google_iam_policy with dynamic conditional binding always show diff on plan

[theminghuang]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Affected Resource(s)

• google_iam_policy. But I think it may apply to other data resource with binding as well

Terraform Configuration Files

data "google_iam_policy" "policy" {
  binding {
     ...
  }

  dynamic "binding" {
    for_each = lookup(var.viewers, each.key, null) != null ? [lookup(var.viewers, each.key)] : []
    content {
      members = binding.value.members
      role    = "roles/secretmanager.viewer"
      condition {
        expression = binding.value.condition.expression
        title      = binding.value.condition.title
      }
    }
  }
}

resource "google_secret_manager_secret_iam_policy" "policy" {
  project     = var.project_id
  secret_id   = google_secret_manager_secret.secret.secret_id
  policy_data = data.google_iam_policy.policy.policy_data
}

Debug Output

Panic Output

Expected Behavior

Should not show diff on plan after applied.

Actual Behavior

Show diff on every plan

  ~ resource "google_secret_manager_secret_iam_policy" "policy" {
      ...
      ~ policy_data = jsonencode(
          ~ {
              ~ bindings = [
                    # (1 unchanged element hidden)
                  ~ {
                      + condition = {
                          + expression = "some expression"
                          + title      = "some title"
                        }
                      ~ role      = "roles/secretmanager.viewer_withcond_3d5bd4f3d1cd3952fe85" -> "roles/secretmanager.viewer"
                    },
                ]
            }
        )
        # (3 unchanged attributes hidden)
    }

Steps to Reproduce

1. terraform plan

Important Factoids

References

• 0000

b/306360761

[SarahFrench]

👋 This is a bit of drive-by input, but I noticed this issue and it's relevant to something I looked at recently.

I think the cause of this might be that the google_secret_manager_secret_iam_policy resource doesn't support conditions. For example google_compute_instance_iam _* resources support conditions and the docs include information about conditions there, but the google_secret_manager_secretiam* documentation doesn't mention conditions.

This section of YAML is used to generate the IAM resources for the Secret Manager Secret resource, but it doesn't include the iam_conditions_request_type property which is needed to enable use of conditions

[melinath]

This is likely an issue with the API not supporting conditions (or rejecting requests that include conditions) rather than an issue with the Terraform resource.

[abheda-crest]

In the google_secret_manager_secret_iam_* resources, the condition fields were not supported because the iam_conditions_request_type field was missing in the Secret Manager Secret resource. This issue has now been resolved and support for this field has been added as a part of this PR. The condition field was introduced as part of release 5.33.0. The details regarding the condition field are available in the documentation.

[melinath]

Duplicate of https://github.com/hashicorp/terraform-provider-google/issues/11127

[melinath]

@abheda-crest thanks for identifying that this has been resolved!

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.