google_folder_iam_member with IAM Conditions

[zamerman]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v0.13.5
hashicorp/google v3.52.0

Affected Resource(s)

• google_folder_iam_member

Terraform Configuration Files

resource "google_folder_iam_member" "iam" {
  folder  = "folders/[REDACTED]"
  role    = "roles/iam.serviceAccountUser"
  member  = "user:[REDACTED]@[REDACTED].com"

  condition {
    title       = "expires_after_2021_01_27"
    expression  = "request.time < timestamp(\"2021-01-27T00:00:00Z\")"
  }
}

Debug Output

https://gist.github.com/zamerman/cd36404bf140c52900650a9649f8cdf0

https://gist.github.com/zamerman/1989a4d12d773ef38f29a547424f6ef8

Panic Output

Expected Behavior

Should have successfully produced a IAM role binding for the GCP Service Account User Role on the user with a condition that the binding only worked until 2021-01-27, and returned with a success.

Actual Behavior

When applied, it gave one of two results.

First result: It produces the IAM binding with the condition but it returns as a fail with the following error,

Error: Provider produced inconsistent result after apply

When applying changes to google_folder_iam_member.iam, provider
"registry.terraform.io/hashicorp/google" produced an unexpected new value:
Root resource was present, but now absent.

This is a bug in the provider, which should be reported in the provider's own
issue tracker.

Second result: No results with the following error,

Error: Error applying IAM policy for folder "folders/[REDACTED]": Error setting IAM policy for folder "folders/[REDACTED]": googleapi: Error 400: Policy cannot contain both conditions and condition hashes. Please update your client to request version 3 policy. For more information, please refer to https://cloud.google.com/iam/docs/policies#versions., badRequest

Steps to Reproduce

1. terraform apply

Important Factoids

References

• #0000

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!