fix terraform issues (#92)

* update key versions and permissions

* add firebase admin role and trim cert keys

Author: mikehelmick

terraform/keys.tf

@@ -33,6 +33,10 @@ resource "google_kms_crypto_key" "certificate-signer" {
   }
 }
 
+data "google_kms_crypto_key_version" "certificate-signer-version" {
+  crypto_key = google_kms_crypto_key.certificate-signer.self_link
+}
+
 resource "google_kms_crypto_key" "token-signer" {
   key_ring = google_kms_key_ring.verification.self_link
   name     = "token-signer"
@@ -43,3 +47,7 @@ resource "google_kms_crypto_key" "token-signer" {
     protection_level = "HSM"
   }
 }
+
+data "google_kms_crypto_key_version" "token-signer-version" {
+  crypto_key = google_kms_crypto_key.token-signer.self_link
+}

terraform/service_apiserver.tf

@@ -44,6 +44,12 @@ resource "google_secret_manager_secret_iam_member" "apiserver-db" {
   member    = "serviceAccount:${google_service_account.apiserver.email}"
 }
 
+resource "google_kms_key_ring_iam_member" "kms-signerverifier" {
+  key_ring_id = google_kms_key_ring.verification.self_link
+  role        = "roles/cloudkms.signerVerifier"
+  member      = "serviceAccount:${google_service_account.apiserver.email}"
+}
+
 resource "google_cloud_run_service" "apiserver" {
   name     = "apiserver"
   location = var.region

terraform/service_server.tf

@@ -51,6 +51,12 @@ resource "google_secret_manager_secret_iam_member" "server-csrf" {
   member    = "serviceAccount:${google_service_account.server.email}"
 }
 
+resource "google_project_iam_member" "firebase-admin" {
+  project = var.project
+  role    = "roles/firebaseauth.admin"
+  member  = "serviceAccount:${google_service_account.server.email}"
+}
+
 resource "google_cloud_run_service" "server" {
   name     = "server"
   location = var.region

terraform/services.tf

@@ -40,7 +40,7 @@ locals {
   }
 
   signing_config = {
-    CERTIFICATE_SIGNING_KEY = google_kms_crypto_key.certificate-signer.self_link
-    TOKEN_SIGNING_KEY       = google_kms_crypto_key.token-signer.self_link
+    CERTIFICATE_SIGNING_KEY = trimprefix(data.google_kms_crypto_key_version.certificate-signer-version.id, "//cloudkms.googleapis.com/v1/")
+    TOKEN_SIGNING_KEY       = trimprefix(data.google_kms_crypto_key_version.token-signer-version.id, "//cloudkms.googleapis.com/v1/")
   }
 }