Added SA for Astro Airflow user

terraform/database.tf

@@ -1,31 +1,31 @@
-# Create a Cloud SQL DB instance for Cloud Composer Backend
-resource "google_sql_database_instance" "flyte_db_backend" {
-  name             = "flyte-db-backend"
-  database_version = "POSTGRES_14"
-  region           = local.region
+# # Create a Cloud SQL DB instance for Cloud Composer Backend
+# resource "google_sql_database_instance" "flyte_db_backend" {
+#   name             = "flyte-db-backend"
+#   database_version = "POSTGRES_14"
+#   region           = local.region
 
-  settings {
-    tier = "db-f1-micro"
+#   settings {
+#     tier = "db-f1-micro"
 
-    # ip_configuration {
-    #   require_ssl = true
-    # }
-    disk_size         = 10
-    disk_type         = "PD_HDD"
-    activation_policy = "ALWAYS"
-  }
+#     # ip_configuration {
+#     #   require_ssl = true
+#     # }
+#     disk_size         = 10
+#     disk_type         = "PD_HDD"
+#     activation_policy = "ALWAYS"
+#   }
 
-  depends_on = [google_project_service.cloud_sql_api]
-}
+#   depends_on = [google_project_service.cloud_sql_api]
+# }
 
-resource "random_password" "flyte_db_password" {
-  length           = 16
-  special          = true
-  override_special = "_@#"
-}
+# resource "random_password" "flyte_db_password" {
+#   length           = 16
+#   special          = true
+#   override_special = "_@#"
+# }
 
-resource "google_sql_user" "flyte_db_user" {
-  name     = "postgres"
-  instance = google_sql_database_instance.flyte_db_backend.name
-  password = random_password.flyte_db_password.result
-}
+# resource "google_sql_user" "flyte_db_user" {
+#   name     = "postgres"
+#   instance = google_sql_database_instance.flyte_db_backend.name
+#   password = random_password.flyte_db_password.result
+# }

terraform/service_accounts.tf

@@ -22,3 +22,28 @@
 #   role               = "roles/composer.ServiceAgentV2Ext"
 #   member             = "serviceAccount:service-${local.number}@cloudcomposer-accounts.iam.gserviceaccount.com"
 # }
+
+
+resource "google_service_account" "airflow_user_sa" {
+  account_id   = "airflow-user-sa"
+  display_name = "Custom Service Account for Astro Airflow User"
+}
+
+
+resource "google_project_iam_binding" "gcs_access" {
+  project = local.id
+  role    = "roles/storage.objectAdmin"
+  members = ["serviceAccount:${google_service_account.airflow_user_sa.email}"]
+}
+
+resource "google_project_iam_binding" "bq_access" {
+  project = local.id
+  role    = "roles/bigquery.dataEditor"
+  members = ["serviceAccount:${google_service_account.airflow_user_sa.email}"]
+}
+
+resource "google_project_iam_binding" "gsm_access" {
+  project = local.id
+  role    = "roles/secretmanager.secretAccessor"
+  members = ["serviceAccount:${google_service_account.airflow_user_sa.email}"]
+}