子

我创建了一个 terraform 文件来创建具有公共可读存储对象权限的 Google 存储桶。我能够部署存储桶，但无法针对我的模板分配正确的 ACL，我发现 ACL 部分有一些错误。

provider "google-beta" {
  project = "${var.project}"
}

 resource "google_storage_default_object_access_control" "public_rule" {
  bucket = "google_storage_bucket.test-${var.project}"
  role   = "READER"
  entity = "allUsers"
 }

resource "google_storage_bucket" "bucket" {
  name = "test-${var.project}"
  storage_class = "standard"
  location = "US"
}

错误：已附

如果有人可以帮助我在创建存储桶时分配权限，那就太好了。

想要通过 terraform 将多个 IAM 角色分配给单个服务帐户。准备了一个 tf 文件来执行此操作，但发现一些错误，如果我使用单个角色，那么它可以成功分配，但是当我尝试多个 IAM 角色时，它给出了一些错误。

data "google_iam_policy" "auth1" {
  binding {
    role = "roles/cloudsql.admin"
    members = [
      "serviceAccount:${google_service_account.service_account_1.email}",
    ]    
    role = "roles/secretmanager.secretAccessor"
    members = [
      "serviceAccount:${google_service_account.service_account_1.email}",
    ]      
    role = "roles/datastore.owner"
    members = [
      "serviceAccount:${google_service_account.service_account_1.email}",
    ]  
    role = "roles/storage.admin"
    members = [
      "serviceAccount:${google_service_account.service_account_1.email}",
    ]      
  }
}

您能帮我解决一下，如何针对单个服务帐户分配多个角色。

我想使用 terraform 部署一个谷歌云运行服务。当我尝试通过“端口”块进行部署以定义容器端口时，出现错误，我必须从模板标记传递容器端口，但无法这样做。这是我的 .tf 文件 -

resource "google_cloud_run_service" "default" {
  name     = "cloudrun-srv"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "us.gcr.io/xxxxxx/xxxx.app"

        port {
          container_port = 19006
        }
      }
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
}

data "google_iam_policy" "noauth" {
  binding {
    role = "roles/run.invoker"
    members = [
      "allUsers",
    ]
  }
}

resource "google_cloud_run_service_iam_policy" "noauth" {
  location    = google_cloud_run_service.default.location
  project     = google_cloud_run_service.default.project
  service     = google_cloud_run_service.default.name

  policy_data = data.google_iam_policy.noauth.policy_data
}

output "url" { …