Add warning documenting behavior of the google_service_account_key resource for certain cases where the project cannot be inferred by terraform

[stangles]

Resolves hashicorp/terraform-provider-google#9617.

Release Note Template for Downstream PRs (will be copied)

iam: added warning regarding `google_service_account_key` behavior when the project cannot be inferred from the `service_account_id` field.

[google-cla]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

---

What to do if you already signed the CLA

Individual signers

• It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

• Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
• The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
• The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

[modular-magician]

Hello! I am a robot who works on Magic Modules PRs.

I have detected that you are a community contributor, so your PR will be assigned to someone with a commit-bit on this repo for initial review.

Thanks for your contribution! A human will be with you soon.

@melinath, please review this PR or find an appropriate assignee.

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 1 file changed, 1 insertion(+))
Terraform Beta: Diff ( 1 file changed, 1 insertion(+))

[stangles]

@googlebot I signed it!

[melinath]

It seems like it might be better to clarify the docs for service_account_id rather than adding a separate warning.

Also, this warning as written is not entirely correct (and neither is the current service_account_id). The project will be inferred if service_account_id is a full email address OR if it's a full URL like projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. It seems like the failure case is if just the first part of the email address is given?

[melinath]

@stangles are you still working on this PR?

[stangles]

It seems like the failure case is if just the first part of the email address is given?

Yes, that matches my understanding. When taking a look back at how I reproduced the unexpected behavior stated in the issue, I believe I had specified the SA unique ID, thus tripping the same error (and also demonstrating how the current service_account_id description isn't correct). Updated in d3ad7a4

are you still working on this PR?

Yes, apologies for the delayed response.

[melinath]

This looks a lot better but it seems like it should be possible to use projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID} according to these docs. Could you incorporate that information as well?

In case it's helpful here's the code the provider uses to calculate the actual service account id sent to the server: https://github.com/hashicorp/terraform-provider-google/blob/master/google/utils.go#L349

[stangles]

This looks a lot better but it seems like it should be possible to use projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID} according to these docs. Could you incorporate that information as well?

Done in f34e0f1

In case it's helpful here's the code the provider uses

That was quite helpful, thank you for the documentation and code references. Hopefully I've got it right this time around 😄

[melinath]

This looks a lot better - the one thing that seems to be missing is that I think it should be possible to use projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID} - could you include that as an option?

[stangles]

I think it should be possible to use projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID} - could you include that as an option?

Yep, added in 35423ff which hopefully is unambiguous without being too wordy.

[melinath]

LGTM - thanks!

[melinath]

Build failure is unrelated; this is docs only & will be fine after merge.