Enable constraint disableServiceAccountKeyCreation on project

[k9ert]

If you terraform a new project based on a organsiation which is unaltered, you will get an issue like this in the bootstrap-phase:

➜  inception git:(kn/tf-fix-01) gcloud iam service-accounts keys create inception-sa-creds.json \
  --iam-account=${inception_email}
ERROR: (gcloud.iam.service-accounts.keys.create) FAILED_PRECONDITION: Key creation is not allowed on this service account.
- '@type': type.googleapis.com/google.rpc.PreconditionFailure
  violations:
  - description: Key creation is not allowed on this service account.
    subject: projects/stgtest01/serviceAccounts/[email protected]?configvalue=mynameprefix-inception-tf%40stgtest01.iam.gserviceaccount.com
    type: constraints/iam.disableServiceAccountKeyCreation
➜  inception git:(kn/tf-fix-01)

So this is coming from an organisational constraint which can be disabled like this:

gcloud org-policies delete iam.disableServiceAccountKeyCreation --organization=ORGANIZATION_ID

However, this is creating a security hole which should be fixed after the platform phase (maybe even after the inception-phase).
Manually, that contraint can be activated again like this:

gcloud resource-manager org-policies enable-enforce constraints/iam.disableServiceAccountKeyCreation --project=PROJECT_ID

Via terraform, it can probably get activated like this:

resource "google_project_organization_policy" "disable_sa_key_creation" {
  project    = google_project.my_project.project_id
  constraint = "constraints/iam.disableServiceAccountKeyCreation"

  boolean_policy {
    enforced = true
  }
}