Grant network user on shared VPC to service project's cloud run serviceaccount. #926
Description
TL;DR
For using direct VPC egress feature of cloud run, cloud run serviceaccount (service-PROJECT_NUMBER@serverless-robot-prod.iam.gserviceaccount.com) needs roles/compute.networkUser on host project. For now, this module does not support iam permission configuration for cloud run serviceaccount.
Terraform Resources
google_project_iam_member
google_compute_subnetwork_iam_member
Detailed design
Adding "run.googleapis.com": format("service-%[email protected]", local.service_project_number), to locals.api in modules/shared_vpc_access/main.tf will implement this feature.
Additional information
No response