Project factory support for Serverless VPC Access connector permissions

[ChrisF987]

Proposed project-factory update to support enabling access for Cloud Run, Cloud Functions and App Engine service agents to use Serverless VPC Access connectors that are deployed in a shared vpc host project.

Relates to issue #1517

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[juliocc]

@ChrisF987 what if you expose the whole shared_vpc_service_config.service_identity_iam as a field in the yaml? This would allow using any service identity and not just the serverless one.

[wiktorn]

Hi @ChrisF987,

I did a bit different implementation of this feature. One thing that I miss, is that you are also granting roles/vpcaccess.user for App Engine Standard robot. I would expect this to be mentioned here but this doc is only mentioning that the role is needed for the user that is doing the deploy. Is this a bug in official docs?

[ChrisF987]

Hi @ChrisF987,

I did a bit different implementation of this feature. One thing that I miss, is that you are also granting roles/vpcaccess.user for App Engine Standard robot. I would expect this to be mentioned here but this doc is only mentioning that the role is needed for the user that is doing the deploy. Is this a bug in official docs?

Hi @wiktorn @juliocc , thanks for your comments, and for the implementation of service identity iam via your other PR. Re if roles/vpcaccess.user is necessary for App Engine Standard robot, I've reviewed the docs again and yea I just misread it whilst doing this PR.

[ChrisF987]

Implemented in #1542