State Converter fails on gcp:projects:IAMMember | Wrong number of parts to Member id

[GeoffMillerAZ]

What happened?

I am trying to import resources from an existing Terraform State file.

pulumi import --from terraform terraform.tfstate

error: gcp:projects:IAMMember (gke-monitoring): error: Preview failed: importing project-name-here/roles/monitoring.viewer/serviceAccount:default-gke@project-name-here.iam.gserviceaccount.com: Wrong number of parts to Member id [project-name-here/roles/monitoring.viewer/serviceAccount:default-gke@project-name-here.iam.gserviceaccount.com]; expected 'resource_name role member [condition_title]'.

Example

I apologize for my example to reproduce and state I'm sharing not being consistent. I don't have a good setup yet for gcp and I'm new to gcp. I'll update if I get a better example.

Code similar to this:

variable "gcp_project" {
  type        = string
  description = "value of the GCP project"
}

provider "google" {
  project = var.gcp_project
  region  = "us-central1"
}

resource "google_service_account" "example_user" {
  account_id   = "example-user"
  display_name = "Example User"
}

resource "google_project_iam_binding" "example_binding" {
  project = var.gcp_project
  role    = "roles/viewer"

  members = [
    "user:${google_service_account.example_user.email}",
  ]
}

resource "google_project_iam_member" "example_member" {
  project = var.gcp_project
  role    = "roles/viewer"
  member  = "user:${google_service_account.example_user.email}"
}

Terraform state file similar to this:

{
      "mode": "managed",
      "type": "google_project_iam_member",
      "name": "gke-logging",
      "provider": "provider[\"registry.terraform.io/hashicorp/google\"]",
      "instances": [
        {
          "schema_version": 0,
          "attributes": {
            "condition": [],
            "etag": "BwYHPNcgIxI=",
            "id": "project-name-here/roles/logging.logWriter/serviceAccount:default-gke@project-name-here.iam.gserviceaccount.com",
            "member": "serviceAccount:default-gke@project-name-here.iam.gserviceaccount.com",
            "project": "project-name-here",
            "role": "roles/logging.logWriter"
          },
          "sensitive_attributes": [],
          "private": "...",
          "dependencies": [
            "google_service_account.gke"
          ]
        }
      ]
    },

error: gcp:projects:IAMMember (gke-monitoring): error: Preview failed: importing project-name-here/roles/monitoring.viewer/serviceAccount:default-gke@project-name-here.iam.gserviceaccount.com: Wrong number of parts to Member id [project-name-here/roles/monitoring.viewer/serviceAccount:default-gke@project-name-here.iam.gserviceaccount.com]; expected 'resource_name role member [condition_title]'.

Output of pulumi about

terraform version                                               
Terraform v1.5.7
on darwin_arm64
+ provider registry.terraform.io/hashicorp/google v5.0.0

Your version of Terraform is out of date! The latest version
is 1.6.0. You can update by downloading from https://www.terraform.io/downloads.html

CLI          
Version      3.87.0
Go Version   go1.21.2
Go Compiler  gc

Plugins
NAME    VERSION
gcp     6.67.0
nodejs  unknown

Host     
OS       darwin
Version  14.0
Arch     arm64

This project is written in nodejs: executable='/usr/local/bin/node' version='v18.18.0'

Current Stack: GeoffMillerAZ/convert_google_project_iam_member/dev

Found no resources associated with dev

Found no pending operations associated with dev

Backend        
Name           pulumi.com
URL            https://app.pulumi.com/GeoffMillerAZ
User           GeoffMillerAZ
Organizations  GeoffMillerAZ
Token type     personal

Dependencies:
NAME            VERSION
@types/node     16.18.58
@pulumi/gcp     6.67.0
@pulumi/pulumi  3.87.0

Pulumi locates its logs in /var/folders/39/pjbcs1t54djdg68ptpxw5q880000gn/T/ by default

Additional context

related issues:

43

Contributing

Vote on this issue by adding a 👍 reaction. To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[justinvp]

From: https://github.com/pulumi/pulumi/issues/14479

Same is true for gcp:serviceAccount:IAMMember, gcp:storage:BucketIAMMember and gcp:spanner:DatabaseIAMMember, but my guess is that it's true for all of them.