TerraformでGCPのIAMをちょっとだけ上手に管理する - Qiita

# create account resource "google_service_account" "sample_app_user" { account_id = "app-mgr" display_name = "app-mgr" } # add role1 resource "google_project_iam_member" "sample_app_user_1" { role = "roles/cloudsql.client" member = "serviceAccount:${google_service_account.sample_app_user.email}" } # add role2 resource "google_project_iam_member" "sample_app_user_2" { role = "roles/storage.objectVi