How can I safely migrate from google_project_iam_policy resources to google_project_iam_member?
I have a TF project which currently uses a single google_project_iam_policy resource, and would like to transition to using
google_project_iam_member.
The documentation warns:
google_project_iam_policy cannot be used in conjunction with google_project_iam_binding and google_project_iam_member or they will fight over what your policy should be.
Is there a safe path to migrate from one style to the other?
terraform-provider-gcp
asked Nov 14 '18 at 0:51
Mike WilliamsMike Williams
984
add a comment |
I have a TF project which currently uses a single google_project_iam_policy resource, and would like to transition to using
google_project_iam_member.
The documentation warns:
google_project_iam_policy cannot be used in conjunction with google_project_iam_binding and google_project_iam_member or they will fight over what your policy should be.
Is there a safe path to migrate from one style to the other?
terraform-provider-gcp
asked Nov 14 '18 at 0:51
Mike WilliamsMike Williams
984
add a comment |
I have a TF project which currently uses a single google_project_iam_policy resource, and would like to transition to using
google_project_iam_member.
The documentation warns:
google_project_iam_policy cannot be used in conjunction with google_project_iam_binding and google_project_iam_member or they will fight over what your policy should be.
Is there a safe path to migrate from one style to the other?
terraform-provider-gcp
asked Nov 14 '18 at 0:51
Mike WilliamsMike Williams
984
I have a TF project which currently uses a single google_project_iam_policy resource, and would like to transition to using
google_project_iam_member.
The documentation warns:
google_project_iam_policy cannot be used in conjunction with google_project_iam_binding and google_project_iam_member or they will fight over what your policy should be.
Is there a safe path to migrate from one style to the other?
terraform-provider-gcp
terraform-provider-gcp
asked Nov 14 '18 at 0:51
Mike WilliamsMike Williams
984
asked Nov 14 '18 at 0:51
Mike WilliamsMike Williams
984
asked Nov 14 '18 at 0:51
Mike WilliamsMike Williams
984
asked Nov 14 '18 at 0:51
Mike WilliamsMike Williams
984
asked Nov 14 '18 at 0:51
Mike WilliamsMike Williams
984
984
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
google_project_iam_policy might fight with google_project_iam_binding and google_project_iam_member, but it should be possible to use them concurrently for a brief period (provided they contain the same values).
I haven't tested this, but I think it should be possible to do something like:
- Mirror the current
google_project_iam_policypermissions into a new set ofgoogle_project_iam_bindingorgoogle_project_iam_memberresources - Run
terraform applyto add the new resources to your terraform state file - Remove the old
google_project_iam_policyresources from your terraform config, but don't runterraform apply - Run
terraform state rm <resource-name>for each of the oldgoogle_project_iam_policyresources - Run
terraform planand confirm no changes are planned
answered Nov 15 '18 at 23:08
James HealyJames Healy
9,48122130
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53291631%2fhow-can-i-safely-migrate-from-google-project-iam-policy-resources-to-google-proj%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
google_project_iam_policy might fight with google_project_iam_binding and google_project_iam_member, but it should be possible to use them concurrently for a brief period (provided they contain the same values).
I haven't tested this, but I think it should be possible to do something like:
- Mirror the current
google_project_iam_policypermissions into a new set ofgoogle_project_iam_bindingorgoogle_project_iam_memberresources - Run
terraform applyto add the new resources to your terraform state file - Remove the old
google_project_iam_policyresources from your terraform config, but don't runterraform apply - Run
terraform state rm <resource-name>for each of the oldgoogle_project_iam_policyresources - Run
terraform planand confirm no changes are planned
answered Nov 15 '18 at 23:08
James HealyJames Healy
9,48122130
add a comment |
google_project_iam_policy might fight with google_project_iam_binding and google_project_iam_member, but it should be possible to use them concurrently for a brief period (provided they contain the same values).
I haven't tested this, but I think it should be possible to do something like:
- Mirror the current
google_project_iam_policypermissions into a new set ofgoogle_project_iam_bindingorgoogle_project_iam_memberresources - Run
terraform applyto add the new resources to your terraform state file - Remove the old
google_project_iam_policyresources from your terraform config, but don't runterraform apply - Run
terraform state rm <resource-name>for each of the oldgoogle_project_iam_policyresources - Run
terraform planand confirm no changes are planned
answered Nov 15 '18 at 23:08
James HealyJames Healy
9,48122130
add a comment |
google_project_iam_policy might fight with google_project_iam_binding and google_project_iam_member, but it should be possible to use them concurrently for a brief period (provided they contain the same values).
I haven't tested this, but I think it should be possible to do something like:
- Mirror the current
google_project_iam_policypermissions into a new set ofgoogle_project_iam_bindingorgoogle_project_iam_memberresources - Run
terraform applyto add the new resources to your terraform state file - Remove the old
google_project_iam_policyresources from your terraform config, but don't runterraform apply - Run
terraform state rm <resource-name>for each of the oldgoogle_project_iam_policyresources - Run
terraform planand confirm no changes are planned
answered Nov 15 '18 at 23:08
James HealyJames Healy
9,48122130
google_project_iam_policy might fight with google_project_iam_binding and google_project_iam_member, but it should be possible to use them concurrently for a brief period (provided they contain the same values).
I haven't tested this, but I think it should be possible to do something like:
- Mirror the current
google_project_iam_policypermissions into a new set ofgoogle_project_iam_bindingorgoogle_project_iam_memberresources - Run
terraform applyto add the new resources to your terraform state file - Remove the old
google_project_iam_policyresources from your terraform config, but don't runterraform apply - Run
terraform state rm <resource-name>for each of the oldgoogle_project_iam_policyresources - Run
terraform planand confirm no changes are planned
answered Nov 15 '18 at 23:08
James HealyJames Healy
9,48122130
answered Nov 15 '18 at 23:08
James HealyJames Healy
9,48122130
answered Nov 15 '18 at 23:08
James HealyJames Healy
9,48122130
answered Nov 15 '18 at 23:08
James HealyJames Healy
9,48122130
9,48122130
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53291631%2fhow-can-i-safely-migrate-from-google-project-iam-policy-resources-to-google-proj%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
