Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support organization iam conditions #9047

Conversation

modular-magician
Copy link
Collaborator

Resolved #8904. Organization IAM via terraform didn't properly support v3 policies (i.e. with conditions) resulting in the google API error:

Error 400: Policy cannot contain both conditions and condition hashes. Please update your client to request version 3 policy. For more information, please refer to https://cloud.google.com/iam/docs/policies#versions.

Note that the tests don't run in CI/CD so if you want to verify that they work at all (or that they don't work at places they're expected not to) you'll need to do so locally by setting your environment variables for a personal org and running:

TF_RUN_ORG_IAM=true make testacc TEST=./google TESTARGS='-run="TestAccOrganizationIamMembersAndBindings'

If this PR is for Terraform, I acknowledge that I have:

  • Searched through the issue tracker for an open issue that this either resolves or contributes to, commented on it to claim it, and written "fixes {url}" or "part of {url}" in this PR description. If there were no relevant open issues, I opened one and commented that I would like to work on it (not necessary for very small changes).
  • Generated Terraform, and ran make test and make lint to ensure it passes unit and linter tests.
  • Ensured that all new fields I added that can be set by a user appear in at least one example (for generated resources) or third_party test (for handwritten resources or update tests).
  • Ran relevant acceptance tests (If the acceptance tests do not yet pass or you are unable to run them, please let your reviewer know).
  • Read the Release Notes Guide before writing my release note below.

Release Note Template for Downstream PRs (will be copied)

resourcemanager: fixed broken handling of IAM conditions for `google_organization_iam_member`, `google_organization_iam_binding`, and `google_organization_iam_policy`

Derived from GoogleCloudPlatform/magic-modules#4749

* Split out organization iam tests

* Added failing tests for organization iam binding and member with conditions

* Made organization iam policy requests include requested policy version

Signed-off-by: Modular Magician <magic-modules@google.com>
@ghost ghost added size/l labels Apr 30, 2021
@modular-magician modular-magician merged commit 77eae86 into hashicorp:master Apr 30, 2021
@ghost
Copy link

ghost commented May 31, 2021

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!

@hashicorp hashicorp locked as resolved and limited conversation to collaborators May 31, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

google_organization_iam_binding with IAM Conditions
1 participant