The readme for the service_accounts_iam module indicates that project is not a required variable, and defaults it to an empty string. However, when you try to apply this module with an empty string as the project, it uses an invalid service account ID when creating the bindings (e.g. projects//serviceAccounts/my-service-account@project.iam.gserviceaccount.com)
Expected behavior
I expect the module to generate an error if the project isn't specified.
Observed behavior
Error: "service_account_id" ("projects//serviceAccounts/REDACTED@REDACTED.iam.gserviceaccount.com") doesn't match regexp "projects/(?:(?:[-a-z0-9]{1,63}\\.)*(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?):)?(?:[0-9]{1,19}|(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)|-)/serviceAccounts/((?:(?:[-a-z0-9]{1,63}\\.)*(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?):)?(?:[0-9]{1,19}|(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?))@[a-z]+.gserviceaccount.com$|[0-9]{1,20}-compute@developer.gserviceaccount.com|[a-z](?:[-a-z0-9]{4,28}[a-z0-9])@[-a-z0-9\\.]{1,63}\\.iam\\.gserviceaccount\\.com$)"
with module.app_service_accounts_iam_binding.google_service_account_iam_member.service_account_iam_additive["default--roles/iam.workloadIdentityUser--serviceAccount:REDACTED.svc.id.goog[default/REDACTED]"],
│ on .terraform/modules/hail_search_service_accounts_iam_binding/modules/service_accounts_iam/main.tf line 51, in resource "google_service_account_iam_member" "service_account_iam_additive":
│ 51: service_account_id = "projects/${var.project}/serviceAccounts/${module.helper.bindings_additive[each.key].name}"
TL;DR
The readme for the service_accounts_iam module indicates that
project
is not a required variable, and defaults it to an empty string. However, when you try to apply this module with an empty string as the project, it uses an invalid service account ID when creating the bindings (e.g.projects//serviceAccounts/my-service-account@project.iam.gserviceaccount.com
)Expected behavior
I expect the module to generate an error if the project isn't specified.
Observed behavior
Terraform Configuration
Additional information
No response