IAM interface refactor

[ludoo]

No description provided.

[gustavovalverde]

@ludoo Maybe this was expected, based on the incompatible change label. I'd like to keep up with the repo changes, but after re-applying stage0-bootstrap I got this error and I'm not completely sure what's required to migrate to the new approach.

│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to module.organization.google_organization_iam_member.bindings["roles/compute.orgFirewallPolicyAdmin-group:[email protected]"],
│ provider "provider[\"registry.terraform.io/hashicorp/google\"]" produced an unexpected new value: Root resource was present, but now absent.
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵
╷
│ Error: Error applying IAM policy for organization "***REDACTED***": Error setting IAM policy for organization "***REDACTED***": googleapi: Error 400: The role name must be in the form "roles/{role}", "organizations/{organization_id}/roles/{role}", or "projects/{project_id}/roles/{role}"., badRequest
│ 
│   with module.organization.google_organization_iam_binding.bindings["sa_resman_delegated_iam"],
│   on ../../../modules/organization/iam.tf line 51, in resource "google_organization_iam_binding" "bindings":
│   51: resource "google_organization_iam_binding" "bindings" {

When I retried, then I got:

│ Error: Error when reading or editing organizations/***REDACTED***/roles/organizationIamAdmin: googleapi: Error 403: You don't have permission to get the role at organizations/***REDACTED***/roles/organizationIamAdmin.
│ Details:
│ [
│   {
│     "@type": "type.googleapis.com/google.rpc.ErrorInfo",
│     "domain": "iam.googleapis.com",
│     "metadata": {
│       "permission": "iam.roles.get",
│       "resource": "organizations/***REDACTED***/roles/organizationIamAdmin"
│     },
│     "reason": "IAM_PERMISSION_DENIED"
│   }
│ ]
│ , forbidden
│ 
│   with module.organization.google_organization_iam_custom_role.roles["organizationIamAdmin"],
│   on ../../../modules/organization/iam.tf line 35, in resource "google_organization_iam_custom_role" "roles":
│   35: resource "google_organization_iam_custom_role" "roles" {
│ 
╵
╷
│ Error: Error when reading or editing organizations/***REDACTED***/roles/tenantNetworkAdmin: googleapi: Error 403: You don't have permission to get the role at organizations/***REDACTED***/roles/tenantNetworkAdmin.
│ Details:
│ [
│   {
│     "@type": "type.googleapis.com/google.rpc.ErrorInfo",
│     "domain": "iam.googleapis.com",
│     "metadata": {
│       "permission": "iam.roles.get",
│       "resource": "organizations/***REDACTED***/roles/tenantNetworkAdmin"
│     },
│     "reason": "IAM_PERMISSION_DENIED"
│   }
│ ]
│ , forbidden
│ 
│   with module.organization.google_organization_iam_custom_role.roles["tenantNetworkAdmin"],
│   on ../../../modules/organization/iam.tf line 35, in resource "google_organization_iam_custom_role" "roles":
│   35: resource "google_organization_iam_custom_role" "roles" {
│ 
╵
╷
│ Error: Error when reading or editing organizations/***REDACTED***/roles/serviceProjectNetworkAdmin: googleapi: Error 403: You don't have permission to get the role at organizations/***REDACTED***/roles/serviceProjectNetworkAdmin.
│ Details:
│ [
│   {
│     "@type": "type.googleapis.com/google.rpc.ErrorInfo",
│     "domain": "iam.googleapis.com",
│     "metadata": {
│       "permission": "iam.roles.get",
│       "resource": "organizations/***REDACTED***/roles/serviceProjectNetworkAdmin"
│     },
│     "reason": "IAM_PERMISSION_DENIED"
│   }
│ ]
│ , forbidden
│ 
│   with module.organization.google_organization_iam_custom_role.roles["serviceProjectNetworkAdmin"],
│   on ../../../modules/organization/iam.tf line 35, in resource "google_organization_iam_custom_role" "roles":
│   35: resource "google_organization_iam_custom_role" "roles" {
│ 
╵

[juliocc]

@gustavovalverde my guess is that the first error removed some permissions from the gcp-org-admins group. Can you double check gcp-network-admins has the right permissions at the org level?

Also double check that you're a member of that group, but that's not something we change/touch from bootstrap.

[gustavovalverde]

Thank you @juliocc, I had to add some permissions that were removed, also had to remove my 0-bootstrap-providers.tf to init the terraform configuration, and most errors were gone.

But this one still remains:

│ Error: Error applying IAM policy for organization "***REDACTED***": Error setting IAM policy for organization "***REDACTED***": googleapi: Error 400: The role name must be in the form "roles/{role}", "organizations/{organization_id}/roles/{role}", or "projects/{project_id}/roles/{role}"., badRequest
│ 
│   with module.organization.google_organization_iam_binding.bindings["sa_resman_delegated_iam"],
│   on ../../../modules/organization/iam.tf line 51, in resource "google_organization_iam_binding" "bindings":
│   51: resource "google_organization_iam_binding" "bindings" {

[juliocc]

Can you check the value of module.organization.custom_role_id? Looks like the ids of the custom roles have an unexpected format.

[gustavovalverde]

This is the output from the apply. The role is being set as sa_resman_delegated_iam:

              + custom_roles = {
                  + organization_iam_admin        = "organizations/***REDACTED***/roles/organizationIamAdmin"
                  + service_project_network_admin = "organizations/***REDACTED***/roles/serviceProjectNetworkAdmin"
                  + tenant_network_admin          = "organizations/***REDACTED***/roles/tenantNetworkAdmin"
                }

...

  # module.organization.google_organization_iam_binding.bindings["sa_resman_delegated_iam"] will be created
  + resource "google_organization_iam_binding" "bindings" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + members = [
          + "serviceAccount:***REDACTED***-prod-resman-0@***REDACTED***-prod-iac-core-0.iam.gserviceaccount.com",
        ]
      + org_id  = "***REDACTED***"
      + role    = "sa_resman_delegated_iam"

      + condition {
          + description = "Automation service account delegated grants."
          + expression  = "api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly(['roles/accesscontextmanager.policyAdmin','roles/compute.orgFirewallPolicyAdmin','roles/compute.xpnAdmin','roles/orgpolicy.policyAdmin','roles/resourcemanager.organizationViewer','organizations/***REDACTED***/roles/tenantNetworkAdmin','roles/billing.admin','roles/billing.costsManager','roles/billing.user'])"
          + title       = "automation_sa_delegated_grants"
        }
    }

[gustavovalverde]

Fixed with:

• fix(organization): use correct role for bindings #1621