whekin/household-bot
1
0
Fork 0
mirror of https://github.com/whekin/household-bot.git synced 2026-03-31 12:04:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(infra): grant GitHub deployer access to webhook secrets

Browse Source
This commit is contained in:
whekin
2026-03-16 05:31:38 +04:00
parent 3d15754936
commit da6bdc3813
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
infra/terraform/main.tf
View File

@@ -97,6 +97,24 @@ resource "google_secret_manager_secret_iam_member" "github_deployer_bot_token_ac
member = "serviceAccount:${google_service_account.github_deployer[0].email}" member = "serviceAccount:${google_service_account.github_deployer[0].email}"
} }
resource "google_secret_manager_secret_iam_member" "github_deployer_webhook_secret_access" {
count = var.create_workload_identity ? 1 : 0
project = var.project_id
secret_id = var.telegram_webhook_secret_id
role = "roles/secretmanager.secretAccessor"
member = "serviceAccount:${google_service_account.github_deployer[0].email}"
}
resource "google_secret_manager_secret_iam_member" "github_deployer_webhook_secret_test_access" {
count = var.create_workload_identity ? 1 : 0
project = var.project_id
secret_id = "${var.telegram_webhook_secret_id}-test"
role = "roles/secretmanager.secretAccessor"
member = "serviceAccount:${google_service_account.github_deployer[0].email}"
}
module "bot_api_service" { module "bot_api_service" {
source = "./modules/cloud_run_service" source = "./modules/cloud_run_service"