adding existing GCP service account to Terraform root module for cloudbuild to build Terraform configuration

You have 2 solutions:

1. Use the Cloud Build service account when you execute your Terraform. Your provider look like this:

provider "google" {
//  Useless with Cloud Build
//  credentials = file("${var.CREDENTIAL_FILE}}")
  project = var.PROJECT_ID
  region = "europe-west1"
}

But this solution implies to grant several roles to Cloud Build only for Terraform process. A custom role is a good choice for granting only what is required.

2. The second solution is to use a service account key file. Here again 2 solutions:

   • Cloud Build creates the service account, grant all the role on it, generates a key and passes it to terraform. After the terraform execution, the service account is deleted by Cloud Build. Good solution, but you have to grant Cloud Build service account the capability to grant itself any roles and to generate a json Key file. That's a lot a responsibility!
   • Use an existing service account and the key generated on it. But you have to secure the key and to rotate it regularly. I recommend you to securely store it in secret manager, but for the rotation, you have to manage it by yourselves, today. With this process, Cloud Build download the key (in secret manager) and pass it to terraform. Here again, the Cloud Build service account has the right to access to secrets, that is a critical privilege. The step in Cloud Build is something like this:

steps:
        - name: gcr.io/cloud-builders/gcloud:latest
          entrypoint: "bash"
          args:
                  - "-c"
                  - |
                      gcloud beta secrets versions access --secret=test-secret latest > my-secret-file.txt