google_project_iam_member.tf

###############################################################################
# Google Project IAM Members
# Single stanza for all IAM bindings
###############################################################################

locals {
  google_project = "example-project"
  users = toset([
    "user:[email protected]",
    "user:[email protected]",
    "user:[email protected]",
  ])
  users_roles = toset([
    "roles/viewer",
    "roles/bigquery.admin",
    "roles/run.admin",
    "roles/run.invoker",
    "roles/compute.osAdminLogin",
    "roles/iap.tunnelResourceAccessor",
    "roles/compute.instanceAdmin.v1",
  ])
}

resource "google_project_iam_member" "users" {
  for_each = {
    for pair in setproduct(local.users, local.users_roles) :
    "${pair[0]}-${pair[1]}" => {
      member = pair[0]
      role   = pair[1]
    }
  }
  project = local.google_project
  member  = each.value.member
  role    = each.value.role
}