Not able to add attributes directly for network_subnet_users in project factory

[HarshalSanap007]

Hey @ludoo, Im trying to create with project factory in .yaml file we have one field called "network_users" but I wanted it add "network_subnet_users" to grant users access on specific subnets only.
As like network_users for which we are directly passing the value from .auto.tfvars.json similarly I tried replicating for "network_subnet_users" because I didn't want to pass users or service account explicitly in my .yaml file. but it threw error.

parent: team-a/dev
shared_vpc_service_config:
  host_project: dev-spoke-0
  network_users:
    - gcp-devops

but when I modified this to

shared_vpc_service_config:
  host_project: dev-spoke-0
  network_subnet_users:
    "australia-southeast1/subnet-name":
    - "group:[email protected]"
    "australia-southeast1/subnet-name":
    - "serviceAccount:service-account-email"
    

this works perfectly , it adds that user/service account to the subnet as network user.
but problem arises when , if I try to pass the same gcp-devops group or service account as a attribute from .tfvars.json to "network_subnet_user"

parent: team-a/dev
shared_vpc_service_config:
  host_project: dev-spoke-0
  network_subnet_users:
    "australia-southeast1/subnet-name":
    - gcp-devops // or service account attribute from .tfvars.auto.json

Its not accepting this and start throwing error as

Error: invalid value for member (IAM members must have one of the values outlined here: https://cloud.google.com/billing/docs/reference/rest/v1/Policy#Binding)
 with module.projects.module.projects["sample-app-01"].google_compute_subnetwork_iam_member.shared_vpc_host_subnets_iam["australia-southeast1:subnet-name:gcp-devops"],
│   on ../../../modules/project/shared-vpc.tf line 157, in resource "google_compute_subnetwork_iam_member" "shared_vpc_host_subnets_iam":
│  157:   member     = each.value.member

Could you please help me ?
thanks

[HarshalSanap007]

FYI , i havent changed any project.schema.json or .tf file in module and I've updated the .auto.tfvars.json to give service account name in the form of "serviceAccount:service-account-email" after looking at groups output as its writing the output as "group:group-email" for project-factory projects only , I can keep both the form like "my-sa:serviceAccount:sa-email" or "my-sa:sa-email" , whichever works.

[HarshalSanap007]

Hey @ALL , any help would help a lot

[HarshalSanap007]

Hey, @juliocc , I can't pass the full group name or full service account , I'm using the same code to deploy resources in 2 different orgs at a same time. so for both of them prefix are different , that's where the problem arising , if it was possible to use direct attribute name which we have passed with network_users , this would have been easier.
thanks

[HarshalSanap007]

You have to use the full group name. Try with "group:[email protected]"

I don't want to pass 2 service accounts to pass like the way you've suggested , I have one with test prefix and another one with prod prefix. as my subnets are same in both orgs as I'm justing promoting the code from test to prod , but test service accounts would also have access to the subnet in prod orgs, that's the problem

[HarshalSanap007]

Hey @juliocc , How we can proceed for this ?

[juliocc]

You can use context.iam_principals to map gcp-devops to whatever you want.

[HarshalSanap007]

Hey @juliocc , where to use context.iam_principals , could you please tell me exactly ? in project.yaml file ?

[juliocc]

I linked it in my previous response. It's a variable in the project factory stage. You can set it like any other terraform variable.

[HarshalSanap007]

Hey @juliocc , you mean

iam_principals    = optional(map(string), {})

as

iam_principals    = optional(map(string), {gcp-devops}). // ??

not able understand where to use so that it allows use of attributes , could please you tell where?

Thanks