Let google_project_iam_policy ignore the resourcemanager.projectOwnerInvitee role

[pdecat]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

Given that:

• the google_project_iam_policy resource can no longer be non-authoritative since version 2.0.0 of the provider,
• and that the project Owner role cannot be granted to external users on organization owned projects,
• and that no specific project logic will be implemented by terraform.

Maybe the google_project_iam_policy resource should ignore the resourcemanager.projectOwnerInvitee role bound to such users when invited from the GCP web console.

Note: I realize as writing this that this kind of goes against #2315.

# terraform version
Terraform v0.11.11
+ provider.google v2.0.0
+ provider.google-beta v2.0.0

New or Affected Resource(s)

• google_project_iam_policy

Potential Terraform Configuration

No change to configuration needed.

# Propose what you think the configuration to take advantage of this feature should look like.
# We may not use it verbatim, but it's helpful in understanding your intent.

References

• Make google_project_iam_policy authoritative. #2315
• Problem when setting external users as owners of organization owned projects #2514

[rileykarson]

We may have a similar precedent in https://github.com/terraform-providers/terraform-provider-google/blob/master/google/resource_google_project_services.go#L51 for values Terraform can't manage.

To clarify;

• Terraform is unable to add project owners from within another organization because the REST API does not allow that operation.

• It's possible to add project owners in the Cloud Console

• When an owner has been invited, they're given the resourcemanager.projectOwnerInvitee. Is that permanent, or do they receive the Owner role upon acceptance?

[pdecat]

Upon acceptance, resourcemanager.projectOwnerInvitee is replaced by owner.

[rileykarson]

Great, thanks!

In that case, I think that adding that role as an ignored role is the best solution here. Terraform will still try (and fail) to grant owner to non-organization members, but will authoritatively remove owner roles if they're not present in config once accepted.

[rileykarson]

We discussed this and don't think we should handle this role specially- it's likely to paper over diffs that will be detected later anyways when the invitee accepts their invite. Instead, we'd recommend managing policies with the appropriate fine-grained resources to represent the level of control Terraform has over the policy.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.