google_folder_iam documentation examples: cannot use IAM conditions with primitive roles (roles/editor)

[gtsorbo]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

3.63.0

Affected Resource(s)

• google_folder_iam
• google_folder_iam_policy
• google_folder_iam_binding
• google_folder_iam_member

Terraform Configuration Files

N/A

Debug Output

N/A

Panic Output

N/A

Expected Behavior

IAM conditions cannot be applied to bindings of primitive roles (Owner, Editor, Viewer)

Actual Behavior

Documentation provides examples of IAM bindings using IAM conditions with primitive roles (roles/editor). This configuration will fail.

Steps to Reproduce

Documentation: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_folder_iam
sections: google_folder_iam_policy, google_folder_iam_binding, google_folder_iam_member

Important Factoids

This behavior is reflected in the google_project_iam documentation, and this same behavior should be expected with folder resources as well.

References

N/A

[venkykuberan]

Can you share your config and the errors you are getting ?

[gtsorbo]

I wrote a test case using the example mentioned in the documentation:
Folder IDs and user names removed.

Config

resource "google_folder_iam_member" "folder" {
  folder  = "folders/############"
  role    = "roles/editor"
  member  = "user:xxxx"

  condition {
    title       = "expires_after_2019_12_31"
    description = "Expiring at midnight of 2019-12-31"
    expression  = "request.time < timestamp(\"2020-01-01T00:00:00Z\")"
  }
}

Error

Error: Error applying IAM policy for folder "folders/############": Error setting IAM policy for folder "folders/############": googleapi: Error 400: LintValidationUnits/BindingRoleAllowConditionCheck Error: Conditions can't be set on primitive roles., badRequest

[venkykuberan]

Looks like API is now throwing this error for primitive roles with conditions. We will update the doc., thanks for filing the issue

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.