Fix dependencies

modules/project/outputs.tf

@@ -23,7 +23,8 @@ output "project_id" {
     google_project_organization_policy.boolean,
     google_project_organization_policy.list,
     google_project_service.project_services,
-    google_compute_shared_vpc_service_project.service_projects
+    google_compute_shared_vpc_service_project.service_projects,
+    google_kms_crypto_key_iam_member.crypto_key
   ]
 }
 
@@ -34,7 +35,8 @@ output "name" {
     google_project_organization_policy.boolean,
     google_project_organization_policy.list,
     google_project_service.project_services,
-    google_compute_shared_vpc_service_project.service_projects
+    google_compute_shared_vpc_service_project.service_projects,
+    google_kms_crypto_key_iam_member.crypto_key
   ]
 }
 
@@ -45,7 +47,8 @@ output "number" {
     google_project_organization_policy.boolean,
     google_project_organization_policy.list,
     google_project_service.project_services,
-    google_compute_shared_vpc_service_project.service_projects
+    google_compute_shared_vpc_service_project.service_projects,
+    google_kms_crypto_key_iam_member.crypto_key
   ]
 }
 
@@ -56,7 +59,10 @@ output "service_accounts" {
     default        = local.service_accounts_default
     robots         = local.service_accounts_robots
   }
-  depends_on = [google_project_service.project_services]
+  depends_on = [
+    google_project_service.project_services,
+    google_kms_crypto_key_iam_member.crypto_key
+  ]
 }
 
 output "custom_roles" {

modules/project/service_accounts.tf

@@ -53,6 +53,7 @@ data "google_bigquery_default_service_account" "bq_sa" {
   depends_on = [google_project_service.project_services]
 }
 
+# Secret Manager SA created just in time, we need to trigger the creation.
 resource "google_project_service_identity" "sm_sa" {
   provider   = google-beta
   count      = contains(var.services, "secretmanager.googleapis.com") ? 1 : 0