Fix 0-bootstrap iam_by_principals not taking into account all principals

[wiktorn]

When I provide iam_by_principals to bootstrap stage, not all entries are taken into account, as only principals listed local.iam_principals were used. For example, if using this to grant permissions to non-FAST defined groups, this would not work.

---

Checklist

I applicable, I acknowledge that I have:

• Read the contributing guide
• Ran terraform fmt on all modified files
• Regenerated the relevant README.md files using tools/tfdoc.py
• Made sure all relevant tests pass

[ludoo]

Can you provide repro, and of course this should only consider normal apply once a bootstrap SA has been created.

[ludoo]

Feel free to merge we can discuss later, don't want ro block you.

[wiktorn]

local.iam_principals contains principals defined in var.groups as keys. Hence the code is it is now, works only for those principals, i.e.:

groups = {
  gcp-billing-admins      = "group:ba@example.com"
  gcp-devops              = "group:do@example.com"
  gcp-network-admins      = "group:na@example.com"
  gcp-organization-admins = "group:oa@example.com"
  gcp-security-admins     = "group:sa@example.com"
  gcp-support             = "group:su@example.com"
}
iam_by_principals = {
  "group:su@example.com" = [ "roles/owner" ]
}

Works, but this won't work:

groups = {
  gcp-billing-admins      = "group:ba@example.com"
  gcp-devops              = "group:do@example.com"
  gcp-network-admins      = "group:na@example.com"
  gcp-organization-admins = "group:oa@example.com"
  gcp-security-admins     = "group:sa@example.com"
  gcp-support             = "group:su@example.com"
}
iam_by_principals = {
  "group:another@example.com" = [ "roles/owner" ]
}

We need to either document this limitation of iam_by_principals or fix this.

[ludoo]

local.iam_principals contains principals defined in var.groups as keys. Hence the code is it is now, works only for those principals, i.e.:

groups = {
  gcp-billing-admins      = "group:ba@example.com"
  gcp-devops              = "group:do@example.com"
  gcp-network-admins      = "group:na@example.com"
  gcp-organization-admins = "group:oa@example.com"
  gcp-security-admins     = "group:sa@example.com"
  gcp-support             = "group:su@example.com"
}
iam_by_principals = {
  "group:su@example.com" = [ "roles/owner" ]
}

Works, but this won't work:

groups = {
  gcp-billing-admins      = "group:ba@example.com"
  gcp-devops              = "group:do@example.com"
  gcp-network-admins      = "group:na@example.com"
  gcp-organization-admins = "group:oa@example.com"
  gcp-security-admins     = "group:sa@example.com"
  gcp-support             = "group:su@example.com"
}
iam_by_principals = {
  "group:another@example.com" = [ "roles/owner" ]
}

We need to either document this limitation of iam_by_principals or fix this.

Makes sense, good catch.