如何通过terraform创建带有服务帐户的谷歌云pubsub订阅

Question

从这个文档中，我想通过terraform创建同样的东西。

https://cloud.google.com/run/docs/tutorials/pubsub

gcloud pubsub subscriptions create myRunSubscription --topic myRunTopic 
--push-endpoint=SERVICE-URL/ 
--push-auth-service-account=cloud-run-pubsub-invoker@PROJECT_ID.iam.gserviceaccount.com

地形的主.tf

resource "google_pubsub_subscription" "my_task" {
name  = "my-task-subscription"
topic = google_pubsub_topic.my_task.name
ack_deadline_seconds = 20
push_config {
push_endpoint = var.push_endpoint
}
dead_letter_policy {
dead_letter_topic = "[e-mail]"
}
}

地形应用

# module.pubsub.google_pubsub_subscription.my_task will be created
+ resource "google_pubsub_subscription" "my_task" {
+ ack_deadline_seconds       = 20
+ id                         = (known after apply)
+ message_retention_duration = "604800s"
+ name                       = "my-task-subscription"
+ path                       = (known after apply)
+ project                    = (known after apply)
+ topic                      = "MyTask"
+ dead_letter_policy {
+ dead_letter_topic = "[e-mail]"
}
+ expiration_policy {
+ ttl = (known after apply)
}
+ push_config {
+ push_endpoint = "https://an-endpoint.com"
}
}

收到错误：

Error: Error creating Subscription: googleapi: Error 400: Invalid resource name given (name=[e-mail]). Refer to https://cloud.google.com/pubsub/docs/admin#resource_names for more information.

从地形图的文档来看，dead_letter_policy与Pub/Sub服务帐户相关：https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/pubsub_subscription#dead_letter_policy

但为什么它不起作用？那么如何将--push-auth-service-account设置为谷歌官方呢？

Answer 1

您的问题在这里：

dead_letter_policy {
dead_letter_topic = "[e-mail]"
}

您正在尝试为dead_letter_topic分配服务帐户标识。这是不正确的。

相反，使用这样的东西来创建一个主题：

resource "google_pubsub_topic" "example_dead_letter" {
name = "example-topic-dead-letter"
}

或者引用现有主题：

data "google_pubsub_topic" "example_dead_letter" {
name = "example-topic-dead-letter"
}

然后像这样使用资源：

dead_letter_policy {
dead_letter_topic = google_pubsub_topic.example_dead_letter.id
}

Answer 2

您链接的Terraform文档如下所述。

与此订阅关联的云发布/子服务帐户父项目(即。，服务-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com)必须对此订阅具有Acknowledge((消息的权限。

您用于死信策略的服务帐户似乎没有相应的权限来确认消息。

根据IAM文件，它至少需要pub/sub subscriber角色来确认消息。

请参阅此处获取有关pubsub角色的更多信息。