Terraform update needed for container escape example.

[jake-luna-sada]

https://github.com/mondoohq/samples/blob/main/hack-lab/container-escape/gcp/main.tf
Line 65 seems to want to hardcode a Service account that doesn't seem to need to be there from an external domain which is a little worrying

OG below

resource "google_kms_crypto_key" "key" {
  name = "pass-key-${random_string.suffix.result}"
  key_ring = google_kms_key_ring.pass.id
  rotation_period = "2592000s"

  version_template {
    algorithm = "GOOGLE_SYMMETRIC_ENCRYPTION"
  }

  lifecycle {
    prevent_destroy = false
  }

  depends_on = [
    google_kms_key_ring.pass,
  ]
}
resource "google_kms_crypto_key_iam_binding" "crypto_key" {
  crypto_key_id = google_kms_crypto_key.key.id
  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  members       = [
     "serviceAccount:lunalectric-${random_string.suffix.result}[email protected]",
     "serviceAccount:service-${var.project_number}@container-engine-robot.iam.gserviceaccount.com",
  ]
  depends_on = [
    module.service_accounts-roles,
  ]
}

Proposed below

 resource "google_kms_crypto_key" "key" {
  name = "pass-key-${random_string.suffix.result}"
  key_ring = google_kms_key_ring.pass.id
  rotation_period = "2592000s"

  version_template {
    algorithm = "GOOGLE_SYMMETRIC_ENCRYPTION"
  }

  lifecycle {
    prevent_destroy = false
  }

  depends_on = [
    google_kms_key_ring.pass,
  ]
}
resource "google_kms_crypto_key_iam_binding" "crypto_key" {
  crypto_key_id = google_kms_crypto_key.key.id
  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  members       = [
     "serviceAccount:service-${var.project_number}@container-engine-robot.iam.gserviceaccount.com",
  ]
  depends_on = [
    module.service_accounts-roles,
  ]
} 

[mm-weber]

Thanks for noting this.
Created a PR to change this behaviour: https://github.com/mondoohq/samples/pulls

[chris-rock]

Thank you @Jluna-sada for the feedback. We merged mondoohq/samples#50 to address the issue. Please let us know if you see anything else!