Allow the CI identity to set things up (#143)

Signed-off-by: Matt Moore <[email protected]>

Author: mattmoor

modules/configmap/README.md

@@ -81,6 +81,7 @@ No modules.
 | [google_secret_manager_secret.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/secret_manager_secret) | resource |
 | [google_secret_manager_secret_iam_binding.authorize-access](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/secret_manager_secret_iam_binding) | resource |
 | [google_secret_manager_secret_version.data](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/secret_manager_secret_version) | resource |
+| [google_client_openid_userinfo.me](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/client_openid_userinfo) | data source |
 | [google_project.project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |
 
 ## Inputs

modules/configmap/main.tf

@@ -25,6 +25,9 @@ resource "google_secret_manager_secret_version" "data" {
 // Get a project number for this project ID.
 data "google_project" "project" { project_id = var.project_id }
 
+// What identity is deploying this?
+data "google_client_openid_userinfo" "me" {}
+
 // Create an alert policy to notify if the secret is accessed by an unauthorized entity.
 resource "google_monitoring_alert_policy" "anomalous-secret-access" {
   # In the absence of data, incident will auto-close after an hour
@@ -46,10 +49,18 @@ resource "google_monitoring_alert_policy" "anomalous-secret-access" {
       filter = <<EOT
       protoPayload.serviceName="secretmanager.googleapis.com"
       protoPayload.request.name: ("projects/${var.project_id}/secrets/${var.name}/" OR "projects/${data.google_project.project.number}/secrets/${var.name}/")
+
+      -- Ignore the identity that is intended to access this.
       -(
         protoPayload.authenticationInfo.principalEmail="${var.service-account}"
         protoPayload.methodName="google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion"
       )
+
+      -- Ignore the identity as which we set this up.
+      -(
+        protoPayload.authenticationInfo.principalEmail="${data.google_client_openid_userinfo.me.email}"
+        protoPayload.methodName=("google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion" OR "google.cloud.secretmanager.v1.SecretManagerService.GetSecretVersion" OR "google.cloud.secretmanager.v1.SecretManagerService.EnableSecretVersion")
+      )
       EOT
     }
   }