Add IAM resources types which allow to set one or multiple users to many roles

[radkomateusz]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

Currently google terraform provider give us 3 kinds of resources for managing IAMs:

• iam_member 1 user -> 1 role (non authoritative)
• iam_binding many users -> 1 role (authoritative for given role scope)
• iam_policy - many roles -> many users (but in form of list of iam_bindings, authoritative for whole IAM policy for given resource)

I would like to have option for having this mappings also:

• 1 user -> many roles (authoritative for given user scope/ or non authoritative also)
• many users - many roles (non authoritative)

It would make terraform config more readable and maintainable. Currently if we have many users which should have many roles assigned and we want to allow to manually maintain another iams, then we have to use a lot of iam_member resources. It produces big and not readable config file.

New or Affected Resource(s)

• google_*_iam_member (allowing to specify more than one role)
• google_*_iam_binding (allowing non authoritative version or allowing to specify more than one role)
• possible new resources

Potential Terraform Configuration

resource "google_project_iam_member" "project" {
  project = "your-project-id"
  role    = ["roles/editor", "roles/anotherRole1", "roles/anotherRole2"]
  member  = "user:[email protected]"
}

resource "google_project_iam_binding" "project" {
  project = "your-project-id"
  role    = ["roles/editor", "roles/anotherRole1", "roles/anotherRole2"]

  members = [
    "user:[email protected]", "user:[email protected]",
  ]
}
}

References

• can a iam member be given multiple roles one time? #3478 - it was only a question, not a feature request

[emilymye]

Since our binding/role resources are split up specifically to make breaking down of IAM policies easier, is there a reason you don't want to use count (available before 0.12) or foreach (0.12+)?

[radkomateusz]

Sorry for the late answer. No, I have nothing against using foreach. At that time I was aware only about count which have some disadvantages. Currently using foreach construction is enough for me. Thanks.

[paddycarver]

It sounds like this got resolved, so I'm going to close it out. If this is still something people are looking for, feel free to open a new issue. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!