IAM member validation blocks special BigQuery dataset permissions

[nickstamat]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v1.3.6
on linux_amd64
+ provider registry.terraform.io/hashicorp/google v4.47.0

Affected Resource(s)

• google_bigquery_dataset_iam

Terraform Configuration Files

data "google_iam_policy" "owner" {
  binding {
    role = "roles/bigquery.dataOwner"
    members = [
      "projectOwners",
    ]
  }
}

resource "google_bigquery_dataset_iam_policy" "dataset" {
  dataset_id  = google_bigquery_dataset.dataset.dataset_id
  policy_data = data.google_iam_policy.owner.policy_data
}

Debug Output

N/A

Panic Output

N/A

Expected Behavior

IAM validation is expected to allow special BigQuery dataset IAM permissions, which are also parsed here:

terraform-provider-google/google/iam_bigquery_dataset.go

Lines 216 to 219 in 12d406e

	if member == "projectOwners" || member == "projectReaders" || member == "projectWriters" || member == "allAuthenticatedUsers" {
	// These are special BigQuery Dataset permissions
	return "specialGroup", member, nil
	}

Actual Behavior

IAM validation fails during plan, with the following error:

╷
│ Error: invalid value for bindings.0.members.0 (IAM members must have one of the values outlined here: https://cloud.google.com/billing/docs/reference/rest/v1/Policy#Binding)
╵

Steps to Reproduce

Perform a terraform plan on the above TF configuration using provider version v4.47.0 or newer.

Important Factoids

N/A

References

• Add validation for IAM members. #13203

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.