resource "google_service_account" "dlt_service_account" {
    account_id   = "dlt-${var.app_id}-sa"
    display_name = "Service Account for loading data via dlt for project ${var.project_id}"
}

resource "google_storage_bucket_iam_member" "dlt_sa_viewer" {
    bucket = google_storage_bucket.dlt_demo_source_bucket.name
    role   = "roles/storage.objectViewer"
    member = google_service_account.dlt_service_account.member
}

resource "google_service_account_iam_member" "dlt_service_account_iam" {
    service_account_id = google_service_account.dlt_service_account.name
    role               = "roles/iam.serviceAccountKeyAdmin"
    for_each = toset(var.project_admins)
    member = each.value
}

resource "google_storage_bucket_iam_member" "bucket_iam_admin" {
    bucket = google_storage_bucket.dlt_demo_source_bucket.name
    role   = "roles/storage.objectAdmin"
    for_each = toset(var.project_admins)
    member = each.value
}

resource "google_project_iam_member" "dlt_sa_bigquery_data_editor" {
    project = var.project_id
    for_each = toset([
        "roles/bigquery.dataEditor",
        "roles/bigquery.jobUser"
    ])
    role    = each.value
    member  = "serviceAccount:${google_service_account.dlt_service_account.email}"
}