Rearrange teardown tasks for GCP (#93)

Signed-off-by: Jim Enright <[email protected]>

Author: jimright

roles/platform/tasks/teardown_gcp_authz.yml

@@ -51,20 +51,6 @@
     project: "{{ plat__gcp_project }}"
     state: absent
 
-- name: Tear down Operational GCP Service Accounts
-  when: plat__teardown_deletes_roles
-  loop_control:
-    loop_var: __gcp_identity_item
-  loop:
-    - "{{ plat__gcp_log_identity_name }}"
-    - "{{ plat__gcp_datalakeadmin_identity_name }}"
-    - "{{ plat__gcp_ranger_audit_identity_name }}"
-    - "{{ plat__gcp_idbroker_identity_name }}"
-  google.cloud.gcp_iam_service_account:
-    name: "{{ __gcp_identity_item }}@{{ plat__gcp_project }}.iam.gserviceaccount.com"
-    project: "{{ plat__gcp_project }}"
-    state: absent
-
 - name: Tear down Operational GCP Service Accounts Policies
   when: plat__teardown_deletes_policies
   register: __gcp_service_account_teardown
@@ -118,4 +104,18 @@
   command: >
     gsutil iam
     ch -d {{ __gcp_pol_item.account |quote }}
-    gs://{{ __gcp_pol_item.bucket |quote }}
+    gs://{{ __gcp_pol_item.bucket |quote }}
+
+- name: Tear down Operational GCP Service Accounts
+  when: plat__teardown_deletes_roles
+  loop_control:
+    loop_var: __gcp_identity_item
+  loop:
+    - "{{ plat__gcp_log_identity_name }}"
+    - "{{ plat__gcp_datalakeadmin_identity_name }}"
+    - "{{ plat__gcp_ranger_audit_identity_name }}"
+    - "{{ plat__gcp_idbroker_identity_name }}"
+  google.cloud.gcp_iam_service_account:
+    name: "{{ __gcp_identity_item }}@{{ plat__gcp_project }}.iam.gserviceaccount.com"
+    project: "{{ plat__gcp_project }}"
+    state: absent

roles/platform/vars/main.yml

@@ -26,7 +26,7 @@ plat__gcp_roles:
   storage_admin: roles/storage.admin
   storage_object_admin: roles/storage.objectAdmin
   iam_workload_identity_user: roles/iam.workloadIdentityUser
-  iam_service_account_user: roles/iam.workloadIdentityUser
+  iam_service_account_user: roles/iam.serviceAccountUser
   iam_service_account_token_creator: roles/iam.serviceAccountTokenCreator
 
 plat__cdp_iam_identities: