search

privacysandbox / aggregation-service

This repository contains instructions and scripts to set up and test the Privacy Sandbox Aggregation Service
Apache License 2.0
65 stars 34 forks source link

Terraform is trying to modify account IAM Policy even if service_account_token_creator_list is not set #68

Open sebastianrtb opened 3 months ago

sebastianrtb commented 3 months ago

When running terraform for adtech setup, it modifies service IAM policy even though service_account_token_creator_list is not set in adtech_setup.auto.tfvars

It is problematic because we are running periodically terraform plan to check if there were no manual modifications in our environment. Unfortunately we need to add some IAM permissions to our service account configured in adtech_setup.aut.tfvars as deploy_service_account_email.

Could you change the terraform script so that if service_account_token_creator_list is not set (or is empty), then you will skip modification of account IAM policy?

nlrussell commented 1 month ago

Hi @sebastianrtb, thanks for the feedback. Let me investigate if there's a any known issues with the GCP Terraform provider, or if there's changes that can be made to resolve this. I'll reach back out with some follow up questions if I have any!