# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# yaml-language-server: $schema=../../../../schemas/project.schema.json

parent: $folder_ids:domain-0
name: prod-dp-dd-0
services:
  - bigquery.googleapis.com
  - datacatalog.googleapis.com
  - dataplex.googleapis.com
  - datalineage.googleapis.com
  - logging.googleapis.com
  - monitoring.googleapis.com
  - storage.googleapis.com
  - composer.googleapis.com
automation:
  project: $project_ids:core-0
  service_accounts:
    iac-ro:
      display_name: Domain 0 (ro)
      iam:
        roles/iam.serviceAccountTokenCreator:
          - $iam_principals:dp-product-a-0
    iac-rw:
      display_name: Domain 0 (rw)
      iam:
        roles/iam.serviceAccountTokenCreator:
          - $iam_principals:dp-product-a-0
  bucket:
    name: tf-state
    iam:
      roles/storage.admin:
        - $iam_principals:service_accounts/shared-0/automation/iac-rw
      roles/storage.objectViewer:
        - $iam_principals:service_accounts/shared-0/automation/iac-ro
        - $iam_principals:dp-product-a-0
    versioning: true
iam_by_principals:
  $iam_principals:service_accounts/shared-0/automation/iac-rw:
    - roles/owner
  $iam_principals:service_accounts/shared-0/automation/iac-ro:
    - roles/viewer
  $iam_principals:service_accounts/_self_/composer:
    - roles/composer.worker
service_accounts:
  composer: {}

# TODO: Uncomment the following block if you want to use Shared VPC instead of local VPCs.
# shared_vpc_service_config:
#   host_project: $project_ids:net-dev-0
#   service_agent_iam:
#     roles/composer.sharedVpcAgent:
#       - $service_agents:composer
#     roles/compute.networkUser:
#       - $service_agents:composer
#   network_users:
#     - $iam_principals:service_accounts/_self_/composer

# If this project contains a local VPC, it should be configured as a Shared VPC host.
# shared_vpc_host_config:
#   enabled: true
