addressing comment

Author: Zheng Qin

metadata.yaml

@@ -75,11 +75,11 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/cloudsql.admin
           - roles/iam.serviceAccountAdmin
           - roles/iam.serviceAccountUser
           - roles/resourcemanager.projectIamAdmin
           - roles/serviceusage.serviceUsageAdmin
-          - roles/cloudsql.admin
     services:
       - cloudresourcemanager.googleapis.com
       - iam.googleapis.com

modules/backup/metadata.yaml

@@ -191,9 +191,9 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/logging.logWriter
           - roles/cloudsql.admin
           - roles/iam.serviceAccountUser
+          - roles/logging.logWriter
     services:
       - serviceusage.googleapis.com
       - sqladmin.googleapis.com

modules/mysql/metadata.yaml

@@ -918,12 +918,12 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/cloudsql.admin
-          - roles/resourcemanager.projectIamAdmin
           - roles/iam.serviceAccountUser
           - roles/compute.networkAdmin
           - roles/cloudkms.cryptoKeyEncrypterDecrypter
           - roles/logging.logWriter
+          - roles/cloudsql.admin
+          - roles/resourcemanager.projectIamAdmin
     services:
       - cloudkms.googleapis.com
       - cloudresourcemanager.googleapis.com

modules/postgresql/metadata.yaml

@@ -924,21 +924,22 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/cloudkms.admin
+          - roles/logging.logWriter
           - roles/cloudsql.admin
+          - roles/storage.admin
           - roles/resourcemanager.projectIamAdmin
           - roles/iam.serviceAccountUser
           - roles/compute.networkAdmin
-          - roles/cloudkms.admin
           - roles/cloudkms.autokeyAdmin
-          - roles/storage.admin
           - roles/cloudkms.cryptoKeyEncrypterDecrypter
-          - roles/logging.logWriter
     services:
       - cloudkms.googleapis.com
       - cloudresourcemanager.googleapis.com
       - compute.googleapis.com
       - iam.googleapis.com
       - monitoring.googleapis.com
+      - servicenetworking.googleapis.com
       - serviceusage.googleapis.com
       - sqladmin.googleapis.com
     providerVersions:

modules/safer_mysql/metadata.yaml

@@ -384,9 +384,9 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/cloudsql.admin
           - roles/iam.serviceAccountUser
           - roles/logging.logWriter
+          - roles/cloudsql.admin
     services:
       - serviceusage.googleapis.com
       - sqladmin.googleapis.com

test/setup/main.tf

@@ -42,6 +42,7 @@ locals {
     postgresql = [
       "sqladmin.googleapis.com",
       "serviceusage.googleapis.com",
+      "servicenetworking.googleapis.com",
       "iam.googleapis.com",
       "cloudkms.googleapis.com",
       "cloudresourcemanager.googleapis.com",