Error 403 when import google_project_iam_member for existing resources

[Ameausoone]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• If an issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to "hashibot", a community member has claimed the issue already.

Terraform Version

Terraform v0.12.7

• provider.github v2.2.0
• provider.gitlab v2.2.0
• provider.google v2.13.0
• provider.null v2.1.2

Affected Resource(s)

• google_project_iam_member

Terraform Configuration Files

resource "google_project_iam_member" "admins" {
  project = "my-project-id"
  role = "roles/owner"
  member = "user:${each.value.email}"
  for_each = var.admins
}

Debug Output

https://gist.github.com/Ameausoone/9137c691fe015c76c8f05957d99fc842

Panic Output

Expected Behavior

terraform import 'google_project_iam_member.admins["ameausoone"]' 'my-project-id roles/owner user:antoine.meausoone(at)domain.com'

should import existing resource

Actual Behavior

terraform import 'google_project_iam_member.admins["ameausoone"]' 'my-project-id roles/owner user:antoine.meausoone(at)domain.com'

Error: Error reading Resource "project "pl-service-infra-lmfr"" with IAM Member: Role "roles/owner" Member "user:antoine.meausoone(at)domain.com": Error retrieving IAM policy for project "my-project-id": googleapi: Error 403: The caller does not have permission, forbidden

Steps to Reproduce

• manually add user as owner on gcp project
• declare resource in terraform
• import resource

terraform import 'google_project_iam_member.admins["ameausoone"]' 'my-project-id roles/owner user:antoine.meausoone(at)domain.com'

Important Factoids

• I checked twice that my service account used by terraform is "project/owner" on project
• If I deleted iam resource, and then apply terraform, iam resource will be created, and user attached to the project.
• If I try to create resource with existed iam resource, I got a 400 bad request error (which seems legitimate)

References

• #0000

[emilymye]

I'm not sure I have enough information to debug this properly, as I can properly import a user in my own project. I'd check thay our service account is able to read the project IAM policy using a different source (for example the API or gcloud) to confirm that it isn't a permission problem.

[Ameausoone]

Thank you @emilymye I can't reproduce the problem, I will reopen it if I could isolate the problem.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!