infra/gcp/main: add aws terraform bucket

infra/gcp/ensure-main-project.sh

@@ -89,6 +89,7 @@ terraform_state_bucket_entries=(
   "${LEGACY_CLUSTER_TERRAFORM_BUCKET}:${CLUSTER_ADMINS_GROUP}"
   k8s-infra-tf-prow-clusters:"${CLUSTER_ADMINS_GROUP}"
   k8s-infra-tf-public-clusters:k8s-infra-prow-oncall@kubernetes.io
+  k8s-infra-tf-aws:k8s-infra-aws-admins@kubernetes.io
 )
 color 6 "Ensuring terraform state buckets exist with correct permissions"
 for entry in "${terraform_state_bucket_entries[@]}"; do
@@ -100,12 +101,6 @@ for entry in "${terraform_state_bucket_entries[@]}"; do
     ) 2>&1 | indent
 done 2>&1 | indent
 
-color 6 "Empowering BigQuery admins"
-ensure_project_role_binding \
-    "${PROJECT}" \
-    "group:${BQ_ADMINS_GROUP}" \
-    "roles/bigquery.admin"
-
 color 6 "Empowering cluster admins"
 # TODO: this can also be a custom role
 cluster_admin_roles=(
@@ -164,7 +159,6 @@ empower_ksa_to_svcacct \
     "$(svc_acct_email "${PROJECT}" "k8s-infra-dns-updater")"
 
 color 6 "Empowering ${DNS_GROUP}"
-color 6 "Empowering BigQuery admins"
 ensure_project_role_binding \
     "${PROJECT}" \
     "group:${DNS_GROUP}" \
@@ -220,6 +214,12 @@ ensure_dns_zone "${PROJECT}" "canary-kubernetes-io" "canary.kubernetes.io"
 ensure_dns_zone "${PROJECT}" "canary-x-k8s-io" "canary.x-k8s.io"
 ensure_dns_zone "${PROJECT}" "canary-k8s-e2e-com" "canary.k8s-e2e.com"
 
+color 6 "Empowering BigQuery admins"
+ensure_project_role_binding \
+    "${PROJECT}" \
+    "group:${BQ_ADMINS_GROUP}" \
+    "roles/bigquery.admin"
+
 color 6 "Creating the BigQuery dataset for billing data"
 if ! bq --project_id "${PROJECT}" ls "${BQ_BILLING_DATASET}" >/dev/null 2>&1; then
     bq --project_id "${PROJECT}" mk "${BQ_BILLING_DATASET}"