terraform: add bindings for impersonating account directly

This was previously done directly in Pantheon.

Change-Id: I8cdc5e8f721554b001741babc1a25ff75c6e4b34
Reviewed-on: https://go-review.googlesource.com/c/pkgsite-metrics/+/494076
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com>
Reviewed-by: Jonathan Amsterdam <jba@google.com>

terraform/main.tf

diff --git a/terraform/main.tf b/terraform/main.tf
index ab680fc..89a8f2e 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -141,14 +141,28 @@
 # Permissions on the impersonate service account.
 data "google_iam_policy" "impersonate" {
   binding {
-    # Let anyone in the ecosystem group get an access token for this service account.
+    # Let anyone in the ecosystem and golang group get an access token for this service account.
     role    = "roles/iam.serviceAccountTokenCreator"
-    members = [var.team_group]
+    members = [
+    	var.team_group,
+	"group:golang-eng-policy@twosync.google.com"
+	]
   }
   binding {
-    # Let anyone in the ecosystem group act as this service account.
+    # Let anyone in the ecosystem and golang group act as this service account.
     role    = "roles/iam.serviceAccountUser"
-    members = [var.team_group]
+    members = [
+    	var.team_group,
+	"group:golang-eng-policy@twosync.google.com"
+	]
+  }
+  binding {
+    # Let anyone in the ecosystem and golang group view most of Cloud resources, including permissions.
+    role    = "roles/viewer"
+    members = [
+    	var.team_group,
+	"group:golang-eng-policy@twosync.google.com"
+	]
   }
 }