-
Notifications
You must be signed in to change notification settings - Fork 982
Roll out full IAM interface to artifact registry module #2605
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
artifact-registry
should use iam_member
instead of iam_binding
The IAM interface used across all our modules supports both authoritative and additive bindings. Artifact registry is the exception and has never been updated to the new interface. I changed the title to reflect what actually needs to be done. |
I've opened this PR, please let me know if that was the right way to implement the new interface |
Ah sorry, we basically did the same thing. I'll close mine. |
This has been merged, closing this (and thanks for flagging and taking care of it). |
Describe the bug
The current implementation of the artifact-registry module is using an
iam_binding
resource to set the permissions, which is dropping any IAM permissions that has been set by another module.Environment
To Reproduce
artifact-registry
module in a Terraform module A. Add some IAM permissions on the repository (service account for instance)Expected behavior
The permissions set by the Terraform module B should be kept, alongside the one set by the module A
Result
The permissions set by the Terraform module B are dropped when applying the module A
Additional context
More insights on my current use case: I'm creating a Terraform module that creates a Virtual repository, but also creates the permissions in the remote GCP projects where the upstream repositories live.
In that context I have permissions set at:
The text was updated successfully, but these errors were encountered: