CLOUD_IAM_GROUP mysql_grant not working #254
Description
Steps I want:
- Create read_only role with SELECT, SHOW VIEW permission
- Create CLOUD_IAM_GROUP from email. read_only_users@domain.com
- GRANT read_only role to the group created above.
The problem happens on step 3, cloudsql automatically grants cloudiamgroup to any role created with type CLOUD_IAM_GROUP
but terraform gives this error when just adding a new role.
Error: user/role mysql.UserOrRole{Name:"read_only_users", Host:"domain.com"} already has grant &{[cloudiamgroup] false {read_only_users domain.com} NONE} -
Seems like for accounts that are cloud_iam_groups, it should ignore the cloudiamgroup grant, as it is something that it is managed by google and therefore we cant revoke / grant and should not be a grant managed by terraform.
GRANT USAGE is also automatically added to these users.
This is the desired sql to be executed
CREATE ROLE IF NOT EXISTS read_only;
GRANT SELECT, SHOW VIEW ON *.* TO read_only;
GRANT read_only TO 'read_only_users'@'domain.com';
terraform script
resource "google_sql_user" "iam_groups" {
depends_on = [ module.mysql ]
for_each = toset(["read_only_users@domain.com"])
name = each.value
type = "CLOUD_IAM_GROUP"
project = local.effective_project
instance = module.mysql.primary_name
}
# Create the Role
resource "mysql_role" "read_only_role" {
depends_on = [ module.mysql ]
name = "read_only"
}
# Grant Permissions to the Role
resource "mysql_grant" "read_only_role_grant" {
depends_on = [ mysql_role.read_only_role ]
role = mysql_role.read_only_role.name
privileges = ["SELECT", "SHOW VIEW"]
database = "*"
table = "*"
}
# Grant role to IAM AUTH read only users
resource "mysql_grant" "iam_user_role_grants" {
depends_on = [ google_sql_user.iam_groups, mysql_grant.read_only_role_grant ]
for_each = google_sql_user.iam_groups
user = split("@", each.key)[0]
host = split("@", each.key)[1]
roles = [mysql_role.read_only_role.name]
}