feat(api): eventarc SAs

gcp/cloud-run-v2/main.tf

@@ -200,7 +200,6 @@ module "lb-http" {
   }
 }
 
-
 resource "google_eventarc_trigger" "default" {
   for_each = { for i, trigger in var.eventarc_triggers : i => trigger }
 
@@ -225,6 +224,26 @@ resource "google_eventarc_trigger" "default" {
   }
 }
 
+resource "google_project_iam_binding" "eventarc_cloud_run" {
+  count   = length(var.eventarc_triggers) > 0 && var.cloud_run_service_account != null && var.cloud_run_service_account != "" ? 1 : 0
+  project = var.project_id
+  role    = "roles/eventarc.eventReceiver"
+
+  members = [
+    "serviceAccount:${var.cloud_run_service_account}",
+  ]
+}
+
+resource "google_project_iam_binding" "eventarc_pubsub" {
+  count   = length(var.eventarc_triggers) > 0 ? 1 : 0
+  project = var.project_id
+  role    = "roles/iam.serviceAccountTokenCreator"
+
+  members = [
+    "serviceAccount:service-${var.project_id}@gcp-sa-pubsub.iam.gserviceaccount.com"
+  ]
+}
+
 # Cloud Build trigger configuration
 module "trigger_provision" {
   count           = var.create_trigger == true ? 1 : 0