IAM custom role creation fails due to invalid argument (badRequest)

[snoozesecurity]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• If an issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to "hashibot", a community member has claimed the issue already.

Terraform v0.12.12

Affected Resource(s)

• google_project_iam_custom_role

main.tf

resource "google_project_iam_custom_role" "my-custom-role" {
  role_id     = "myCustomRole"
  title       = "My Custom Role"
  description = "A description"
  permissions = ["iam.roles.list", "iam.roles.create", "iam.roles.delete"]
}

resource "google_project_iam_member" "custom_membership" {
  role     = "projects/${var.project_id}/roles/${google_project_iam_custom_role.my-custom-role.role_id}"
  member  = "user:user@domain.com"
}

Expected Behavior

I would expect the role to be created since my service account has the proper permissions.

Actual Behavior

terraform apply fails. Snippet of the error message:

400: Request contains an invalid argument., badRequest

on main.tf line 15, in resource "google_project_iam_member" "custom_membership":
15: resource "google_project_iam_member" "custom_membership" {

(note that the final '{' symbol is underlined in stdout)

Steps to Reproduce

1. terraform apply

[nat-henderson]

I will need your debug logs to help further - this issue doesn't occur in our unit tests.

[snoozesecurity]

Here is what I believe to be the relevant snippet of my debug log. Let me know if additional information is required - thank you for taking a look!

tf_debug_log.txt

[mogthesprog]

We're seeing this exact same issue, only the last week or so, and with terraform 0.11.7, and provider version 1.16.0. We haven't tried bumping the provider version yet, but the TF version in the original issue implies that even later providers have this problem.

[nat-henderson]

Are you able to do that in the cloud console? In your log it looks like you're trying to add gmailuser@gmail.com - to make someone a project owner comes with a complex flow, which might not be handled right in the API. Can you give it a shot there and see if it works? And if it does work, will terraform apply work afterwards?

[snoozesecurity]

@ndmckinley I verified that myCustomRole actually does get created by terraform. The issue is with adding a user to that specific role, as per the below terraform:

resource "google_project_iam_member" "custom_membership" { role = "projects/${var.project_id}/roles/${google_project_iam_custom_role.my-custom-role.role_id}" member = "user:gmailuser@gmail.com" }

Am I just going about the membership incorrectly? I was able to perform the above action in the UI without issue, granted I was not acting on behalf of the service account obviously.

[edwardmedia]

@snoozesecurity what version of the provider were you using? If that was old, can you try again using the latest version? Please provide the new full debug log if you can repro this issue.

[edwardmedia]

@snoozesecurity your above code works for me. both customrole and iam binding are showed up in the gcp console. I am closing this issue. Please feel free to reopen it if you need further assistance.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!