Provider maps roles/bigquery.dataViewer to incorrect primitive

[CrAzE124]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v0.12.25

• provider.google v3.22.0

Affected Resource(s)

• google_bigquery_dataset_access

Terraform Configuration Files

resource "google_bigquery_dataset" "tf_test_dataset" {
  dataset_id  = "tf_test_ds"
  location    = "EU"
  description = "Testing dataset for terraform playground"

  labels = {
    env = "dev"
  }
}

resource "google_bigquery_dataset_access" "access_example" {
  dataset_id = google_bigquery_dataset.tf_test_dataset.dataset_id
  domain     = "mydomain.com"
  role       = "roles/bigquery.dataViewer"
}

Debug Output

Potential sensitive information, and I don't believe anything relevant to the actual issue at hand.

The only DEBUG output worth mentioning is that the predefined role does in fact get replaced.

Panic Output

Error: Error creating DatasetAccess: googleapi: Error 400: IAM setPolicy failed for Dataset myproject:tf_test_ds: The role name must be in the form "roles/{role}", "organizations/{organization_id}/roles/{role}", or "projects/{project_id}/roles/{role}"., invalid

Expected Behavior

The access_example resource should have been created with the correct rights

Actual Behavior

An error is logged -

Error creating DatasetAccess: googleapi: Error 400: IAM setPolicy failed for Dataset myproject:tf_test_ds: The role name must be in the form "roles/{role}", "organizations/{organization_id}/roles/{role}", or "projects/{project_id}/roles/{role}"., invalid

It seems TF tries to map roles/bigquery.dataViewer to VIEWER instead of READER

Steps to Reproduce

1. terraform apply

Important Factoids

The correct primitive according to the docs should be READER, not VIEWER

References

• https://cloud.google.com/bigquery/docs/access-control-primitive-roles
• https://github.com/terraform-providers/terraform-provider-google/blob/master/google/resource_big_query_dataset_access.go#L30
• https://github.com/terraform-providers/terraform-provider-google/pull/6307/files

[edwardmedia]

@CrAzE124 to your case, you might want to provide READER instead of roles/bigquery.dataViewer for that role in your code.

But in below code, the role value in access block in google_bigquery_dataset failed to be updated accordingly after I updated the role and re-applied the plan.

resource "google_bigquery_dataset_access" "access" {
  dataset_id    = google_bigquery_dataset.dataset.dataset_id
#  role = "READER" <------ change role here and re-apply and watch the result in its access block
 role          = "OWNER"
  user_by_email = google_service_account.bqowner.email
}
resource "google_bigquery_dataset" "dataset" {
  dataset_id = "example_dataset"
}
resource "google_service_account" "bqowner" {
  account_id = "bqowner"
}

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!