fix: tf roles app sa (#300)

Author: eliasecchig

src/base_template/deployment/terraform/dev/variables.tf

@@ -49,14 +49,15 @@ variable "app_sa_roles" {
   description = "List of roles to assign to the application service account"
   type        = list(string)
   default = [
-{%- if "adk" in cookiecutter.tags and cookiecutter.session_type == "alloydb" %}
+{%- if cookiecutter.session_type == "alloydb" %}
     "roles/secretmanager.secretAccessor",
 {%- endif %}
     "roles/aiplatform.user",
     "roles/discoveryengine.editor",
     "roles/logging.logWriter",
     "roles/cloudtrace.agent",
-    "roles/storage.admin"
+    "roles/storage.admin",
+    "roles/serviceusage.serviceUsageConsumer",
   ]
 }
 {% if cookiecutter.data_ingestion %}

src/base_template/deployment/terraform/variables.tf

@@ -70,15 +70,15 @@ variable "app_sa_roles" {
   description = "List of roles to assign to the application service account"
   type        = list(string)
   default = [
-{%- if cookiecutter.deployment_target == 'cloud_run' %}
-    "roles/run.invoker",
+{%- if cookiecutter.session_type == "alloydb" %}
     "roles/secretmanager.secretAccessor",
 {%- endif %}
     "roles/aiplatform.user",
     "roles/discoveryengine.editor",
     "roles/logging.logWriter",
     "roles/cloudtrace.agent",
-    "roles/storage.admin"
+    "roles/storage.admin",
+    "roles/serviceusage.serviceUsageConsumer",
   ]
 }
 {%- if cookiecutter.deployment_target == 'cloud_run' %}