resource "google_project_iam_member" "vertex_ai_user_role" {
  project = var.project_id
  role    = "roles/aiplatform.user"
  member  = "serviceAccount:${google_service_account.vertex_ai_user.email}"
}

resource "google_project_iam_member" "bigquery_job_user_role" {
  project = var.project_id
  role    = "roles/bigquery.jobUser"
  member  = "serviceAccount:${google_service_account.vertex_ai_user.email}"
}

resource "google_bigquery_dataset_iam_member" "sa_sandbox_owner" {
  project    = var.project_id
  dataset_id = google_bigquery_dataset.sa_sandbox.dataset_id
  role       = "roles/bigquery.dataOwner"
  member     = "serviceAccount:${google_service_account.vertex_ai_user.email}"
}