cloud_run_service_iam_member unable to retrieve IAM policy

[timothyrenner]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v0.14.3

• provider registry.terraform.io/hashicorp/google v3.50.0

Affected Resource(s)

• google_cloud_run_service_iam_member

Terraform Configuration Files

These are the relevant bits.

provider "google" {
  project = var.gcp_project_id
  region  = "us-central1"
}

resource "google_cloud_run_service_iam_member" "run_invoker" {
  service = "my-service"
  role    = "roles/run.invoker"
  member  = "serviceAccount:${google_service_account.run_invoker.account_id}@${var.gcp_project_id}.iam.gserviceaccount.com"
}

Debug Output

https://gist.github.com/timothyrenner/53d213276c3148ab31eb31c225e26925
Real names have been replaced to protect the innocent. The above logs are for the creation of the service account. If you need other portions of the logs please let me know.

Panic Output

None

Expected Behavior

I would have expected it to work fine, the service and service accounts both exist, and other IAM member resources in the project work without issue.

Actual Behavior

The problem appears (at least to me, but I'm not an expert) to be the request itself:

2020-12-22T13:29:25.046-0600 [DEBUG] plugin.terraform-provider-google_v3.50.0_x5: ---[ REQUEST ]---------------------------------------
2020-12-22T13:29:25.046-0600 [DEBUG] plugin.terraform-provider-google_v3.50.0_x5: GET /v1/projects/REDACTED/locations//services/my-service:getIamPolicy?alt=json HTTP/1.1
2020-12-22T13:29:25.046-0600 [DEBUG] plugin.terraform-provider-google_v3.50.0_x5: Host: -run.googleapis.com
2020-12-22T13:29:25.047-0600 [DEBUG] plugin.terraform-provider-google_v3.50.0_x5: User-Agent: Terraform/0.14.3 (+https://www.terraform.io) Terraform-Plugin-SDK/2.1.0 terraform-provider-google/3.50.0
2020-12-22T13:29:25.047-0600 [DEBUG] plugin.terraform-provider-google_v3.50.0_x5: Content-Type: application/json
2020-12-22T13:29:25.047-0600 [DEBUG] plugin.terraform-provider-google_v3.50.0_x5: Accept-Encoding: gzip
2020-12-22T13:29:25.047-0600 [DEBUG] plugin.terraform-provider-google_v3.50.0_x5: 
2020-12-22T13:29:25.047-0600 [DEBUG] plugin.terraform-provider-google_v3.50.0_x5: 
2020-12-22T13:29:25.047-0600 [DEBUG] plugin.terraform-provider-google_v3.50.0_x5: -----------------------------------------------------

1. The region is not filled in the URLs provided (v1/projects/REDACTED/locations//services/my-service). Default region for the project is us-central1 and none of the other resources have that issue.
2. The hostname appears to be missing something: (Host: -run.googleapis.com).

Steps to Reproduce

1. terraform apply

Important Factoids

This has failed when I run locally as project owner and as a service account (with Project IAM Admin) with the same error.

References

Nothing I was able to find.

[edwardmedia]

@timothyrenner can you try something like below?

resource "google_cloud_run_service_iam_member" "member" {
  location = google_cloud_run_service.default.location
  project = google_cloud_run_service.default.project
  service = google_cloud_run_service.default.name
  role = "roles/viewer"
  member = "serviceAccount:${google_service_account.run_invoker.account_id}@${var.gcp_project_id}.iam.gserviceaccount.com"
}

[timothyrenner]

Adding the project and location explicitly worked. Any idea why I have to do that just for this resource?

[edwardmedia]

@timothyrenner it is based on the google_cloud_run_service. Your default settings appear not the same as ones from the service. Closing the service then. Feel free to reopen if you have further questions. Thank you

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!