Fix Service Account creation by ignoring 403 errors on read polling (#11811) (#8336)

[upstream:e6af55b2acc4c621678faebccfa6009420f87b17]

Signed-off-by: Modular Magician <[email protected]>

Author: modular-magician

Diff for: .changelog/11811.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+iam: addressed `google_service_account` creation issues caused by the eventual consistency of the GCP IAM API by ignoring 403 errors returned on polling the service account after creation.
+```

Diff for: google-beta/services/resourcemanager/resource_google_service_account.go

@@ -154,7 +154,8 @@ func resourceGoogleServiceAccountCreate(d *schema.ResourceData, meta interface{}
 
 	// We poll until the resource is found due to eventual consistency issue
 	// on part of the api https://cloud.google.com/iam/docs/overview#consistency
-	err = transport_tpg.PollingWaitTime(resourceServiceAccountPollRead(d, meta), transport_tpg.PollCheckForExistence, "Creating Service Account", d.Timeout(schema.TimeoutCreate), 1)
+	// IAM API returns 403 when the queried SA is not found, so we must ignore both 404 & 403 errors
+	err = transport_tpg.PollingWaitTime(resourceServiceAccountPollRead(d, meta), transport_tpg.PollCheckForExistenceWith403, "Creating Service Account", d.Timeout(schema.TimeoutCreate), 1)
 
 	if err != nil {
 		return err