Add multiple DB credentials and roles/cloudsql.client for the GKE SAs

Terraform/org/folder.fda-my-studies/project.heroes-hat-dev-data/data/main.tf

@@ -82,3 +82,4 @@ module "my_studies_cloudsql" {
     verify_server_certificate = null
   }
 }
+

Terraform/org/folder.fda-my-studies/project.heroes-hat-dev-data/data/outputs.tf

@@ -0,0 +1,9 @@
+output "instance_name" {
+  value = module.my_studies_cloudsql.instance_name
+}
+
+# This is not outputted by the safer_sql module, but allow dependents to treat
+# it like it is.
+output "instance_user" {
+  value = "default"
+}

Terraform/org/folder.fda-my-studies/project.heroes-hat-dev-data/data/secrets.tf

@@ -0,0 +1,70 @@
+# Create a separate user for each app, generate a password, and store in secrets
+locals {
+  apps = [
+    "auth-server",
+    "response-server",
+    "study-designer",
+    "study-meta-data",
+    "user-registration",
+  ]
+}
+
+resource "random_password" "db_passwords" {
+  for_each = toset(local.apps)
+
+  length  = 16
+  special = true
+}
+
+resource "google_sql_user" "db_users" {
+  for_each = toset(local.apps)
+
+  name     = "${each.key}-db-user"
+  instance = module.my_studies_cloudsql.instance_name
+  host     = "%"
+  password = random_password.db_passwords[each.key].result
+}
+
+resource "google_secret_manager_secret" "db_passwords_secrets" {
+  provider = google-beta
+
+  for_each = toset(local.apps)
+
+  secret_id = "${each.key}-db-password"
+  project   = var.project_id
+
+  replication {
+    automatic = true
+  }
+}
+
+resource "google_secret_manager_secret" "db_users_secrets" {
+  provider = google-beta
+
+  for_each = toset(local.apps)
+
+  secret_id = "${each.key}-db-user"
+  project   = var.project_id
+
+  replication {
+    automatic = true
+  }
+}
+
+resource "google_secret_manager_secret_version" "db_passwords_secrets_values" {
+  provider = google-beta
+
+  for_each = toset(local.apps)
+
+  secret      = google_secret_manager_secret.db_passwords_secrets[each.key].id
+  secret_data = random_password.db_passwords[each.key].result
+}
+
+resource "google_secret_manager_secret_version" "db_users_secrets_values" {
+  provider = google-beta
+
+  for_each = toset(local.apps)
+
+  secret      = google_secret_manager_secret.db_users_secrets[each.key].id
+  secret_data = google_sql_user.db_users[each.key].name
+}

Terraform/org/folder.fda-my-studies/project.heroes-hat-dev-data/iam/terragrunt.hcl

@@ -26,6 +26,9 @@ dependency "apps" {
 
   mock_outputs = {
     service_account = "mock-gke-service-account"
+    apps_service_accounts = {
+      mock-app = "mock-app-gke@mock-project.iam.gserviceaccount.com"
+    }
   }
 }
 
@@ -38,8 +41,10 @@ dependency "networks" {
 }
 
 inputs = {
-  sql_client_service_accounts = [
-    dependency.apps.outputs.service_account,
-    dependency.networks.outputs.bastion_service_account,
-  ]
+  sql_client_service_accounts = concat(
+    [
+      dependency.apps.outputs.service_account,
+      dependency.networks.outputs.bastion_service_account,
+    ],
+  values(dependency.apps.outputs.apps_service_accounts)[*].email)
 }