Cloud Functions第2世代移行で直面したIAM設定の変更点とカスタムサービスアカウントの実装

# 第1世代ではこう書いていた
resource "google_cloudfunctions_function_iam_member" "invoker" {
  project        = var.project_id
  region         = "asia-northeast1"
  cloud_function = "my-function"
  role           = "roles/cloudfunctions.invoker"
  member         = "serviceAccount:${var.service_account_email}"
}

# 第2世代ではCloud Runのリソースを使う必要がある
resource "google_cloud_run_service_iam_member" "invoker" {
  project  = var.project_id
  location = "asia-northeast1"
  service  = "my-function"  # 関数名がそのままサービス名になる
  role     = "roles/run.invoker"  # ロールも変わっている！
  member   = "serviceAccount:${var.service_account_email}"
}

resource "google_project_iam_member" "cloud_build_permissions_gen1" {
  for_each = toset([
    "roles/cloudfunctions.developer",  # Cloud Functions開発者
    "roles/iam.serviceAccountUser",    # サービスアカウント使用権限
  ])
  project = var.project_id
  role    = each.value
  member  = "serviceAccount:${google_service_account.cloud_build.email}"
}

resource "google_project_iam_member" "cloud_build_permissions_gen2" {
  for_each = toset([
    "roles/cloudfunctions.developer",  # Cloud Functions開発者（まだ必要）
    "roles/run.admin",                 # Cloud Run管理者権限が追加で必要！
    "roles/iam.serviceAccountUser",    # サービスアカウント使用権限
    "roles/eventarc.admin",            # Pub/Subトリガーを使う場合は必須
    "roles/artifactregistry.reader",   # コンテナイメージへのアクセス
  ])
  project = var.project_id
  role    = each.value
  member  = "serviceAccount:${google_service_account.cloud_build.email}"
}

# Cloud Build用サービスアカウント（デプロイを実行する）
resource "google_service_account" "cloud_build" {
  account_id   = "cloud-build-deployer"
  project      = var.project_id
  display_name = "Cloud Build Deployer"
  description  = "Cloud Functionsのデプロイを実行するサービスアカウント"
}

# Cloud Functions実行用サービスアカウント
resource "google_service_account" "cloud_functions" {
  account_id   = "cf-my-function"
  project      = var.project_id
  display_name = "Cloud Functions Runtime"
  description  = "Cloud Functions実行時に使用するサービスアカウント"
}

# Cloud BuildがFunctionsのサービスアカウントを使用するための権限
resource "google_service_account_iam_member" "cloud_build_act_as" {
  service_account_id = google_service_account.cloud_functions.name
  role               = "roles/iam.serviceAccountUser"
  member             = "serviceAccount:${google_service_account.cloud_build.email}"
}

resource "google_cloud_run_service_iam_member" "pubsub_invoker" {
  project  = var.project_id
  location = "asia-northeast1"
  service  = "my-function"
  role     = "roles/run.invoker"
  member   = "serviceAccount:service-${var.project_number}@gcp-sa-pubsub.iam.gserviceaccount.com"
}

# Cloud Buildサービスアカウントに追加で必要な権限
resource "google_project_iam_member" "cloud_build_additional" {
  for_each = toset([
    "roles/storage.objectViewer",     # ソースコードへのアクセス
    "roles/logging.logWriter",        # ビルドログの書き込み
  ])
  project = var.project_id
  role    = each.value
  member  = "serviceAccount:${google_service_account.cloud_build.email}"
}

steps:
  - id: deploy cloud function
    name: gcr.io/google.com/cloudsdktool/cloud-sdk
    entrypoint: 'bash'
    args:
      - '-c'
      - |
        gcloud functions deploy my-function \
        --gen2 \
        --region=asia-northeast1 \
        --trigger-topic=my-topic \
        --runtime=nodejs20 \
        --entry-point=main \
        --service-account=${_CF_SERVICE_ACCOUNT}@${PROJECT_ID}.iam.gserviceaccount.com

# Secret Managerへのアクセス権限
resource "google_secret_manager_secret_iam_member" "function_secrets" {
  for_each = toset([
    "API_KEY",
    "DATABASE_PASSWORD",
  ])
  project   = var.project_id
  secret_id = each.value
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.cloud_functions.email}"
}

--set-secrets="API_KEY=API_KEY:latest" \
--set-secrets="DB_PASSWORD=DATABASE_PASSWORD:latest"

正しい: service-123456789@gcp-sa-pubsub.iam.gserviceaccount.com
間違い: service-my-project-id@gcp-sa-pubsub.iam.gserviceaccount.com