diff --git a/mmv1/third_party/terraform/tests/resource_composer_environment_test.go.erb b/mmv1/third_party/terraform/tests/resource_composer_environment_test.go.erb
index 2f20ec7e761c..5431b512673b 100644
--- a/mmv1/third_party/terraform/tests/resource_composer_environment_test.go.erb
+++ b/mmv1/third_party/terraform/tests/resource_composer_environment_test.go.erb
@@ -971,7 +971,8 @@ func grantEncrypterDecrypterRoleToServiceAgents(t *testing.T) {
 		"gcp-sa-artifactregistry",
 		"gcp-sa-pubsub",
 	}
-	if policyChanged := BootstrapAllPSARole(t, serviceAgents, "roles/cloudkms.cryptoKeyEncrypterDecrypter"); policyChanged {
+	role := "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+	if policyChanged := BootstrapAllPSARole(t, serviceAgents, role); policyChanged {
 		// Fail this test run because the policy needs time to reconcile.
 		t.Fatalf("Granted crypto key encrypter/decrypter role for service agents %v in test project's IAM policy. Retry the test in a few minutes.", serviceAgents)
 	}
diff --git a/mmv1/third_party/terraform/utils/iam.go.erb b/mmv1/third_party/terraform/utils/iam.go.erb
index 2415509e183b..2d9c2283cdec 100644
--- a/mmv1/third_party/terraform/utils/iam.go.erb
+++ b/mmv1/third_party/terraform/utils/iam.go.erb
@@ -484,6 +484,8 @@ func missingBindingsMap(aMap, bMap map[iamBindingKey]map[string]struct{}) map[ia
 			results[key] = bMembers
 		}
 	}
+
+	return results
 }
 
 // Returns the bindings that are in one set of bindings and not the other.