How can I safely migrate from google_project_iam_policy resources to google_project_iam_member?

user_2163565 0
Viewed 559

I have a TF project which currently uses a single google_project_iam_policy resource, and would like to transition to using google_project_iam_member.

The documentation warns:

google_project_iam_policy cannot be used in conjunction with google_project_iam_binding and google_project_iam_member or they will fight over what your policy should be.

Is there a safe path to migrate from one style to the other?

terraform-provider-gcp
1 Answers

google_project_iam_policy might fight with google_project_iam_binding and google_project_iam_member, but it should be possible to use them concurrently for a brief period (provided they contain the same values).

I haven't tested this, but I think it should be possible to do something like:

  1. Mirror the current google_project_iam_policy permissions into a new set of google_project_iam_binding or google_project_iam_member resources
  2. Run terraform apply to add the new resources to your terraform state file
  3. Remove the old google_project_iam_policy resources from your terraform config, but don't run terraform apply
  4. Run terraform state rm <resource-name> for each of the old google_project_iam_policy resources
  5. Run terraform plan and confirm no changes are planned
user_1272550
Related