# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# yaml-language-server: $schema=../../../../schemas/project.schema.json

parent: $folder_ids:domain-0
name: prod-dp-dd0-p0
services:
  - bigquery.googleapis.com
  - cloudaicompanion.googleapis.com
  - cloudresourcemanager.googleapis.com
  - composer.googleapis.com
  - datacatalog.googleapis.com
  - dataplex.googleapis.com
  - datalineage.googleapis.com
  - logging.googleapis.com
  - monitoring.googleapis.com
  - storage.googleapis.com
automation:
  project: $project_ids:shared-0
  service_accounts:
    iac-ro:
      display_name: Product 0/0 (ro)
      iam:
        roles/iam.serviceAccountTokenCreator:
          - $iam_principals:dp-product-a-0
    iac-rw:
      display_name: Product 0/0 (rw)
      iam:
        roles/iam.serviceAccountTokenCreator:
          - $iam_principals:dp-product-a-0
  bucket:
    name: tf-state
    iam:
      roles/storage.admin:
        - $iam_principals:service_accounts/product-0/automation/iac-rw
      roles/storage.objectViewer:
        - $iam_principals:service_accounts/product-0/automation/iac-ro
        - $iam_principals:dp-product-a-0
    versioning: true

service_accounts:
  processing:
    display_name: Processing service account.
    iam:
      roles/iam.serviceAccountUser:
        - $iam_principals:service_accounts/product-0/automation/iac-rw

datasets:
  # TODO: this dataset is exposed to consumers via the 'exposure/public' tag
  public:
    iam:
      roles/bigquery.dataViewer:
        - $iam_principals:data-consumer-bi
    tag_bindings:
      exposure: $tag_values:core-0/exposure/public

  # TODO: this dataset is internal/private
  private: {}

buckets:
  # TODO: this bucket is exposed to consumers via the 'exposure/public' tag
  public:
    iam:
      roles/storage.objectViewer:
        - $iam_principals:data-consumer-bi
    tag_bindings:
      exposure: $tag_values:core-0/exposure/public

  # TODO: this bucket is internal/private
  private: {}

iam_by_principals:
  $iam_principals:service_accounts/product-0/automation/iac-rw:
    - roles/owner
  $iam_principals:service_accounts/product-0/automation/iac-ro:
    - roles/viewer
  $iam_principals:service_accounts/_self_/processing:
    - roles/bigquery.dataEditor
    - roles/bigquery.jobUser
    - roles/dataflow.admin
    - roles/dataproc.editor
    - roles/dataproc.worker
    - roles/iam.serviceAccountUser
    - roles/storage.bucketViewer
    - roles/storage.objectAdmin


# shared_vpc_service_config:
#   host_project: $project_ids:net-dev-0
#   service_agent_iam:
#     roles/compute.networkUser:
#       - $service_agents:dataproc
