google_service_account_iam_policy doesn't allow setting policy on GCP created accounts

[rolandkool]

Hi,

When trying to apply an IAM policy on a service account that is automatically created by GCP when you enable an API for example, it fails stating that the service account doesn't match a regex.

Terraform Version

terraform 0.11.7
google provider: 1.9.0

Affected Resource(s)

• google_service_account_iam_policy (tested)
• google_service_account_iam_binding (assumed)
• google_service_account_iam_member (assumed)

Terraform Configuration Files

resource "google_service_account_iam_policy" "service-account-275613298579-compute-iam-policy" {
  service_account_id = "[email protected]"
  policy_data = "${data.google_iam_policy.service-account-275613298579-compute-policy-data.policy_data}"
}

data "google_iam_policy" "service-account-275613298579-compute-policy-data" {
  binding {
    role = "roles/iam.serviceAccountUser"
    members = [
      "user:[email protected]",
    ]
  }
}

Debug Output

Error: google_service_account_iam_policy.service-account-275613298579-compute-iam-policy: "service_account_id" ("[email protected]") doesn't match regexp "projects/(?:(?:[-a-z0-9]{1,63}\.)*(?:a-z?):)?(?:[0-9]{1,19}|(?:a-z0-9?))/serviceAccounts/a-z@[-a-z0-9\.]{1,63}\.iam\.gserviceaccount\.com$"

Expected Behavior

Should be valid service account, regex should allow these.

Actual Behavior

Policy not applied as the regex doesn't validate the service account.

Steps to Reproduce

Use example with terraform apply.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!