Add another permission

SkyTruth · Oct 25, 2023 · 86232f6 · 86232f6
1 parent 4432de6
commit 86232f6
Showing 1 changed file with 11 additions and 1 deletion.
diff --git a/stack/cloud_run_orchestrator.py b/stack/cloud_run_orchestrator.py
@@ -29,14 +29,24 @@
 )
 
 cloud_function_service_account_iam = gcp.projects.IAMMember(
-    construct_name("cloud-run-orchestrator"),
+    construct_name("cloud-run-orchestrator-cloudTasksEnqueuer"),
     project=pulumi.Config("gcp").require("project"),
     role="roles/cloudtasks.enqueuer",
     member=cloud_function_service_account.email.apply(
         lambda email: f"serviceAccount:{email}"
     ),
 )
 
+cloud_function_service_account_iam = gcp.projects.IAMMember(
+    construct_name("cloud-run-orchestrator-cloudSqlClient"),
+    project=pulumi.Config("gcp").require("project"),
+    role="roles/cloudsql.client",
+    member=cloud_function_service_account.email.apply(
+        lambda email: f"serviceAccount:{email}"
+    ),
+)
+
+
 service_name = construct_name("cloud-run-orchestrator")
 default = gcp.cloudrun.Service(
     service_name,