Adding support for service account impersonation and short lived tokens

[rjerrems]

Hi Guys,

Here is a first cut at adding support for short lived tokens / service account impersonation to address this issue:

#243

I have refactored the service account deletion script (renamed to modify-service-account.sh) and updated the preconditions checking script.

Before merge I will need to work on getting tests to pass but was having some trouble getting the full test suite to run locally.

Thanks

[morgante]

Instead of a separate service block, we should inject this into the activate_apis. (In particular, this would break in the case of authoritatively setting the project services.)

[rjerrems]

This has been fixed in the latest commit and is injected in the locals block.

[morgante]

Renaming the resource is likely to lead to some issues with existing projects (causing state migrations). I'd prefer if we kept these as two separate null_resources.

[rjerrems]

Cool make sense, this has been fixed in the latest commit.

[morgante]

Make sure to run the format/linting commands.

[rjerrems]

No problem, this formatting change was the result of running terraform fmt FYI, running make -s has a bunch of errors locally for me for files I haven't touched, perhaps I am using a different version of shellcheck. Mine is 0.4.7, here is a sample of the errors:

In ./helpers/setup-sa.sh line 171:
\ \ - serviceAccount:${SA_ID}\\
^-- SC1117: Backslash is literal in "\ ". Prefer explicit escaping: "\\ ".
  ^-- SC1117: Backslash is literal in "\ ". Prefer explicit escaping: "\\ ".


In ./helpers/setup-sa.sh line 172:
\ \ role: roles/billing.user" policy-tmp-$$.yml && rm policy-tmp-$$.yml.bak
^-- SC1117: Backslash is literal in "\ ". Prefer explicit escaping: "\\ ".
  ^-- SC1117: Backslash is literal in "\ ". Prefer explicit escaping: "\\ ".

[rjerrems]

I have run through the integration tests three times from the last commit and it looks like it is working most of the time, although I have seen this error once (and a couple times on previous commit)

       Error: Invalid count argument
       
         on ../../../modules/core_project_factory/main.tf line 113, in resource "null_resource" "check_if_shared_vpc_subnets_contains_items_with_invalid_name":
        113:   count = length(
        114:     compact(null_resource.shared_vpc_subnet_invalid_name.*.triggers.name),
        115:   ) == 0 ? 0 : 1
       
       The "count" value depends on resource attributes that cannot be determined
       until apply, so Terraform cannot predict how many instances will be created.
       To work around this, use the -target argument to first apply only the
       resources that the count depends on.

Is this a known issue or something I may have introduced?

[aaron-lane]

@rjerrems that issue is a regression which exists on the master branch so it's not caused by your changes.

[rjerrems]

Ok cool - good to know. Thanks @aaron-lane

[rjerrems]

Hi Guys, Just giving this a nudge - let me know if there is anything that needs to be worked on for this?