Automate with Terraform

# Variables
variable "gcp_project_id" {}
variable "gcp_folder_id"  {}  # Required only for folder-level integrations
variable "nr_account_id" {}

# Service account
resource "google_service_account" "newrelic" {
  account_id   = "newrelic-gcp-integration"
  display_name = "New Relic GCP Integration"
  project      = var.gcp_project_id
}

resource "google_project_iam_member" "viewer" {
  project = var.gcp_project_id
  role    = "roles/viewer"
  member  = "serviceAccount:${google_service_account.newrelic.email}"
}

resource "google_project_iam_member" "service_usage" {
  project = var.gcp_project_id
  role    = "roles/serviceusage.serviceUsageConsumer"
  member  = "serviceAccount:${google_service_account.newrelic.email}"
}

resource "google_project_iam_member" "cloud_asset_viewer" {
  project = var.gcp_project_id
  role    = "roles/cloudasset.viewer"
  member  = "serviceAccount:${google_service_account.newrelic.email}"
}

# Required only for integrations configured at the folder level
resource "google_folder_iam_member" "folder_viewer" {
  folder = var.gcp_folder_id
  role   = "roles/resourcemanager.folderViewer"
  member = "serviceAccount:${google_service_account.newrelic.email}"
}

# Workload Identity Pool
resource "google_iam_workload_identity_pool" "newrelic" {
  workload_identity_pool_id = "newrelic-pool"
  display_name              = "New Relic Pool"
  project                   = var.gcp_project_id
}

# OIDC Provider
resource "google_iam_workload_identity_pool_provider" "newrelic" {
  workload_identity_pool_id          = google_iam_workload_identity_pool.newrelic.workload_identity_pool_id
  workload_identity_pool_provider_id = "newrelic-provider"
  display_name                       = "New Relic OIDC Provider"
  project                            = var.gcp_project_id

  attribute_mapping = {
    "google.subject"          = "assertion.sub"
    "attribute.nr_account_id" = "assertion.nr_account_id"
  }

  attribute_condition = "assertion.nr_account_id == '${var.nr_account_id}'"

  oidc {
    issuer_uri        = "https://oidc.newrelic.com/r/gcp-cmp"
    allowed_audiences = ["newrelic-gcp-integrations"]
  }
}

# Allow impersonation
resource "google_service_account_iam_member" "wif_binding" {
  service_account_id = google_service_account.newrelic.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "principal://iam.googleapis.com/${google_iam_workload_identity_pool.newrelic.name}/attribute.nr_account_id/${var.nr_account_id}"
}