Setup access to audit logs for kyma-project admins

configs/terraform/environments/prod/iam-variables.tf

@@ -0,0 +1,5 @@
+variable "kyma_developer_admins_email" {
+  description = "The email of the Kyma Developer Admins group."
+  type = string
+  default = "[email protected]"
+}

configs/terraform/environments/prod/iam.tf

@@ -0,0 +1,20 @@
+# Setups IAM for the project administrators in the kyma-project GCP project.
+import {
+  id = "kyma-project roles/editor group:[email protected]"
+  to = google_project_iam_member.kyma_developer_admins_editor
+}
+
+resource "google_project_iam_member" "kyma_developer_admins_editor" {
+  provider = google.kyma_project
+  project = var.kyma_project_gcp_project_id
+  role = "roles/editor"
+  member = "group:${var.kyma_developer_admins_email}"
+}
+
+# Add roles required to see audit logs in kyma-project GCP project.
+resource "google_project_iam_member" "kyma_developer_admins_logging_viewer" {
+  provider = google.kyma_project
+  project = var.kyma_project_gcp_project_id
+  role = "roles/logging.viewer"
+  member = "group:${var.kyma_developer_admins_email}"
+}

configs/terraform/environments/prod/service_accounts.tf

@@ -4,12 +4,6 @@ resource "google_service_account" "sa-gke-kyma-integration" {
   description  = "Service account is used by Prow to integrate with GKE. Will be removed with Prow"
 }
 
-resource "google_service_account" "gcr-cleaner" {
-  account_id   = "gcr-cleaner"
-  display_name = "gcr-cleaner"
-  description  = "Service account is used by gcr-cleaner tool."
-}
-
 resource "google_service_account" "control-plane" {
   account_id   = "control-plane"
   display_name = "control-plane"