Terraform配置GCP：无法为群组添加Owner角色，仅能添加Member

我尝试通过以下Terraform代码创建一个用于组织内用户白名单的群组：

resource "google_cloud_identity_group" "all-org-users-to-whitelist" {
  display_name         = "all-org-users-to-whitelist"
  description          = "A group that onboards a user on the organization, and enables org level policies such as IP restriction of connection to the console."
  initial_group_config = "WITH_INITIAL_OWNER"
  group_key {
    id = "all-org-users-to-whitelist@domain.fr"
  }
  parent = "customers/${data.google_organization.org.directory_customer_id}"
  labels = {
    "cloudidentity.googleapis.com/groups.discussion_forum" = "" # 文档要求必填
  }
}

resource "google_cloud_identity_group_membership" "all-org-users" {
  group    = google_cloud_identity_group.all-org-users-to-whitelist.id
  for_each = {
    for user in var.all_org_users :
    user.email_id => user.role
  }

  preferred_member_key {
    id = each.key
  }
  roles {
    name = each.value
  }
}

变量输入示例：

all_org_users = [
  {
    role     = "MEMBER"
    email_id = "user1@domain.fr"
  },
  {
    role     = "MEMBER"
    email_id = "user2@domain.fr"
  },
]

以上配置可以正常将用户添加为群组的MEMBER，但当尝试添加OWNER角色的用户时：

{
    role     = "OWNER"
    email_id = "user3@domain.fr"
  },

出现如下错误：

│ Error: Error creating GroupMembership: googleapi: Error 400: MEMBER role must be specified
│ Details:
│ [
│   {
│     "@type": "type.googleapis.com/google.rpc.BadRequest",
│     "fieldViolations": [
│       {
│         "description": "MEMBER role must be specified",
│         "field": "resource.roles"
│       }
│     ]
│   }
│ ]
│
│   with google_cloud_identity_group_membership.all-org-users["user3@domain.fr"],
│   on groups_x_users.tf line 15, in resource "google_cloud_identity_group_membership" "all-org-users":
│   15: resource "google_cloud_identity_group_membership" "all-org-users" {
│

我用超级用户账号在控制台可以完成该操作，请问遗漏了什么配置？

这是因为Google Cloud Identity的群组权限模型要求：OWNER角色不能单独授予，必须同时包含MEMBER角色。控制台操作时会自动为OWNER角色的用户附加MEMBER权限，但Terraform不会自动处理这个逻辑，需要显式配置。

修改google_cloud_identity_group_membership资源的roles部分，当用户角色是OWNER时，同时声明MEMBER和OWNER两个角色：

resource "google_cloud_identity_group_membership" "all-org-users" {
  group    = google_cloud_identity_group.all-org-users-to-whitelist.id
  for_each = {
    for user in var.all_org_users :
    user.email_id => user.role
  }

  preferred_member_key {
    id = each.key
  }

  # 为所有用户添加MEMBER角色
  roles {
    name = "MEMBER"
  }

  # 如果用户角色是OWNER，额外添加OWNER角色
  dynamic "roles" {
    for_each = each.value == "OWNER" ? [true] : []
    content {
      name = "OWNER"
    }
  }
}

这样配置后，当用户角色为OWNER时，会同时拥有MEMBER和OWNER权限，符合Cloud Identity的要求，就能成功创建成员关系了。

内容的提问来源于stack exchange，提问作者Imad