No validation on role_id using google_organization_iam_custom_role

[sfmullen]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v1.4.5

Affected Resource(s)

• google_organization_iam_custom_role

Terraform Configuration Files

resource "google_organization_iam_custom_role" "cloud-run-deploy-custom-role-1" {
  org_id      = var.organization_id
  role_id     = "cloud-run-deploy"
  title       = "Cloud Run Deploy Custom Role"
  permissions = [
    "artifactregistry.repositories.uploadArtifacts", "run.services.create",
    "run.services.get",
    "run.services.setIamPolicy",
    "run.services.update", "iam.serviceAccounts.actAs"
  ]
}

Debug Output

https://gist.github.com/MacMullen/033953f4468244b747363c2233cff2dd

Panic Output

Expected Behavior

When given an invalid role_id (in this case due to the use of hyphens), a validation from the resource should trigger an error.

Actual Behavior

No validation error is triggered, causing the API request to fail with a 400 status code, and the explanation of said error not mentioning that the invalid role_id is causing the issue.

Steps to Reproduce

1. terraform apply

Important Factoids

References

Best wishes,
A fellow Googler.

[edwardmedia]

Below validation is supposed to be called

https://github.com/hashicorp/terraform-provider-google/blob/main/google/validation.go#L34

[bahag-klickst]

Additional hint, in the docs of google_project_iam_custom_role (https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam_custom_role#role_id) there is a hint that hyphens are not allowed. Maybe this should be added to the docs of google_organization_iam_custom_role as well.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.