Terraform doesn't remove Deleted Service Account IAM Assignments on BQ Dataset

[ryanbianchi-lbg]

We have found a possible issue whereby Terraform seems to ignore IAM assignments for deleted service accounts.

Our scenario is as follows:

• A service account in Project A is granted access to a BigQuery Dataset in Project B.
• Project A is deleted.
• The Service Account is prefixed with 'deleted:' on the BigQuery Dataset in Project B.
• The BigQuery Dataset IAM Assignment code is removed for that service account.
• Terraform apply is run but just acknowledges that the IAM assignment has already been removed and doesn't attempt to remove it.
• The end result is, the IAM assignment remains but now with 'deleted' against the Service Account.

Is this behaviour expected or should the provider still remove the IAM assignment even after the Service Account has been deleted?

If you have a support request or question please submit them to one of these resources:

• Terraform community resources
• HashiCorp support (Terraform Enterprise customers)
• Google Cloud Platform Slack

[Noah-Codex]

Some clarifications for future readers:

1. This behavior can be replicated in a single project by deleting a service account (in Terraform) and attempting to apply the same Dataset IAM role on another service account.
2. Whether or not this is intended, if this causes Terraform state issues (e.g. trying to apply changes to the deleted service account), a solution is to delete the IAM permissions on the affected dataset. At the time of posting, that looks like:
   1. Go to the affected GCP project's BigQuery service.
   2. Click on the dataset the service account had IAM permissions on prior to deletion.
   3. Click on Sharing > Permissions.
   4. Find the permission on the deleted service account. Hovering over this will even clarify that the service account has been deleted.
   5. Manually delete the permission, assuming the user has the permissions to do so.

Note that this (a) does not clarify the cause of the issue and (b) can probably done with a CLI command.