Feature request: support for Google IAM policies on PubSub topics

[pdecat]

Hi, I would love to see the addition of a google_pubsub_topic_iam_policy resource to manage IAM policies on PubSub topics:

Following is an example of what this would look like setting an IAM policy on a pubsub topic:

resource "google_service_account" "publisher" {
  account_id   = "publisher"
  display_name = "Publisher"
}

resource "google_pubsub_topic" "default" {
  name = "default-topic"
}

data "google_iam_policy" "topic_publisher" {
  binding {
    role = "roles/pubsub.publisher"

    members = [
      "serviceAccount:${google_service_account.publisher.email}",
    ]
  }
}

# THE FOLLOWING RESOURCE DOES NOT EXIST YET!
resource "google_pubsub_topic_iam_policy" "default_topic_publisher" {
  target      = "${google_pubsub_topic.default.name}"
  policy_data = "${data.google_iam_policy.topic_publisher.policy_data}"
}

PS: If this feature request is accepted, should I open other issues for the other resources I am willing to see support? Or should this issue be renamed and updated to track everything in one place?

[evmin]

+1
I would also be interested in explicit subscription permissions.

Pubsub and Bigquery are probably the most needed resources.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.