I made what appears to be a fairly common mistake by using google_service_account_iam_binding to enable a service account to do various things where as I should have used google_project_iam_binding. I've got everything working now but I want to understand what google_service_account_iam_* resources are actually for? I can't really find any documentation that explains in what scenario you would use them.
what is google_service_account_iam_binding for (vs google_project_iam_binding)
Viewed 704
1 Answers
A service account in an identity (a technical, and service identity) but also a resource. And for example, you can grant a user, or another service account, on a service account to allow them to impersonate the service account (role: Service Account User for example).
If you grant the same role on the project, you allow the user, or the service account, to impersonate all the service account in the project, which could be too broad.
EDIT 1
Let's take your example: You want to grant a service account some roles on a Compute Engine instance.
You can grant the service account at the project level (to have access to all the Compute engine instances in the project), or at the resource level (this specific) compute engine instance), with google_compute_instance_iam.
For a service account it's the same thing. You can grant another service account (or a user account) some permission on a service account.
You can grant another service account (or a user account) at the project level (to have access to all the service accounts in the project), or at the resource level (this specific service account).
This is useful when you want to act as a service account, to impersonate it for example. You don't want to grant the permission to impersonate all the service accounts, but only one.
Related