google_organization_iam_binding with IAM Conditions

[aba75-sbg]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v0.13.5
hashicorp/google v3.63.0

Affected Resource(s)

• google_organization_iam_binding

Terraform Configuration Files

resource "google_organization_iam_binding" "organization-vpc-attach-conditions" {
  org_id  = data.google_organization.org.org_id
  role    = local.vpcAttachRole

  members = [
    "serviceAccount:${var.data-sa}",
  ]

  condition {
    title       = "attach_detach_dev_data_shared_vpc"
    description = "Allow data to attach and detach to the dev data shared vpc"
    expression  = "resource.name.startsWith(\"projects/data\") || resource.name.startsWith(\"projects/svpc-host-d\")"
  }
}

Debug Output

https://gist.github.com/aba75-sbg/89fb01ff5b04b3ca84be35c69c1e7720

Panic Output

Expected Behavior

Should have successfully produced an IAM binding for the GCP Service Account Role at the Org level with a Condition that the binding only worked for specific Projects names, and returned with a success.

Actual Behavior

When using terraform to update an IAM policy at Org level containing conditional bindings. The conditional bindings add and update the policy 1st time round, but then any subsequent updates to the policy cause the following error.

Error: Error applying IAM policy for organization "[REDACTED]": Error setting IAM policy for organization "[REDACTED]": googleapi: Error 400: Policy cannot contain both conditions and condition hashes. Please update your client to request version 3 policy. For more information, please refer to https://cloud.google.com/iam/docs/policies#versions., badRequest
  on .terraform/modules/data-vpc-attach-networking-iam/modules/organizations_iam/main.tf line 31, in resource "google_organization_iam_binding" "organization_iam_authoritative":
  31: resource "google_organization_iam_binding" "organization_iam_authoritative" {

Steps to Reproduce

terraform apply

Important Factoids

Opened a GCP Support ticket to investigate this before coming here. Here is their summary;

Based on the logs you shared, the issue is happening for the IAM member at the organization level.
By inspecting the logs, the error "Policy cannot contain both conditions and condition hashes" is returned when the Post request is done for organization level IAM:
POST /v1/organizations/[REDACTED]:setIamPolicy?alt=json&prettyPrint=false HTTP/1.1
A similar request at the folder level
POST /v2/folders/[REDACTED]:getIamPolicy?alt=json&prettyPrint=false HTTP/1.1
contains the body:
{
"options": {
"requestedPolicyVersion": 3
}
}

with this missing body at the org level POST request, it shows why the error returns 'Please update your client to request version 3 policy" at the org level only and not at the folder level.

In brief, the POST request done for the org level IAM is missing the requestedPolicyVersion. Which means this is not the underlying APIs issue, but the provider issue.

References

A previous closed issue looks very similar #8186

• #0000

[aba75-sbg]

Hey. It's nice to see a PR on this issue. Looking through the commits, it seems like tests have been added but no change to any code. Am I missing something?

[melinath]

@aba75-sbg no, you're not missing anything. It's a partial PR I haven't sent out for review yet.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!