google_project_iam_member is not compatible with calling the module more than once with the same Service Account

[philipwigg]

TL;DR

The modules uses the google_project_iam_member resource. If we use the module to create multiple topics (call the module more than once), but then remove one of them, the actual IAM binding is removed in Google Cloud but it's still required for the remaining topics.

Expected behavior

If I call the module more than once, to create multiple topics, and I remove one of them, then I expect that the google_project_iam_member binding remains in place as it's still required for the remaining topics.

Observed behavior

If I call the module more than once, to create multiple topics, but then remove only one of them, the actual project IAM bindings are removed from Google Cloud despite being required for the remaining topics to work. If I run Terraform again, it puts them back (multiple times in the state file, but only once in GCP).

I can't see how to get around this with the module as it's designed unless these bindings can be put a resource level?

Terraform Configuration

Not required

Terraform Version

terraform version
Terraform v1.5.7
on darwin_arm64
+ provider registry.terraform.io/cyrilgdn/postgresql v1.22.0
+ provider registry.terraform.io/hashicorp/google v6.15.0
+ provider registry.terraform.io/hashicorp/google-beta v6.15.0
+ provider registry.terraform.io/hashicorp/null v3.2.3
+ provider registry.terraform.io/hashicorp/random v3.6.3

Your version of Terraform is out of date! The latest version
is 1.10.4. You can update by downloading from https://www.terraform.io/downloads.html

Additional information

No response

[stevenaldinger]

relevant PR: #226