1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106

use tokio::process::Command;

pub async fn process_create_service_account(service_name: &str) {
  let description = String::from("--description='") + service_name + " Service Account'";
  let display_name = String::from("--display-name=") + service_name;
  let output = Command::new("gcloud")
    .args(&[
      "iam",
      "service-accounts",
      "create",
      service_name,
      description.as_str(),
      display_name.as_str(),
    ])
    .output()
    .await;
  println!("output = {:?}", output);
}

pub async fn process_create_service_account_key(service_name: &str, project_id: &str) {
  let service_account = String::from(service_name) + "@" + project_id + ".iam.gserviceaccount.com";
  let output = Command::new("gcloud")
    .args(&[
      "iam",
      "service-accounts",
      "keys",
      "create",
      "./keyfile.json",
      "--iam-account",
      service_account.as_str(),
    ])
    .output()
    .await;
  println!("output = {:?}", output);
}

pub async fn process_add_roles(service_name: &str, project_id: &str) {
  let roles = [
    "roles/cloudsql.editor",
    "roles/containerregistry.ServiceAgent",
    "roles/pubsub.editor",
    "roles/datastore.user",
    "roles/iam.serviceAccountUser",
    "roles/run.admin",
    "roles/storage.admin",
    "roles/storage.objectAdmin",
    "roles/cloudscheduler.admin",
    "roles/appengine.appCreator",
    "roles/logging.admin",
    "roles/cloudtranslate.admin",
  ];
  for role in roles {
    process_add_service_account_role(service_name, project_id, role).await;
  }
}

pub async fn process_add_service_account_role(
  service_name: &str,
  project_id: &str,
  role_arg: &str,
) {
  let member = String::from("--member=serviceAccount:")
    + service_name
    + "@"
    + project_id
    + ".iam.gserviceaccount.com";
  let role = String::from("--role=") + role_arg;
  let output = Command::new("gcloud")
    .args(&[
      "projects",
      "add-iam-policy-binding",
      project_id,
      member.as_str(),
      role.as_str(),
    ])
    .output()
    .await;
  println!("output = {:?}", output);
}

pub async fn process_enable_permissions() {
  let service_urls = [
    "compute.googleapis.com",
    "iam.googleapis.com",
    "dns.googleapis.com",
    "sqladmin.googleapis.com",
    "sql-component.googleapis.com",
    "servicenetworking.googleapis.com",
    "containerregistry.googleapis.com",
    "run.googleapis.com",
    "vpcaccess.googleapis.com",
    "cloudscheduler.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "translate.googleapis.com",
    "firestore.googleapis.com",
    "cloudfunctions.googleapis.com",
    "cloudbuild.googleapis.com",
    "spanner.googleapis.com",
  ];
  for service_name in service_urls {
    let _output = Command::new("gcloud")
      .args(&["services", "enable", service_name])
      .output()
      .await;
  }
}