Adding in DeleteBeforeReplace: True to IAM types

[rshade]

This added in DeleteBeforeReplace for google_project_iam_policy, google_project_iam_member

[github-actions]

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.

Maintainer note: consult the runbook for dealing with any breaking changes.

[VenelinMartinov]

Thanks for opening this. I am fairly certain that IAM Member resources do not work without DeleteBeforeReplace - all the upstream schema fields are ForceNew and the replacements works as described in #2463 (comment), which causes a silent deletion of the resource.

It'd be nice if we added a test for these resources but it might be non-trivial given that it involves permissions.

I am wondering if we can solve this more widely for GCP - there are a fair number of Iam_policy and iam_member resources and I suspect all of them work this way. Perhaps something to consider as a follow up - we could add a test which provisions each of these resources and verifies that a replacement ends with a resource still existing.

[rshade]

@VenelinMartinov I like it, we could use the gcloud technique you showed me last week to do a get and see if they still exist. Since I am new to the ForceNew concept, is this a place where DBR is almost always needed, and if so should we run a comparison of resources with DBR vs ForceNew, and make a diff list to patch?

[VenelinMartinov]

A property with ForceNew: true in the TF schema means that any change to that property triggers a replacement of the resource.

Generally resources do not require DeleteBeforeReplace if they have an "identity" in the cloud itself (think compute instance, storage bucket etc.)

Unfortunately, a number of resources do not have their own "identity" in the cloud. These tend to be resources representing a link between two other resources. We call these "structural" resources, there is a big and old issue about supporting these better: pulumi/pulumi#918

In this case, IAM Member is a structural resource, and that manifests in issues like #2463

Structural resources do need DeleteBeforeReplace. Unfortunately, there is no programmatic way to find which these resources are. For GCP specifically, I believe a lot of the IAM-related resources are "structural" since they tend to link a user with permissions/groups etc.

[pulumi-bot]

This PR has been shipped in release v8.10.0.