-
Notifications
You must be signed in to change notification settings - Fork 1.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
google_project_iam_binding replaces existing permissions. IAM to be removed are not shown in tf-plan #5760
Comments
@thnitendra how did you add the 2nd user? When I try adding the 2nd user, it seems to be fine. I got the plan below and verify both users are fine after applied. Did I miss something? Please let me know how I can repro your issue. Thanks
|
User2 was added through terrafrom. User1 was added from GCP IAM UI, before the terrafrom resource was applied. |
@thnitendra can you try to use below resource instead to see if that help your use case?
|
@edwardmedia |
@thnitendra the difference between these two resources are authoritative vs non-authoritative. That are mentioned by the resources in the doc. You are right. You need to update the states before you can apply if you want to use the authoritative resources. I am closing the issue now. Please reopen the issue if you still need further assistance. Thank you |
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks! |
Community Note
modular-magician
user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned tohashibot
, a community member has claimed the issue already.Terraform Version
Terraform v0.12.20
Affected Resource(s)
google_project_iam_binding
Terraform Configuration Files
Expected Behavior
terraform plan should either show the IAM permissions which will be replaced after apply (which happens only if the resource is explicitly imported before apply). Or,
terraform apply
should fail stating that the existing permissions for this roles on this project must be imported before applying.Actual Behavior
terraform plan only shows about addition of members as part of addition of the new resource.
terraform apply silently replaces all existing permissions; unless explicitly imported beforehand.
Steps to Reproduce
User1 permissions are gone after apply.
The text was updated successfully, but these errors were encountered: