update new role entity if old role does not match new role

.changelog/4735.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+storage: fixed bug where `role_entity` user wouldn't update if the role changed.
+```

google-beta/resource_storage_bucket_acl.go

@@ -299,8 +299,8 @@ func resourceStorageBucketAclUpdate(d *schema.ResourceData, meta interface{}) er
 				Entity: pair.Entity,
 			}
 
-			// If the old state is missing this entity, it needs to be inserted
-			if _, ok := old_re_map[pair.Entity]; !ok {
+			// If the old state entity's role doesn't match the new one, it needs to be inserted
+			if old_re_map[pair.Entity] != bucketAccessControl.Role {
 				_, err = config.NewStorageClient(userAgent).BucketAccessControls.Insert(
 					bucket, bucketAccessControl).Do()
 			}

google-beta/resource_storage_bucket_acl_test.go

@@ -11,6 +11,7 @@ import (
 
 var (
 	roleEntityBasic1        = "OWNER:user-paddy@hashicorp.com"
+	roleEntityBasic1_reader = "READER:user-paddy@hashicorp.com"
 	roleEntityBasic2        = "READER:user-paddy@carvers.co"
 	roleEntityBasic3_owner  = "OWNER:user-paddy@paddy.io"
 	roleEntityBasic3_reader = "READER:user-foran.paddy@gmail.com"
@@ -79,6 +80,44 @@ func TestAccStorageBucketAcl_upgrade(t *testing.T) {
 	})
 }
 
+func TestAccStorageBucketAcl_upgradeSingleUser(t *testing.T) {
+	t.Parallel()
+
+	bucketName := testBucketName(t)
+	skipIfEnvNotSet(t, "GOOGLE_PROJECT_NUMBER")
+	vcrTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccStorageBucketAclDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testGoogleStorageBucketsAclBasic1_reader(bucketName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGoogleStorageBucketAcl(t, bucketName, roleEntityBasic1_reader),
+					testAccCheckGoogleStorageBucketAcl(t, bucketName, roleEntityBasic2),
+				),
+			},
+
+			{
+				Config: testGoogleStorageBucketsAclBasic1(bucketName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGoogleStorageBucketAcl(t, bucketName, roleEntityBasic1),
+					testAccCheckGoogleStorageBucketAcl(t, bucketName, roleEntityBasic2),
+				),
+			},
+
+			{
+				Config: testGoogleStorageBucketsAclBasicDelete(bucketName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGoogleStorageBucketAclDelete(t, bucketName, roleEntityBasic1),
+					testAccCheckGoogleStorageBucketAclDelete(t, bucketName, roleEntityBasic2),
+					testAccCheckGoogleStorageBucketAclDelete(t, bucketName, roleEntityBasic1_reader),
+				),
+			},
+		},
+	})
+}
+
 func TestAccStorageBucketAcl_downgrade(t *testing.T) {
 	t.Parallel()
 
@@ -224,6 +263,19 @@ func testAccStorageBucketAclDestroyProducer(t *testing.T) func(s *terraform.Stat
 	}
 }
 
+func testGoogleStorageBucketsAclBasic1_reader(bucketName string) string {
+	return fmt.Sprintf(`
+resource "google_storage_bucket" "bucket" {
+  name = "%s"
+}
+
+resource "google_storage_bucket_acl" "acl" {
+  bucket      = google_storage_bucket.bucket.name
+  role_entity = ["%s", "%s", "%s", "%s", "%s"]
+}
+`, bucketName, roleEntityOwners, roleEntityEditors, roleEntityViewers, roleEntityBasic1_reader, roleEntityBasic2)
+}
+
 func testGoogleStorageBucketsAclBasic1(bucketName string) string {
 	return fmt.Sprintf(`
 resource "google_storage_bucket" "bucket" {