SCC - Article - 3

main.tf

###
# Service account that will be the identity of our GCF
#
resource "google_service_account" "sa_gcf" {
  account_id   = "gcf-golden-image-scanner"
  display_name = "Google Cloud Function that runs the golden image scanner"
}
resource "google_organization_iam_member" "org_scc_findings" {
  org_id  = var.org_id
  role    = "roles/securitycenter.findingsEditor"
  member  = "serviceAccount:${google_service_account.sa_gcf.email}"
}
resource "google_organization_iam_member" "org_scc_assets" {
  org_id  = var.org_id
  role    = "roles/securitycenter.assetsViewer"
  member  = "serviceAccount:${google_service_account.sa_gcf.email}"
}