Move custom role out of module (#71)

Ensure this role isn't recreated by new instantiations of the module.

Signed-off-by: Colleen Murphy <[email protected]>

Author: cmurphy

gcp/modules/tiles_tlog/monitoring.tf

@@ -14,20 +14,10 @@
  * limitations under the License.
  */
 
-resource "google_project_iam_custom_role" "monitoring_metrics_descriptors" {
-  project     = var.project_id
-  role_id     = "OTelMetrics"
-  title       = "OTel metrics management"
-  description = "grant permissions on project for OTel metrics management"
-  permissions = [
-    "monitoring.metricDescriptors.create",
-  ]
-}
-
 resource "google_project_iam_member" "tessera_metric_descriptors_creator" {
   count      = var.freeze_shard ? 0 : 1
   project    = var.project_id
-  role       = "projects/${var.project_id}/roles/${google_project_iam_custom_role.monitoring_metrics_descriptors.role_id}"
+  role       = "projects/${var.project_id}/roles/${var.monitoring_role_id}"
   member     = local.workload_iam_member_id
   depends_on = [google_project_iam_custom_role.monitoring_metrics_descriptors]
 }

gcp/modules/tiles_tlog/spanner.tf

@@ -56,21 +56,10 @@ resource "google_spanner_instance_iam_member" "tiles_spanner_db_admin" {
   depends_on = [google_spanner_instance.tessera]
 }
 
-resource "google_project_iam_custom_role" "monitoring_timeseries" {
-  project     = var.project_id
-  role_id     = "SpannerMonitoringTimeseries"
-  title       = "spanner monitoring timeseries"
-  description = "grant permissions on project for spanner database-related timeseries creation"
-  permissions = [
-    "monitoring.timeSeries.create",
-    "monitoring.timeSeries.list"
-  ]
-}
-
 resource "google_project_iam_member" "tiles_project_timeseries_creator" {
   count      = var.freeze_shard ? 0 : 1
   project    = var.project_id
-  role       = "projects/${var.project_id}/roles/${google_project_iam_custom_role.monitoring_timeseries.role_id}"
+  role       = "projects/${var.project_id}/roles/${var.spanner_timeseries_role_id}"
   member     = local.workload_iam_member_id
   depends_on = [google_project_iam_custom_role.monitoring_timeseries]
 }

gcp/modules/tiles_tlog/variables.tf

@@ -211,3 +211,13 @@ variable "enable_backend_service_logging" {
   type        = bool
   default     = true
 }
+
+variable "spanner_timeseries_role_id" {
+  description = "name of the project role for managing timeseries entries for Spanner - role must include permissions `monitoring.timeSeries.create` and `monitoring.timeSeries.list`"
+  type        = string
+}
+
+variable "monitoring_role_id" {
+  description = "name of the project role for managing metrics - role must include permissions `monitoring.metricDescriptors.create`"
+  type        = string
+}