如何用Terraform为Google Cloud Function添加受限调用者IAM策略

错误原因分析 #

你遇到的400错误主要来自两处语法/格式问题：

1. 条件表达式的title未用引号包裹，Terraform会将foo视为变量而非字符串值
2. 硬编码的资源名称可能与实际函数的完全限定名不匹配，或者未使用变量替换导致格式错误

修正后的Terraform代码 #

如果是给新建的Cloud Function配置（无现有IAM绑定），可以直接使用以下修正后的代码：

resource "google_service_account" "service_account" {
  account_id   = "service-account-id"
  display_name = "Restricted Cloud Function Invoker"
}

data "google_iam_policy" "invoker" {
  binding {
    role = "roles/cloudfunctions.invoker"
    members = [
      "serviceAccount:${google_service_account.service_account.email}",
    ]
    condition {
      # 注意title必须是字符串，且表达式使用变量确保资源名称准确
      expression  = "resource.name == projects/${var.common.project_id}/locations/${var.common.default_region}/functions/function_name"
      title       = "RestrictToSpecificFunction"
      description = "Limit this service account to invoke only the specified Cloud Function"
    }
  }
}

resource "google_cloudfunctions2_function_iam_policy" "binding" {
  cloud_function = "projects/${var.common.project_id}/locations/${var.common.default_region}/functions/function_name"
  project        = var.common.project_id
  location       = var.common.default_region
  policy_data    = data.google_iam_policy.invoker.policy_data
}

关键注意事项 #

• 避免覆盖现有IAM绑定：google_cloudfunctions2_function_iam_policy会完全替换函数的IAM策略，如果函数已有其他绑定（比如默认的开发者权限），需要先获取现有策略并合并新绑定：

# 获取函数现有IAM策略
data "google_cloudfunctions2_function_iam_policy" "existing" {
  cloud_function = "projects/${var.common.project_id}/locations/${var.common.default_region}/functions/function_name"
  project        = var.common.project_id
  location       = var.common.default_region
}

# 合并现有绑定与新的带条件绑定
data "google_iam_policy" "combined_invoker" {
  # 遍历现有所有绑定并保留
  dynamic "binding" {
    for_each = data.google_cloudfunctions2_function_iam_policy.existing.policy_data.bindings
    content {
      role    = binding.value.role
      members = binding.value.members
      # 保留现有绑定的条件（如果有）
      dynamic "condition" {
        for_each = binding.value.condition != null ? [binding.value.condition] : []
        content {
          expression  = condition.value.expression
          title       = condition.value.title
          description = condition.value.description
        }
      }
    }
  }

  # 添加新的带条件的调用者绑定
  binding {
    role = "roles/cloudfunctions.invoker"
    members = [
      "serviceAccount:${google_service_account.service_account.email}",
    ]
    condition {
      expression  = "resource.name == projects/${var.common.project_id}/locations/${var.common.default_region}/functions/function_name"
      title       = "RestrictToSpecificFunction"
      description = "Limit this service account to invoke only the specified Cloud Function"
    }
  }
}

resource "google_cloudfunctions2_function_iam_policy" "binding" {
  cloud_function = "projects/${var.common.project_id}/locations/${var.common.default_region}/functions/function_name"
  project        = var.common.project_id
  location       = var.common.default_region
  policy_data    = data.google_iam_policy.combined_invoker.policy_data
}

• 条件表达式验证：确保resource.name完全匹配函数的资源名称，可以通过GCP控制台查看函数的"资源ID"确认格式是否正确，格式为projects/[项目ID]/locations/[区域]/functions/[函数名]

内容的提问来源于stack exchange，提问作者Zuerst