Closed Shaked closed 1 year ago
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days
Frustrating to see Google being bad at support here. But, alas...they're a cloud provider and they provided poor code.
TL;DR
Cannot use additive mode as it fails for sensitive values:
Expected behavior
Should plan and apply succesfullysuccessfully
Observed behavior
Plan failed due to sensitive values:
Terraform Configuration
module "projects_iam_bindings" { source = "terraform-google-modules/iam/google//modules/projects_iam" version = "7.4.1" projects = ["${var.project_id}"] bindings = local.gcp_roles mode = "additive" }
Terraform Version
locals { g1 = { "roles/owner" = [ "test1", "test2" ] "roles/viewer" = [ "test3", "test2" ] "roles/random" = [ "test3", "test2" ] } g2 = { "roles/owner" = [ "abc", "def" ] "roles/viewer" = [ "gec", "ccc" ] "roles/viewer1" = [ "gecb", "caa" ] }
sa = { for role_name, sas in local.g2 : role_name => [ for sa in sas : "serviceAccount:${sa}@project_id.iam.gserviceaccount.com" ] } groups = { for role_name, groups in local.g1 : role_name => [ for group in groups : "group:${group}@test.com" ] } roles = distinct(concat(keys(local.g1), keys(local.g2)))
all = { for role in local.roles : role => distinct(flatten([ try(local.sa[role], []), try(local.groups[role], []) ])) } } output "sa" { value = local.sa }
output "groups" { value = local.groups }
output "all" { value = local.all }