[#16607] Fix: support iamMember (i.e. for WIF ids) in big query datasets

mmv1/third_party/terraform/services/bigquery/iam_bigquery_dataset.go

@@ -222,6 +222,8 @@ func iamMemberToAccess(member string) (string, string, error) {
 			return "groupByEmail", pieces[1], nil
 		case "domain":
 			return "domain", pieces[1], nil
+		case "iamMember":
+			return "iamMember", pieces[1], nil
 		case "user":
 			return "userByEmail", pieces[1], nil
 		case "serviceAccount":
@@ -234,7 +236,7 @@ func iamMemberToAccess(member string) (string, string, error) {
 		// These are special BigQuery Dataset permissions
 		return "specialGroup", member, nil
 	}
-	return "iamMember", member, nil
+	return "", "", fmt.Errorf("Failed to parse BigQuery Dataset IAM member type: %s", member)
 }
 
 func accessToIamMember(access map[string]interface{}) (string, error) {

mmv1/third_party/terraform/website/docs/r/bigquery_dataset_iam.html.markdown

@@ -86,12 +86,13 @@ The following arguments are supported:
 
 * `member/members` - (Required) Identities that will be granted the privilege in `role`.
   Each entry can have one of the following values:
-  * **allUsers**: A special identifier that represents anyone who is on the internet; with or without a Google account.
   * **allAuthenticatedUsers**: A special identifier that represents anyone who is authenticated with a Google account or a service account.
-  * **user:{emailid}**: An email address that represents a specific Google account. For example, [email protected] or [email protected].
-  * **serviceAccount:{emailid}**: An email address that represents a service account. For example, [email protected].
-  * **group:{emailid}**: An email address that represents a Google group. For example, [email protected].
+  * **allUsers**: A special identifier that represents anyone who is on the internet; with or without a Google account.
   * **domain:{domain}**: A G Suite domain (primary, instead of alias) name that represents all the users of that domain. For example, google.com or example.com.
+  * **group:{emailid}**: An email address that represents a Google group. For example, [email protected].
+  * **iamMember:{principal}**: Some other type of member that appears in the IAM Policy but isn't a user, group, domain, or special group.
+  * **serviceAccount:{emailid}**: An email address that represents a service account. For example, [email protected].
+  * **user:{emailid}**: An email address that represents a specific Google account. For example, [email protected] or [email protected].
 
 * `role` - (Required) The role that should be applied. Only one
     `google_bigquery_dataset_iam_binding` can be used per role. Note that custom roles must be of the format