update per module configs

Author: Zheng Qin

metadata.yaml

@@ -359,15 +359,26 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/resourcemanager.organizationAdmin
-          - roles/serviceusage.serviceUsageAdmin
+          - roles/compute.admin
           - roles/iam.serviceAccountAdmin
+          - roles/resourcemanager.projectIamAdmin
+          - roles/storage.admin
           - roles/iam.serviceAccountUser
-          - roles/logging.logWriter
+          - roles/billing.projectManager
     services:
+      - accesscontextmanager.googleapis.com
+      - admin.googleapis.com
+      - appengine.googleapis.com
+      - billingbudgets.googleapis.com
       - cloudbilling.googleapis.com
       - cloudresourcemanager.googleapis.com
+      - compute.googleapis.com
+      - essentialcontacts.googleapis.com
       - iam.googleapis.com
+      - iamcredentials.googleapis.com
+      - oslogin.googleapis.com
+      - pubsub.googleapis.com
+      - serviceconsumermanagement.googleapis.com
       - serviceusage.googleapis.com
     providerVersions:
       - source: hashicorp/google

modules/budget/metadata.yaml

@@ -122,9 +122,26 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/logging.logWriter
+          - roles/billing.projectManager
+          - roles/compute.admin
+          - roles/iam.serviceAccountAdmin
+          - roles/resourcemanager.projectIamAdmin
+          - roles/storage.admin
+          - roles/iam.serviceAccountUser
     services:
+      - accesscontextmanager.googleapis.com
+      - admin.googleapis.com
+      - appengine.googleapis.com
       - billingbudgets.googleapis.com
+      - cloudbilling.googleapis.com
+      - cloudresourcemanager.googleapis.com
+      - compute.googleapis.com
+      - essentialcontacts.googleapis.com
+      - iam.googleapis.com
+      - iamcredentials.googleapis.com
+      - oslogin.googleapis.com
+      - pubsub.googleapis.com
+      - serviceconsumermanagement.googleapis.com
       - serviceusage.googleapis.com
     providerVersions:
       - source: hashicorp/google

modules/essential_contacts/metadata.yaml

@@ -79,10 +79,26 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/essentialcontacts.configEditor
-          - roles/logging.logWriter
+          - roles/compute.admin
+          - roles/iam.serviceAccountAdmin
+          - roles/resourcemanager.projectIamAdmin
+          - roles/storage.admin
+          - roles/iam.serviceAccountUser
+          - roles/billing.projectManager
     services:
+      - accesscontextmanager.googleapis.com
+      - admin.googleapis.com
+      - appengine.googleapis.com
+      - billingbudgets.googleapis.com
+      - cloudbilling.googleapis.com
+      - cloudresourcemanager.googleapis.com
+      - compute.googleapis.com
       - essentialcontacts.googleapis.com
+      - iam.googleapis.com
+      - iamcredentials.googleapis.com
+      - oslogin.googleapis.com
+      - pubsub.googleapis.com
+      - serviceconsumermanagement.googleapis.com
       - serviceusage.googleapis.com
     providerVersions:
       - source: hashicorp/google

modules/fabric-project/metadata.yaml

@@ -153,10 +153,26 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/logging.logWriter
           - roles/resourcemanager.projectIamAdmin
+          - roles/storage.admin
+          - roles/iam.serviceAccountUser
+          - roles/billing.projectManager
+          - roles/compute.admin
+          - roles/iam.serviceAccountAdmin
     services:
+      - accesscontextmanager.googleapis.com
+      - admin.googleapis.com
+      - appengine.googleapis.com
+      - billingbudgets.googleapis.com
+      - cloudbilling.googleapis.com
       - cloudresourcemanager.googleapis.com
+      - compute.googleapis.com
+      - essentialcontacts.googleapis.com
+      - iam.googleapis.com
+      - iamcredentials.googleapis.com
+      - oslogin.googleapis.com
+      - pubsub.googleapis.com
+      - serviceconsumermanagement.googleapis.com
       - serviceusage.googleapis.com
     providerVersions:
       - source: hashicorp/google

modules/gsuite_enabled/metadata.yaml

@@ -250,10 +250,26 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/cloudidentity.groupMemberAdmin
-          - roles/logging.logWriter
+          - roles/iam.serviceAccountUser
+          - roles/billing.projectManager
+          - roles/compute.admin
+          - roles/iam.serviceAccountAdmin
+          - roles/resourcemanager.projectIamAdmin
+          - roles/storage.admin
     services:
-      - cloudidentity.googleapis.com
+      - accesscontextmanager.googleapis.com
+      - admin.googleapis.com
+      - appengine.googleapis.com
+      - billingbudgets.googleapis.com
+      - cloudbilling.googleapis.com
+      - cloudresourcemanager.googleapis.com
+      - compute.googleapis.com
+      - essentialcontacts.googleapis.com
+      - iam.googleapis.com
+      - iamcredentials.googleapis.com
+      - oslogin.googleapis.com
+      - pubsub.googleapis.com
+      - serviceconsumermanagement.googleapis.com
       - serviceusage.googleapis.com
     providerVersions:
       - source: DeviaVir/gsuite

modules/project_services/metadata.yaml

@@ -104,9 +104,26 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/serviceusage.serviceUsageAdmin
-          - roles/logging.logWriter
+          - roles/iam.serviceAccountAdmin
+          - roles/resourcemanager.projectIamAdmin
+          - roles/storage.admin
+          - roles/iam.serviceAccountUser
+          - roles/billing.projectManager
+          - roles/compute.admin
     services:
+      - accesscontextmanager.googleapis.com
+      - admin.googleapis.com
+      - appengine.googleapis.com
+      - billingbudgets.googleapis.com
+      - cloudbilling.googleapis.com
+      - cloudresourcemanager.googleapis.com
+      - compute.googleapis.com
+      - essentialcontacts.googleapis.com
+      - iam.googleapis.com
+      - iamcredentials.googleapis.com
+      - oslogin.googleapis.com
+      - pubsub.googleapis.com
+      - serviceconsumermanagement.googleapis.com
       - serviceusage.googleapis.com
     providerVersions:
       - source: hashicorp/google

modules/quota_manager/metadata.yaml

@@ -79,9 +79,26 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/serviceusage.quotaViewer
-          - roles/logging.logWriter
+          - roles/compute.admin
+          - roles/iam.serviceAccountAdmin
+          - roles/resourcemanager.projectIamAdmin
+          - roles/storage.admin
+          - roles/iam.serviceAccountUser
+          - roles/billing.projectManager
     services:
+      - accesscontextmanager.googleapis.com
+      - admin.googleapis.com
+      - appengine.googleapis.com
+      - billingbudgets.googleapis.com
+      - cloudbilling.googleapis.com
+      - cloudresourcemanager.googleapis.com
+      - compute.googleapis.com
+      - essentialcontacts.googleapis.com
+      - iam.googleapis.com
+      - iamcredentials.googleapis.com
+      - oslogin.googleapis.com
+      - pubsub.googleapis.com
+      - serviceconsumermanagement.googleapis.com
       - serviceusage.googleapis.com
     providerVersions:
       - source: hashicorp/google-beta

modules/shared_vpc_access/metadata.yaml

@@ -106,11 +106,26 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/logging.logWriter
-          - roles/compute.networkUser
+          - roles/compute.admin
+          - roles/iam.serviceAccountAdmin
+          - roles/resourcemanager.projectIamAdmin
+          - roles/storage.admin
           - roles/iam.serviceAccountUser
+          - roles/billing.projectManager
     services:
+      - accesscontextmanager.googleapis.com
+      - admin.googleapis.com
+      - appengine.googleapis.com
+      - billingbudgets.googleapis.com
+      - cloudbilling.googleapis.com
+      - cloudresourcemanager.googleapis.com
       - compute.googleapis.com
+      - essentialcontacts.googleapis.com
+      - iam.googleapis.com
+      - iamcredentials.googleapis.com
+      - oslogin.googleapis.com
+      - pubsub.googleapis.com
+      - serviceconsumermanagement.googleapis.com
       - serviceusage.googleapis.com
     providerVersions:
       - source: hashicorp/google

modules/svpc_service_project/metadata.yaml

@@ -237,11 +237,26 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/servicenetworking.networksAdmin
+          - roles/compute.admin
+          - roles/iam.serviceAccountAdmin
+          - roles/resourcemanager.projectIamAdmin
+          - roles/storage.admin
           - roles/iam.serviceAccountUser
-          - roles/logging.logWriter
+          - roles/billing.projectManager
     services:
-      - servicenetworking.googleapis.com
+      - accesscontextmanager.googleapis.com
+      - admin.googleapis.com
+      - appengine.googleapis.com
+      - billingbudgets.googleapis.com
+      - cloudbilling.googleapis.com
+      - cloudresourcemanager.googleapis.com
+      - compute.googleapis.com
+      - essentialcontacts.googleapis.com
+      - iam.googleapis.com
+      - iamcredentials.googleapis.com
+      - oslogin.googleapis.com
+      - pubsub.googleapis.com
+      - serviceconsumermanagement.googleapis.com
       - serviceusage.googleapis.com
     providerVersions:
       - source: hashicorp/google