Project Factory: fix reference to automation SAs in IAM block for service accounts (#3100)

* PF: fix reference to automation SAs in IAM block in service accounts for PF

* add test

---------

Co-authored-by: Luca Prete <lucaprete@google.com>
Co-authored-by: Ludo <ludomagno@google.com>

modules/project-factory/README.md

@@ -408,6 +408,15 @@ iam:
     - automation/ro
 shared_vpc_host_config:
   enabled: true
+service_accounts:
+  vm-default:
+    display_name: "VM default service account."
+    iam_self_roles:
+      - roles/logging.logWriter
+      - roles/monitoring.metricWriter
+    iam:
+      "roles/iam.serviceAccountTokenCreator":
+        - automation/rw
 automation:
   project: test-pf-teams-iac-0
   service_accounts:

modules/project-factory/main.tf

@@ -352,16 +352,16 @@ module "service-accounts" {
     for k, v in lookup(each.value, "iam", {}) : k => [
       for vv in v : try(
         # automation service account (rw)
-        local.context.iam_principals["${each.key}/automation/${vv}"],
+        local.context.iam_principals["${each.value.project_key}/automation/${vv}"],
         # automation service account (automation/rw)
-        local.context.iam_principals["${each.key}/${vv}"],
+        local.context.iam_principals["${each.value.project_key}/${vv}"],
         # other automation service account (project/automation/rw)
         local.context.iam_principals[vv],
         # passthrough + error handling using tonumber until Terraform gets fail/raise function
         (
           strcontains(vv, ":")
           ? vv
-          : tonumber("[Error] Invalid member: '${vv}' in project '${each.key}'")
+          : tonumber("[Error] Invalid member: '${vv}' in project '${each.value.project_key}'")
         )
       )
     ]