google_cloudfunctions_function_iam_member not working with cloudfunctions2...?

[tony-kerz]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

terraform -v
Terraform v1.1.9
on linux_amd64

Your version of Terraform is out of date! The latest version
is 1.2.1. You can update by downloading from https://www.terraform.io/downloads.html

Affected Resource(s)

• google_cloudfunctions2_function
• google_cloudfunctions_function_iam_member

Terraform Configuration Files

resource "google_cloudfunctions2_function" "this" {
  provider    = google-beta
  name        = local.name
  description = coalesce(var.description, local.name)
  location    = var.region
  labels      = merge(var.tenant.labels, var.labels)

  build_config {
    runtime               = var.runtime
    entry_point           = coalesce(var.entry, var.name)
    environment_variables = var.build-vars
    source {
      storage_source {
        bucket = local.bucket
        object = "${local.path}/${var.object}"
      }
    }
  }

  service_config {
    min_instance_count             = var.min
    max_instance_count             = var.max
    available_memory               = var.memory
    timeout_seconds                = var.timeout-sec
    environment_variables          = var.run-vars
    ingress_settings               = var.ingress
    all_traffic_on_latest_revision = var.traffic-latest
    vpc_connector                  = local.connector
    vpc_connector_egress_settings  = var.connector-egress
  }
}

resource "google_cloudfunctions_function_iam_member" "this" {
  provider       = google-beta
  for_each       = toset(local.members)
  cloud_function = google_cloudfunctions2_function.this.name
  role           = "roles/cloudfunctions.invoker"
  member         = each.key
  depends_on = [
    google_cloudfunctions2_function.this
  ]
}

Expected Behavior

iam should be configured as with cloud-functions-gen-1

Actual Behavior

│ Error: Error retrieving IAM policy for cloudfunctions cloudfunction "projects/{blah}/locations/us-east4/functions/{blah}": googleapi: Error 404: Function {blah} in region us-east4 in project {blah} does not exist
│
│   with module.function.google_cloudfunctions_function_iam_member.this["serviceAccount:{blah}@{blah}.iam.gserviceaccount.com"],
│   on ../../main.tf line 138, in resource "google_cloudfunctions_function_iam_member" "this":
│  138: resource "google_cloudfunctions_function_iam_member" "this" {
│
╵

gcloud beta functions list --format json --gen2 --filter 'description=scratch-scratch-pdev'
[
  {
    "buildConfig": {
      "build": "projects/{blah}/locations/us-east4/builds/{blah}",
      "entryPoint": "scratch",
      "runtime": "nodejs16",
      "source": {
        "storageSource": {
          "bucket": "gcf-v2-sources-{blah}-us-east4",
          "object": "scratch-scratch-pdev/function-source.zip"
        }
      },
      "sourceProvenance": {
        "resolvedStorageSource": {
          "bucket": "gcf-v2-sources-{blah}-us-east4",
          "generation": "1654014288827472",
          "object": "scratch-scratch-pdev/function-source.zip"
        }
      }
    },
    "description": "scratch-scratch-pdev",
    "labels": {
      "terraform": "true"
    },
    "name": "projects/{blah}/locations/us-east4/functions/scratch-scratch-pdev",
    "serviceConfig": {
      "allTrafficOnLatestRevision": true,
      "availableMemory": "256M",
      "environmentVariables": {
        "DEBUG": "scratch"
      },
      "ingressSettings": "ALLOW_INTERNAL_ONLY",
      "maxInstanceCount": 100,
      "revision": "scratch-scratch-pdev-00001-zoq",
      "service": "projects/{blah}/locations/us-east4/services/scratch-scratch-pdev",
      "serviceAccountEmail": "{blah}-compute@developer.gserviceaccount.com",
      "timeoutSeconds": 60,
      "uri": "https://scratch-scratch-pdev-{blah}-uk.a.run.app",
      "vpcConnector": "projects/{blah}/locations/us-east4/connectors/{blah}",
      "vpcConnectorEgressSettings": "PRIVATE_RANGES_ONLY"
    },
    "state": "ACTIVE",
    "updateTime": "2022-05-31T16:25:51.317983370Z"
  }
]

Steps to Reproduce

attempt to apply any sample similar to above

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.