gcp: skip potentially dangerous kms_crypto/kms_key_ring_iam_policy/binding

[Piotr1215]

What problem are you facing?

Provider Name: provider-gcp
Provider Version:

Moved from https://github.com/upbound/official-providers/issues/446

• google_kms_crypto_key_iam_policy
• google_kms_crypto_key_iam_binding
• google_kms_key_ring_iam_policy
• google_kms_key_ring_iam_binding

The above resources are a powerful mechanism and similarly to iam roles it can lead to cluster-wide outage (see example: https://upboundio.slack.com/archives/C013YNJ423Y/p1659622122579009).

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_kms_crypto_key_iam

Three different resources help you manage your IAM policy for KMS crypto key. Each of these resources serves a different use case:

google_kms_crypto_key_iam_policy: Authoritative. Sets the IAM policy for the crypto key and replaces any existing policy already attached.
google_kms_crypto_key_iam_binding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the crypto key are preserved.
google_kms_crypto_key_iam_member: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the crypto key are preserved.

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_kms_key_ring_iam

Three different resources help you manage your IAM policy for KMS key ring. Each of these resources serves a different use case:

google_kms_key_ring_iam_policy: Authoritative. Sets the IAM policy for the key ring and replaces any existing policy already attached.
google_kms_key_ring_iam_binding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the key ring are preserved.
google_kms_key_ring_iam_member: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the key ring are preserved.

More details and discussion about the dangers of using those resources can be found here: #14

How could Official Providers help solve your problem?

The suggestion is not to implement those, but use google_kms_crypto_key_iam_member and google_kms_key_ring_iam_member exclusively. Similar decision has been made in the platform team regarding the usage of other iam resources.