Use ResourceIamPolicy for google_project_iam_policy

third_party/terraform/resources/resource_google_project_migrate.go

@@ -5,6 +5,7 @@ import (
 	"log"
 
 	"github.com/hashicorp/terraform-plugin-sdk/terraform"
+	"google.golang.org/api/cloudresourcemanager/v1"
 )
 
 func resourceGoogleProjectMigrateState(v int, s *terraform.InstanceState, meta interface{}) (*terraform.InstanceState, error) {
@@ -45,3 +46,18 @@ func migrateGoogleProjectStateV0toV1(s *terraform.InstanceState, config *Config)
 	log.Printf("[DEBUG] Attributes after migration: %#v", s.Attributes)
 	return s, nil
 }
+
+// Retrieve the existing IAM Policy for a Project
+func getProjectIamPolicy(project string, config *Config) (*cloudresourcemanager.Policy, error) {
+	p, err := config.clientResourceManager.Projects.GetIamPolicy(project,
+		&cloudresourcemanager.GetIamPolicyRequest{
+			Options: &cloudresourcemanager.GetPolicyOptions{
+				RequestedPolicyVersion: iamPolicyVersion,
+			},
+		}).Do()
+
+	if err != nil {
+		return nil, fmt.Errorf("Error retrieving IAM policy for project %q: %s", project, err)
+	}
+	return p, nil
+}

third_party/terraform/tests/resource_google_project_iam_policy_test.go.erb

@@ -165,7 +165,7 @@ func getStatePrimaryResource(s *terraform.State, res, expectedID string) (*terra
 	if !ok {
 		return nil, fmt.Errorf("Not found: %s", res)
 	}
-	if resource.Primary.Attributes["id"] != expectedID && expectedID != "" {
+	if expectedID != "" && !compareProjectName("", resource.Primary.Attributes["id"], expectedID, nil) {
 		return nil, fmt.Errorf("Expected project %q to match ID %q in state", resource.Primary.ID, expectedID)
 	}
 	return resource.Primary, nil

third_party/terraform/utils/iam_project.go

@@ -18,6 +18,17 @@ var IamProjectSchema = map[string]*schema.Schema{
 	},
 }
 
+// In google_project_iam_policy, project is required and not inferred by
+// getProject.
+var IamPolicyProjectSchema = map[string]*schema.Schema{
+	"project": {
+		Type:             schema.TypeString,
+		Required:         true,
+		ForceNew:         true,
+		DiffSuppressFunc: compareProjectName,
+	},
+}
+
 type ProjectIamUpdater struct {
 	resourceId string
 	Config     *Config
@@ -37,6 +48,15 @@ func NewProjectIamUpdater(d *schema.ResourceData, config *Config) (ResourceIamUp
 	}, nil
 }
 
+// NewProjectIamPolicyUpdater is similar to NewProjectIamUpdater, except that it
+// doesn't call getProject and only uses an explicitly set project.
+func NewProjectIamPolicyUpdater(d *schema.ResourceData, config *Config) (ResourceIamUpdater, error) {
+	return &ProjectIamUpdater{
+		resourceId: d.Get("project").(string),
+		Config:     config,
+	}, nil
+}
+
 func ProjectIdParseFunc(d *schema.ResourceData, _ *Config) error {
 	d.Set("project", d.Id())
 	return nil
@@ -84,3 +104,12 @@ func (u *ProjectIamUpdater) GetMutexKey() string {
 func (u *ProjectIamUpdater) DescribeResource() string {
 	return fmt.Sprintf("project %q", u.resourceId)
 }
+
+func compareProjectName(_, old, new string, _ *schema.ResourceData) bool {
+	// We can either get "projects/project-id" or "project-id", so strip any prefixes
+	return GetResourceNameFromSelfLink(old) == GetResourceNameFromSelfLink(new)
+}
+
+func getProjectIamPolicyMutexKey(pid string) string {
+	return fmt.Sprintf("iam-project-%s", pid)
+}

third_party/terraform/utils/provider.go.erb

@@ -372,11 +372,11 @@ end     # products.each do
 				"google_organization_iam_binding":              ResourceIamBinding(IamOrganizationSchema, NewOrganizationIamUpdater, OrgIdParseFunc),
 				"google_organization_iam_custom_role":          resourceGoogleOrganizationIamCustomRole(),
 				"google_organization_iam_member":               ResourceIamMember(IamOrganizationSchema, NewOrganizationIamUpdater, OrgIdParseFunc),
-		"google_organization_iam_policy":               ResourceIamPolicy(IamOrganizationSchema, NewOrganizationIamUpdater, OrgIdParseFunc),
-		"google_organization_iam_audit_config":         ResourceIamAuditConfig(IamOrganizationSchema, NewOrganizationIamUpdater, OrgIdParseFunc),
+				"google_organization_iam_policy":               ResourceIamPolicy(IamOrganizationSchema, NewOrganizationIamUpdater, OrgIdParseFunc),
+				"google_organization_iam_audit_config":         ResourceIamAuditConfig(IamOrganizationSchema, NewOrganizationIamUpdater, OrgIdParseFunc),
 				"google_organization_policy":                   resourceGoogleOrganizationPolicy(),
 				"google_project":                               resourceGoogleProject(),
-				"google_project_iam_policy":                    resourceGoogleProjectIamPolicy(),
+				"google_project_iam_policy":                    ResourceIamPolicy(IamPolicyProjectSchema, NewProjectIamPolicyUpdater, ProjectIdParseFunc),
 				"google_project_iam_binding":                   ResourceIamBindingWithBatching(IamProjectSchema, NewProjectIamUpdater, ProjectIdParseFunc, IamBatchingEnabled),
 				"google_project_iam_member":                    ResourceIamMemberWithBatching(IamProjectSchema, NewProjectIamUpdater, ProjectIdParseFunc, IamBatchingEnabled),
 				"google_project_iam_audit_config":              ResourceIamAuditConfigWithBatching(IamProjectSchema, NewProjectIamUpdater, ProjectIdParseFunc, IamBatchingEnabled),