feat: Add per module requirements to project-factory (#996)

qz267 · Zheng Qin · q2w · web-flow · commit fb1af4caa3dd · 2025-08-11T19:24:35.000Z
Co-authored-by: Zheng Qin &lt;zhengqin@google.com&gt;
Co-authored-by: abhishek kumar tiwari &lt;abhishektiwari571@gmail.com&gt;
diff --git a/Makefile b/Makefile
@@ -94,7 +94,7 @@ docker_generate_docs:
 		-e ENABLE_BPMETADATA=1 \
 		-v "${CURDIR}":/workspace \
 		$(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \
-		/bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs'
+		/bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs --per-module-requirements'
 
 # Alias for backwards compatibility
 .PHONY: generate_docs
diff --git a/metadata.yaml b/metadata.yaml
@@ -357,19 +357,6 @@ spec:
         description: GCE usage reports bucket
   requirements:
     roles:
-      - level: Project
-        roles:
-          - roles/accesscontextmanager.policyAdmin
-          - roles/resourcemanager.organizationViewer
-          - roles/resourcemanager.tagAdmin
-          - roles/resourcemanager.tagUser
-      - level: Project
-        roles:
-          - roles/resourcemanager.projectCreator
-          - roles/resourcemanager.folderAdmin
-          - roles/resourcemanager.folderIamAdmin
-          - roles/billing.projectManager
-          - roles/compute.xpnAdmin
       - level: Project
         roles:
           - roles/compute.admin
@@ -379,20 +366,20 @@ spec:
           - roles/iam.serviceAccountUser
           - roles/billing.projectManager
     services:
+      - accesscontextmanager.googleapis.com
       - admin.googleapis.com
       - appengine.googleapis.com
+      - billingbudgets.googleapis.com
       - cloudbilling.googleapis.com
       - cloudresourcemanager.googleapis.com
       - compute.googleapis.com
+      - essentialcontacts.googleapis.com
       - iam.googleapis.com
       - iamcredentials.googleapis.com
       - oslogin.googleapis.com
-      - serviceusage.googleapis.com
-      - billingbudgets.googleapis.com
       - pubsub.googleapis.com
-      - accesscontextmanager.googleapis.com
-      - essentialcontacts.googleapis.com
       - serviceconsumermanagement.googleapis.com
+      - serviceusage.googleapis.com
     providerVersions:
       - source: hashicorp/google
         version: ">= 5.41, < 7"
diff --git a/modules/budget/metadata.yaml b/modules/budget/metadata.yaml
@@ -122,40 +122,27 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/accesscontextmanager.policyAdmin
-          - roles/resourcemanager.organizationViewer
-          - roles/resourcemanager.tagAdmin
-          - roles/resourcemanager.tagUser
-      - level: Project
-        roles:
-          - roles/resourcemanager.projectCreator
-          - roles/resourcemanager.folderAdmin
-          - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
-          - roles/compute.xpnAdmin
-      - level: Project
-        roles:
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin
           - roles/storage.admin
           - roles/iam.serviceAccountUser
-          - roles/billing.projectManager
     services:
+      - accesscontextmanager.googleapis.com
       - admin.googleapis.com
       - appengine.googleapis.com
+      - billingbudgets.googleapis.com
       - cloudbilling.googleapis.com
       - cloudresourcemanager.googleapis.com
       - compute.googleapis.com
+      - essentialcontacts.googleapis.com
       - iam.googleapis.com
       - iamcredentials.googleapis.com
       - oslogin.googleapis.com
-      - serviceusage.googleapis.com
-      - billingbudgets.googleapis.com
       - pubsub.googleapis.com
-      - accesscontextmanager.googleapis.com
-      - essentialcontacts.googleapis.com
       - serviceconsumermanagement.googleapis.com
+      - serviceusage.googleapis.com
     providerVersions:
       - source: hashicorp/google
         version: ">= 4.28, < 7"
diff --git a/modules/essential_contacts/metadata.yaml b/modules/essential_contacts/metadata.yaml
@@ -77,19 +77,6 @@ spec:
         description: The GCP project you want to enable APIs on
   requirements:
     roles:
-      - level: Project
-        roles:
-          - roles/accesscontextmanager.policyAdmin
-          - roles/resourcemanager.organizationViewer
-          - roles/resourcemanager.tagAdmin
-          - roles/resourcemanager.tagUser
-      - level: Project
-        roles:
-          - roles/resourcemanager.projectCreator
-          - roles/resourcemanager.folderAdmin
-          - roles/resourcemanager.folderIamAdmin
-          - roles/billing.projectManager
-          - roles/compute.xpnAdmin
       - level: Project
         roles:
           - roles/compute.admin
@@ -99,20 +86,20 @@ spec:
           - roles/iam.serviceAccountUser
           - roles/billing.projectManager
     services:
+      - accesscontextmanager.googleapis.com
       - admin.googleapis.com
       - appengine.googleapis.com
+      - billingbudgets.googleapis.com
       - cloudbilling.googleapis.com
       - cloudresourcemanager.googleapis.com
       - compute.googleapis.com
+      - essentialcontacts.googleapis.com
       - iam.googleapis.com
       - iamcredentials.googleapis.com
       - oslogin.googleapis.com
-      - serviceusage.googleapis.com
-      - billingbudgets.googleapis.com
       - pubsub.googleapis.com
-      - accesscontextmanager.googleapis.com
-      - essentialcontacts.googleapis.com
       - serviceconsumermanagement.googleapis.com
+      - serviceusage.googleapis.com
     providerVersions:
       - source: hashicorp/google
         version: ">= 3.43, < 7"
diff --git a/modules/fabric-project/metadata.yaml b/modules/fabric-project/metadata.yaml
@@ -153,40 +153,27 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/accesscontextmanager.policyAdmin
-          - roles/resourcemanager.organizationViewer
-          - roles/resourcemanager.tagAdmin
-          - roles/resourcemanager.tagUser
-      - level: Project
-        roles:
-          - roles/resourcemanager.projectCreator
-          - roles/resourcemanager.folderAdmin
-          - roles/resourcemanager.folderIamAdmin
-          - roles/billing.projectManager
-          - roles/compute.xpnAdmin
-      - level: Project
-        roles:
-          - roles/compute.admin
-          - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin
           - roles/storage.admin
           - roles/iam.serviceAccountUser
           - roles/billing.projectManager
+          - roles/compute.admin
+          - roles/iam.serviceAccountAdmin
     services:
+      - accesscontextmanager.googleapis.com
       - admin.googleapis.com
       - appengine.googleapis.com
+      - billingbudgets.googleapis.com
       - cloudbilling.googleapis.com
       - cloudresourcemanager.googleapis.com
       - compute.googleapis.com
+      - essentialcontacts.googleapis.com
       - iam.googleapis.com
       - iamcredentials.googleapis.com
       - oslogin.googleapis.com
-      - serviceusage.googleapis.com
-      - billingbudgets.googleapis.com
       - pubsub.googleapis.com
-      - accesscontextmanager.googleapis.com
-      - essentialcontacts.googleapis.com
       - serviceconsumermanagement.googleapis.com
+      - serviceusage.googleapis.com
     providerVersions:
       - source: hashicorp/google
         version: ">= 5.41, < 7"
diff --git a/modules/gsuite_enabled/metadata.yaml b/modules/gsuite_enabled/metadata.yaml
@@ -250,40 +250,27 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/accesscontextmanager.policyAdmin
-          - roles/resourcemanager.organizationViewer
-          - roles/resourcemanager.tagAdmin
-          - roles/resourcemanager.tagUser
-      - level: Project
-        roles:
-          - roles/resourcemanager.projectCreator
-          - roles/resourcemanager.folderAdmin
-          - roles/resourcemanager.folderIamAdmin
+          - roles/iam.serviceAccountUser
           - roles/billing.projectManager
-          - roles/compute.xpnAdmin
-      - level: Project
-        roles:
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin
           - roles/storage.admin
-          - roles/iam.serviceAccountUser
-          - roles/billing.projectManager
     services:
+      - accesscontextmanager.googleapis.com
       - admin.googleapis.com
       - appengine.googleapis.com
+      - billingbudgets.googleapis.com
       - cloudbilling.googleapis.com
       - cloudresourcemanager.googleapis.com
       - compute.googleapis.com
+      - essentialcontacts.googleapis.com
       - iam.googleapis.com
       - iamcredentials.googleapis.com
       - oslogin.googleapis.com
-      - serviceusage.googleapis.com
-      - billingbudgets.googleapis.com
       - pubsub.googleapis.com
-      - accesscontextmanager.googleapis.com
-      - essentialcontacts.googleapis.com
       - serviceconsumermanagement.googleapis.com
+      - serviceusage.googleapis.com
     providerVersions:
       - source: DeviaVir/gsuite
         version: ~> 0.1
diff --git a/modules/project_services/metadata.yaml b/modules/project_services/metadata.yaml
@@ -104,40 +104,27 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/accesscontextmanager.policyAdmin
-          - roles/resourcemanager.organizationViewer
-          - roles/resourcemanager.tagAdmin
-          - roles/resourcemanager.tagUser
-      - level: Project
-        roles:
-          - roles/resourcemanager.projectCreator
-          - roles/resourcemanager.folderAdmin
-          - roles/resourcemanager.folderIamAdmin
-          - roles/billing.projectManager
-          - roles/compute.xpnAdmin
-      - level: Project
-        roles:
-          - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin
           - roles/storage.admin
           - roles/iam.serviceAccountUser
           - roles/billing.projectManager
+          - roles/compute.admin
     services:
+      - accesscontextmanager.googleapis.com
       - admin.googleapis.com
       - appengine.googleapis.com
+      - billingbudgets.googleapis.com
       - cloudbilling.googleapis.com
       - cloudresourcemanager.googleapis.com
       - compute.googleapis.com
+      - essentialcontacts.googleapis.com
       - iam.googleapis.com
       - iamcredentials.googleapis.com
       - oslogin.googleapis.com
-      - serviceusage.googleapis.com
-      - billingbudgets.googleapis.com
       - pubsub.googleapis.com
-      - accesscontextmanager.googleapis.com
-      - essentialcontacts.googleapis.com
       - serviceconsumermanagement.googleapis.com
+      - serviceusage.googleapis.com
     providerVersions:
       - source: hashicorp/google
         version: ">= 3.43, < 7"
diff --git a/modules/quota_manager/metadata.yaml b/modules/quota_manager/metadata.yaml
@@ -77,19 +77,6 @@ spec:
         description: The server-generated names of the quota override.
   requirements:
     roles:
-      - level: Project
-        roles:
-          - roles/accesscontextmanager.policyAdmin
-          - roles/resourcemanager.organizationViewer
-          - roles/resourcemanager.tagAdmin
-          - roles/resourcemanager.tagUser
-      - level: Project
-        roles:
-          - roles/resourcemanager.projectCreator
-          - roles/resourcemanager.folderAdmin
-          - roles/resourcemanager.folderIamAdmin
-          - roles/billing.projectManager
-          - roles/compute.xpnAdmin
       - level: Project
         roles:
           - roles/compute.admin
@@ -99,20 +86,20 @@ spec:
           - roles/iam.serviceAccountUser
           - roles/billing.projectManager
     services:
+      - accesscontextmanager.googleapis.com
       - admin.googleapis.com
       - appengine.googleapis.com
+      - billingbudgets.googleapis.com
       - cloudbilling.googleapis.com
       - cloudresourcemanager.googleapis.com
       - compute.googleapis.com
+      - essentialcontacts.googleapis.com
       - iam.googleapis.com
       - iamcredentials.googleapis.com
       - oslogin.googleapis.com
-      - serviceusage.googleapis.com
-      - billingbudgets.googleapis.com
       - pubsub.googleapis.com
-      - accesscontextmanager.googleapis.com
-      - essentialcontacts.googleapis.com
       - serviceconsumermanagement.googleapis.com
+      - serviceusage.googleapis.com
     providerVersions:
       - source: hashicorp/google-beta
         version: ">= 4.11, < 7"
diff --git a/modules/shared_vpc_access/metadata.yaml b/modules/shared_vpc_access/metadata.yaml
@@ -104,19 +104,6 @@ spec:
         description: Service project ID.
   requirements:
     roles:
-      - level: Project
-        roles:
-          - roles/accesscontextmanager.policyAdmin
-          - roles/resourcemanager.organizationViewer
-          - roles/resourcemanager.tagAdmin
-          - roles/resourcemanager.tagUser
-      - level: Project
-        roles:
-          - roles/resourcemanager.projectCreator
-          - roles/resourcemanager.folderAdmin
-          - roles/resourcemanager.folderIamAdmin
-          - roles/billing.projectManager
-          - roles/compute.xpnAdmin
       - level: Project
         roles:
           - roles/compute.admin
@@ -126,20 +113,20 @@ spec:
           - roles/iam.serviceAccountUser
           - roles/billing.projectManager
     services:
+      - accesscontextmanager.googleapis.com
       - admin.googleapis.com
       - appengine.googleapis.com
+      - billingbudgets.googleapis.com
       - cloudbilling.googleapis.com
       - cloudresourcemanager.googleapis.com
       - compute.googleapis.com
+      - essentialcontacts.googleapis.com
       - iam.googleapis.com
       - iamcredentials.googleapis.com
       - oslogin.googleapis.com
-      - serviceusage.googleapis.com
-      - billingbudgets.googleapis.com
       - pubsub.googleapis.com
-      - accesscontextmanager.googleapis.com
-      - essentialcontacts.googleapis.com
       - serviceconsumermanagement.googleapis.com
+      - serviceusage.googleapis.com
     providerVersions:
       - source: hashicorp/google
         version: ">= 3.43, < 7"
diff --git a/modules/svpc_service_project/metadata.yaml b/modules/svpc_service_project/metadata.yaml
diff --git a/test/setup/iam.tf b/test/setup/iam.tf
diff --git a/test/setup/main.tf b/test/setup/main.tf
