securitycenter: add google_scc_notification_service_account

[c2thorn]

Adds google_scc_notification_service_account to provision the SCC notification service account and export its email/member string for Pub/Sub IAM bindings.

Fixes b/536845649

Background

Creating an SCC notification config requires granting roles/pubsub.publisher to the SCC notification service account on the destination topic. In fresh environments, this service account isn't provisioned yet, which causes initial Terraform applies to fail unless created out-of-band first.

Generic google_project_service_identity doesn't work here because securitycenter.googleapis.com uses multiple service agents and ServiceUsage doesn't return an email for the notification agent.

Details

• Modeled after similar service-specific resources like google_storage_project_service_account and google_access_approval_organization_service_account.
• Calls :generateServiceIdentity to trigger IAM provisioning, then returns the deterministic email (service-org-... or service-...).
• Supports organization and project scopes (folder-level configs in GCP use the org service account).
• Delete is a no-op since managed service agents cannot be deleted.

Release Note Template for Downstream PRs (will be copied)

See Write release notes for guidance.

securitycenter: added `google_scc_notification_service_account` resource

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 61bd3b2:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	4 files changed, 561 insertions(+)
google-beta provider	View Diff	4 files changed, 561 insertions(+)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
20	20	0	0

Affected Service Packages

• securitycenter

Learn how VCR tests work

---

Step 1: Replaying Mode

🟢 All tests passed in Replaying mode! No Recording was needed.

View the replaying VCR build log

@c2thorn VCR tests complete for 61bd3b2!

[c2thorn]

@modular-magician reassign-reviewer

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@ScottSuarez, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.