Skip to content

Read-after-write consistency issue on google_tags_tag_key_iam_member with conditions #16525

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
trodge merged 2 commits into from
Mar 3, 2026
Merged

Read-after-write consistency issue on google_tags_tag_key_iam_member with conditions #16525

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1d39919
tagKeys/tagValues IAM read-after-write consistency issue using condit…
jnahelou Feb 25, 2026
8e2dea0
tests: tagKeys/tagValues iam conditions
jnahelou Feb 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions mmv1/products/tags/TagKey.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ iam_policy:
method_name_separator: ':'
fetch_iam_policy_verb: 'POST'
parent_resource_attribute: 'tag_key'
iam_conditions_request_type: 'REQUEST_BODY'
custom_code:
exclude_tgc: true
examples:
Expand Down
1 change: 1 addition & 0 deletions mmv1/products/tags/TagValue.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ iam_policy:
method_name_separator: ':'
fetch_iam_policy_verb: 'POST'
parent_resource_attribute: 'tag_value'
iam_conditions_request_type: 'REQUEST_BODY'
custom_code:
exclude_tgc: true
exclude_sweeper: true
Expand Down
189 changes: 183 additions & 6 deletions mmv1/third_party/terraform/services/tags/resource_tags_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -674,7 +674,7 @@ func testAccTagsTagKeyIamBinding(t *testing.T) {

context := map[string]interface{}{
"random_suffix": acctest.RandString(t, 10),
"role": "roles/viewer",
"role": "roles/resourcemanager.tagAdmin",
"org_id": envvar.GetTestOrgFromEnv(t),

"short_name": "tf-test-key-" + acctest.RandString(t, 10),
Expand All @@ -687,6 +687,9 @@ func testAccTagsTagKeyIamBinding(t *testing.T) {
{
Config: testAccTagsTagKeyIamBinding_basicGenerated(context),
},
{
Config: testAccTagsTagKeyIamBinding_withCondition(context),
},
{
// Test Iam Binding update
Config: testAccTagsTagKeyIamBinding_updateGenerated(context),
Expand All @@ -700,7 +703,7 @@ func testAccTagsTagKeyIamMember(t *testing.T) {

context := map[string]interface{}{
"random_suffix": acctest.RandString(t, 10),
"role": "roles/viewer",
"role": "roles/resourcemanager.tagAdmin",
"org_id": envvar.GetTestOrgFromEnv(t),

"short_name": "tf-test-key-" + acctest.RandString(t, 10),
Expand All @@ -714,6 +717,9 @@ func testAccTagsTagKeyIamMember(t *testing.T) {
// Test Iam Member creation (no update for member, no need to test)
Config: testAccTagsTagKeyIamMember_basicGenerated(context),
},
{
Config: testAccTagsTagKeyIamMember_withCondition(context),
},
},
})
}
Expand All @@ -723,7 +729,7 @@ func testAccTagsTagKeyIamPolicy(t *testing.T) {

context := map[string]interface{}{
"random_suffix": acctest.RandString(t, 10),
"role": "roles/viewer",
"role": "roles/resourcemanager.tagAdmin",
"org_id": envvar.GetTestOrgFromEnv(t),

"short_name": "tf-test-key-" + acctest.RandString(t, 10),
Expand All @@ -739,6 +745,9 @@ func testAccTagsTagKeyIamPolicy(t *testing.T) {
{
Config: testAccTagsTagKeyIamPolicy_emptyBinding(context),
},
{
Config: testAccTagsTagKeyIamPolicy_withCondition(context),
},
},
})
}
Expand All @@ -760,6 +769,28 @@ resource "google_tags_tag_key_iam_member" "foo" {
`, context)
}

func testAccTagsTagKeyIamMember_withCondition(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_tags_tag_key" "key" {

parent = "organizations/%{org_id}"
short_name = "%{short_name}"
description = "For %{short_name} resources."
}

resource "google_tags_tag_key_iam_member" "foo" {
tag_key = google_tags_tag_key.key.name
role = "%{role}"
member = "user:admin@hashicorptest.com"
condition {
description = "Allow tagUser grant."
expression = "api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([\"roles/resourcemanager.tagUser\"])"
title = "only_taguser_delegation"
}
}
`, context)
}

func testAccTagsTagKeyIamPolicy_basicGenerated(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_tags_tag_key" "key" {
Expand Down Expand Up @@ -802,6 +833,34 @@ resource "google_tags_tag_key_iam_policy" "foo" {
`, context)
}

func testAccTagsTagKeyIamPolicy_withCondition(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_tags_tag_key" "key" {

parent = "organizations/%{org_id}"
short_name = "%{short_name}"
description = "For %{short_name} resources."
}

data "google_iam_policy" "foo" {
binding {
role = "%{role}"
members = ["user:admin@hashicorptest.com"]
condition {
description = "Allow tagUser grant."
expression = "api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([\"roles/resourcemanager.tagUser\"])"
title = "only_taguser_delegation"
}
}
}

resource "google_tags_tag_key_iam_policy" "foo" {
tag_key = google_tags_tag_key.key.name
policy_data = data.google_iam_policy.foo.policy_data
}
`, context)
}

func testAccTagsTagKeyIamBinding_basicGenerated(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_tags_tag_key" "key" {
Expand All @@ -819,6 +878,28 @@ resource "google_tags_tag_key_iam_binding" "foo" {
`, context)
}

func testAccTagsTagKeyIamBinding_withCondition(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_tags_tag_key" "key" {

parent = "organizations/%{org_id}"
short_name = "%{short_name}"
description = "For %{short_name} resources."
}

resource "google_tags_tag_key_iam_binding" "foo" {
tag_key = google_tags_tag_key.key.name
role = "%{role}"
members = ["user:admin@hashicorptest.com"]
condition {
description = "Allow tagUser grant."
expression = "api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([\"roles/resourcemanager.tagUser\"])"
title = "only_taguser_delegation"
}
}
`, context)
}

func testAccTagsTagKeyIamBinding_updateGenerated(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_tags_tag_key" "key" {
Expand All @@ -841,7 +922,7 @@ func testAccTagsTagValueIamBinding(t *testing.T) {

context := map[string]interface{}{
"random_suffix": acctest.RandString(t, 10),
"role": "roles/viewer",
"role": "roles/resourcemanager.tagAdmin",
"org_id": envvar.GetTestOrgFromEnv(t),

"key_short_name": "tf-test-key-" + acctest.RandString(t, 10),
Expand All @@ -855,6 +936,9 @@ func testAccTagsTagValueIamBinding(t *testing.T) {
{
Config: testAccTagsTagValueIamBinding_basicGenerated(context),
},
{
Config: testAccTagsTagValueIamBinding_withCondition(context),
},
{
// Test Iam Binding update
Config: testAccTagsTagValueIamBinding_updateGenerated(context),
Expand All @@ -868,7 +952,7 @@ func testAccTagsTagValueIamMember(t *testing.T) {

context := map[string]interface{}{
"random_suffix": acctest.RandString(t, 10),
"role": "roles/viewer",
"role": "roles/resourcemanager.tagAdmin",
"org_id": envvar.GetTestOrgFromEnv(t),

"key_short_name": "tf-test-key-" + acctest.RandString(t, 10),
Expand All @@ -883,6 +967,9 @@ func testAccTagsTagValueIamMember(t *testing.T) {
// Test Iam Member creation (no update for member, no need to test)
Config: testAccTagsTagValueIamMember_basicGenerated(context),
},
{
Config: testAccTagsTagValueIamMember_withCondition(context),
},
},
})
}
Expand All @@ -892,7 +979,7 @@ func testAccTagsTagValueIamPolicy(t *testing.T) {

context := map[string]interface{}{
"random_suffix": acctest.RandString(t, 10),
"role": "roles/viewer",
"role": "roles/resourcemanager.tagAdmin",
"org_id": envvar.GetTestOrgFromEnv(t),

"key_short_name": "tf-test-key-" + acctest.RandString(t, 10),
Expand All @@ -909,6 +996,9 @@ func testAccTagsTagValueIamPolicy(t *testing.T) {
{
Config: testAccTagsTagValueIamPolicy_emptyBinding(context),
},
{
Config: testAccTagsTagValueIamPolicy_withCondition(context),
},
},
})
}
Expand All @@ -935,6 +1025,33 @@ resource "google_tags_tag_value_iam_member" "foo" {
`, context)
}

func testAccTagsTagValueIamMember_withCondition(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_tags_tag_key" "key" {
parent = "organizations/%{org_id}"
short_name = "%{key_short_name}"
description = "For %{key_short_name} resources."
}

resource "google_tags_tag_value" "value" {
parent = google_tags_tag_key.key.id
short_name = "%{value_short_name}"
description = "For %{value_short_name} resources."
}

resource "google_tags_tag_value_iam_member" "foo" {
tag_value = google_tags_tag_value.value.name
role = "%{role}"
member = "user:admin@hashicorptest.com"
condition {
description = "Allow tagUser grant."
expression = "api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([\"roles/resourcemanager.tagUser\"])"
title = "only_taguser_delegation"
}
}
`, context)
}

func testAccTagsTagValueIamPolicy_basicGenerated(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_tags_tag_key" "key" {
Expand Down Expand Up @@ -963,6 +1080,39 @@ resource "google_tags_tag_value_iam_policy" "foo" {
`, context)
}

func testAccTagsTagValueIamPolicy_withCondition(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_tags_tag_key" "key" {
parent = "organizations/%{org_id}"
short_name = "%{key_short_name}"
description = "For %{key_short_name} resources."
}

resource "google_tags_tag_value" "value" {
parent = google_tags_tag_key.key.id
short_name = "%{value_short_name}"
description = "For %{value_short_name} resources."
}

data "google_iam_policy" "foo" {
binding {
role = "%{role}"
members = ["user:admin@hashicorptest.com"]
condition {
description = "Allow tagUser grant."
expression = "api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([\"roles/resourcemanager.tagUser\"])"
title = "only_taguser_delegation"
}
}
}

resource "google_tags_tag_value_iam_policy" "foo" {
tag_value = google_tags_tag_value.value.name
policy_data = data.google_iam_policy.foo.policy_data
}
`, context)
}

func testAccTagsTagValueIamPolicy_emptyBinding(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_tags_tag_key" "key" {
Expand Down Expand Up @@ -1009,6 +1159,33 @@ resource "google_tags_tag_value_iam_binding" "foo" {
`, context)
}

func testAccTagsTagValueIamBinding_withCondition(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_tags_tag_key" "key" {
parent = "organizations/%{org_id}"
short_name = "%{key_short_name}"
description = "For %{key_short_name} resources."
}

resource "google_tags_tag_value" "value" {
parent = google_tags_tag_key.key.id
short_name = "%{value_short_name}"
description = "For %{value_short_name} resources."
}

resource "google_tags_tag_value_iam_binding" "foo" {
tag_value = google_tags_tag_value.value.name
role = "%{role}"
members = ["user:admin@hashicorptest.com"]
condition {
description = "Allow tagUser grant."
expression = "api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([\"roles/resourcemanager.tagUser\"])"
title = "only_taguser_delegation"
}
}
`, context)
}

func testAccTagsTagValueIamBinding_updateGenerated(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_tags_tag_key" "key" {
Expand Down
Loading