# Grant project admins access to the service account
resource "google_service_account_iam_member" "prometheus_scraper_sa_admin" {
  service_account_id = google_service_account.prometheus_scraper_sa.name
  role               = "roles/iam.serviceAccountKeyAdmin"
  for_each           = toset(var.project_admins)
  member             = each.value
}

# Grant project admins access to the scheduler service account
resource "google_service_account_iam_member" "scheduler_sa_admin" {
  service_account_id = google_service_account.scheduler_sa.name
  role               = "roles/iam.serviceAccountKeyAdmin"
  for_each           = toset(var.project_admins)
  member             = each.value
}

# Grant project admins access to the GCS bucket
resource "google_storage_bucket_iam_member" "prometheus_data_bucket_admin" {
  bucket   = google_storage_bucket.prometheus_data_bucket.name
  role     = "roles/storage.objectAdmin"
  for_each = toset(var.project_admins)
  member   = each.value
}

# Grant project admins compute instance admin permissions for the VM
resource "google_compute_instance_iam_member" "vm_admin" {
  project      = var.project_id
  zone         = var.zone
  instance_name = google_compute_instance.prometheus_scraper.name
  role         = "roles/compute.instanceAdmin"
  for_each     = toset(var.project_admins)
  member       = each.value
}