Implement the member_type on the users.yml (#36460)

It now supports user, serviceAccount and group. Groups where not being created before.

Author: ksobrenat32

infra/enforcement/iam.py

@@ -113,6 +113,7 @@ def _export_project_iam(self) -> List[Dict]:
                     members_data[member_str] = {
                         "username": username,
                         "email": email_address,
+                        "member_type": member_type,
                         "permissions": []
                     }
 
@@ -131,6 +132,7 @@ def _export_project_iam(self) -> List[Dict]:
             output_list.append({
                 "username": data["username"],
                 "email": data["email"],
+                "member_type": data["member_type"],
                 "permissions": data["permissions"]
             })
 
@@ -225,6 +227,8 @@ def check_compliance(self) -> List[str]:
             elif not current_user and existing_user:
                 differences.append(f"User {email} found in policy file but not in GCP.")
             elif current_user and existing_user:
+                if current_user.get("member_type") != existing_user.get("member_type"):
+                    differences.append(f"User {email} has different member type. In GCP: {current_user.get('member_type')}, in file: {existing_user.get('member_type')}")
                 if current_user["permissions"] != existing_user["permissions"]:
                     msg = f"\nPermissions for user {email} differ."
                     msg += f"\nIn GCP: {current_user['permissions']}"

infra/iam/README.md

@@ -33,6 +33,7 @@ To manage user roles, edit the `users.yml` file. Add or modify entries under the
 users:
   - username: <username>
     email: <email>
+    member_type: <user|serviceAccount|group>
     permissions:
       - role: <role>
         title: <title> (optional)

infra/iam/users.tf

@@ -28,6 +28,7 @@ locals {
         {
           username              = user.username
           email                 = user.email
+          member_type           = user.member_type
           role                  = replace(perm.role, "PROJECT-ID", var.project_id)
           title                 = lookup(perm, "title", null)
           description           = lookup(perm, "description", null)
@@ -46,7 +47,7 @@ resource "google_project_iam_member" "project_members" {
   }
   project = var.project_id
   role    = each.value.role
-  member = can(regex(".*\\.gserviceaccount\\.com$", each.value.email)) ? "serviceAccount:${each.value.email}" : "user:${each.value.email}"
+  member  = "${each.value.member_type}:${each.value.email}"
 
   dynamic "condition" {
     # Condition is only created if expiry_date is set