如何通过Terraform创建允许外部成员的Google Cloud Identity群组

我用以下Terraform代码创建Google Cloud Identity群组：

resource "google_cloud_identity_group" "team" {
  provider = google.cloud-identity

  display_name         = "team-example"
  parent               = "customers/xyz"
  description          = "Team Description"
  initial_group_config = "EMPTY"

  group_key {
    id = "team-example@example.com"
  }

  labels = {
    "cloudidentity.googleapis.com/groups.discussion_forum" = ""
  }
}

尝试添加外部组织成员时，遇到错误：

Error creating GroupMembership: googleapi: Error 400: Error(4023): Cannot create membership in group 'groups/xyz' for member 'person@otherdomain.com' because the group does not allow members outside the organization

我在Terraform官方文档中没找到对应的配置项，目前临时解决方法是：

• 创建群组
• 登录admin.google.com
• 手动开启允许外部成员加入的配置

解决方案：通过Terraform自动配置外部成员权限 #

google_cloud_identity_group资源本身不包含允许外部成员的配置项，需要结合google_admin_directory_group资源来更新群组的目录设置，实现自动化配置：

# 创建Cloud Identity群组
resource "google_cloud_identity_group" "team" {
  provider = google.cloud-identity

  display_name         = "team-example"
  parent               = "customers/xyz"
  description          = "Team Description"
  initial_group_config = "EMPTY"

  group_key {
    id = "team-example@example.com"
  }

  labels = {
    "cloudidentity.googleapis.com/groups.discussion_forum" = ""
  }
}

# 配置群组允许外部成员加入
resource "google_admin_directory_group" "team_external_access" {
  provider = google.admin

  email = google_cloud_identity_group.team.group_key[0].id
  allow_external_members = true
}

注意事项 #

• 需在Terraform配置中启用google.admin provider，确保服务账号拥有Admin SDK的群组编辑权限
• 该配置仅适用于标记为discussion_forum类型的群组（即代码中设置的labels字段）

内容的提问来源于stack exchange，提问作者Filipe Andujar