google_service_account_iam_policy doesn't allow setting policy on GCP created accounts [Default Cloud Builder Account]

[jjorissen52]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• If an issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to "hashibot", a community member has claimed the issue already.

Terraform Version

(I don't think I can upgrade to latest without affecting state management)

Terraform v0.12.6
+ provider.google v2.13.0
+ provider.local v1.3.0
+ provider.null v2.1.2
+ provider.random v2.2.0

Affected Resource(s)

• google_service_account_iam_policy (tested)
• google_service_account_iam_binding (assumed)
• google_service_account_iam_member (assumed)

Terraform Configuration Files

resource "google_service_account_iam_member" "builder-account-access" {
  service_account_id = "projects/${google_project_services.project.project}/${local.cloud_build_sa}"
  role               = "roles/iam.serviceAccountUser"
  member             = "user:${var.account}"
}

Debug Output

Error: "projects/my-project/serviceAccounts/[email protected]") doesn't match regexp "projects/(?:(?:[-a-z0-9]{1,63}\\.)*(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?):)?(?:[0-9]{1,19}|(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)|-)/serviceAccounts/((?:(?:[-a-z0-9]{1,63}\\.)*(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?):)?(?:[0-9]{1,19}|(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?))@appspot.gserviceaccount.com|[0-9]{1,20}[email protected]|[a-z](?:[-a-z0-9]{4,28}[a-z0-9])@[-a-z0-9\\.]{1,63}\\.iam\\.gserviceaccount\\.com$)"

  on permissions.tf line 70, in resource "google_service_account_iam_member" "builder-account-access":
  70: resource "google_service_account_iam_member" "builder-account-access" {

Expected Behavior

I should have been able to add a member to the service account, similar to effect of command

gcloud iam service-accounts add-iam-policy-binding [email protected] --member='user:[email protected]' --role='roles/iam.serviceAccountUser'

Actual Behavior

Validation rejected my specified service account

Steps to Reproduce

1. Enable cloudbuild api
2. terraform apply

References

Similar to #1374

• google_service_account_iam_policy doesn't allow setting policy on GCP created accounts #1374

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!