Granting compute.networkUser to a service agent in a project created via project factory

[rossiellog]

As the title says, I'm trying to find a way to grant roles/compute.networkUser to a service agent (workstations) on the prod net spoke project from stage 2-networking. The project in which the service agent resides has been initialized by the project factory. I have been messing a bit with the iam-related variables in project factory, to no avail. Is there a way to achieve the aforementioned? If so, how? Otherwise, is this something I can do manually only?

[wiktorn]

Did you try approach documented in project module example for Shared VPC?

You need something like:

  shared_vpc_service_config:
    host_project: ....
    service_agent_iam:
      "roles/compute.networkUser":
      - workstations

[rossiellog]

Thank you! After setting the host_project, I completely forgot about this option. It worked.