google_service_account.trigger_sa.email might have redundant grants in the terraform modules
In infra/modules/firebase-hosting-service/main.tf#L53-L58:
# 5. Give the trigger SA permission to write logs
resource "google_project_iam_member" "logging_writer" {
project = var.gcp_project_id
role = "roles/logging.logWriter"
member = "serviceAccount:${google_service_account.trigger_sa.email}"
}
And in infra/modules/cloud-run-service/main.tf:
resource "google_project_iam_member" "logging_writer_binding" {
project = var.gcp_project_id
role = "roles/logging.logWriter"
member = "serviceAccount:${google_service_account.trigger_sa.email}"
}
Since google_project_iam_member is non-authoritative this should be safe but Terraform will still track both entries in the state, flagging to verify whether it's intended or not.
google_service_account.trigger_sa.emailmight have redundant grants in the terraform modulesIn infra/modules/firebase-hosting-service/main.tf#L53-L58:
And in infra/modules/cloud-run-service/main.tf:
Since
google_project_iam_memberis non-authoritative this should be safe but Terraform will still track both entries in the state, flagging to verify whether it's intended or not.