Organization Admin permission is being removed for User

[HarshalSanap007]

Hey @ludoo ,
Im facing one issue while deploying fast fabric 0-bootstrap stage where, its removing my users Organization administrator permission every time when I'm trying to run this stage, as Im again asking my admin to grant me manually and terraform is trynna remove it .Other roles are also there like owner ,logging admin these are also granted manually but its not removing them.
Points to consider
My user had Organization administrator as its a requirement to run this stage but while running its removing that permission from my user. I haven't changed fast fabric code for bootstrap stage.

module.organization.google_organization_iam_binding.authoritative["roles/resourcemanager.organizationAdmin"] will be updated in-place
  ~ resource "google_organization_iam_binding" "authoritative" {
        id      = "XXXXXXXX/roles/resourcemanager.organizationAdmin"
      ~ members = [
          - "user:[email protected]",
            # (2 unchanged elements hidden)
        ]
        # (3 unchanged attributes hidden)
    }

Could you help me understand why this must be happening ?

[juliocc]

This is working as intended.

The organization admin role is managed authoritatively by bootstrap. After running it for the first time, you should have a gcp-organization-admins group with the organization admin role. Add yourself to that group instead of granting your user the role directly

[HarshalSanap007]

Oh, now I get it , So as my user Org admin role is revoked , I need to add my self to admins group then run it back ? so if I destroy resources do I need to repeat the step or I can still be part admin group and perform the bootstrap again ?
Thanks

[juliocc]

Correct. And yes, if you destroy your user will need to be granted the org admin role to run bootstrap again.

[HarshalSanap007]

Let me right down the flow for confirmation and for other as well
1: Grant yourself required permissions manually.
2: Run the 0-bootstrap process some resources will get created some might fail. during this "apply" user will loose its organization administrator permission.
3: Go to Cloud Identity add yourself to Admins group.
4: Run the plan/apply again and everything should be applied

Hey @juliocc,
could you just confirm once ?

[juliocc]

You need to apply bootstrap twice but nothing should fail. Please follow the process as explained in the documentation

[HarshalSanap007]

Thanks for the clarification.

[HarshalSanap007]

Hey @juliocc , I have one doubt - Can I use a same code for 2 organization at same time , I mean can I pass two organizations in .tfvars which will deploy the landing zone in 2 orgs without much code refactoring ?