feat: support simple sa creation without any project level roles

metadata.yaml

@@ -1,4 +1,4 @@
-# Copyright 2024 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

modules/key-distributor/metadata.yaml

@@ -1,4 +1,4 @@
-# Copyright 2024 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

modules/simple-sa/README.md

@@ -29,7 +29,7 @@ module "sa" {
 | display\_name | Display name of the created service accounts (defaults to 'Terraform-managed service account') | `string` | `"Terraform-managed service account"` | no |
 | name | Name of service account | `string` | n/a | yes |
 | project\_id | Project id where service account will be created | `string` | n/a | yes |
-| project\_roles | Roles to grant the SA in specified project | `list(string)` | n/a | yes |
+| project\_roles | Roles to grant the SA in specified project | `list(string)` | `[]` | no |
 
 ## Outputs
 

modules/simple-sa/metadata.yaml

@@ -1,4 +1,4 @@
-# Copyright 2024 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -61,7 +61,7 @@ spec:
       - name: project_roles
         description: Roles to grant the SA in specified project
         varType: list(string)
-        required: true
+        defaultValue: []
         connections:
           - source:
               source: github.com/GoogleCloudPlatform/terraform-google-secret-manager//modules/simple-secret

modules/simple-sa/variables.tf

@@ -39,4 +39,5 @@ variable "description" {
 variable "project_roles" {
   type        = list(string)
   description = "Roles to grant the SA in specified project"
+  default     = []
 }