Terraform - GCP - 导入项目 IAM 成员

Question

我使用此代码来设置项目对服务帐户的权限：

resource "google_project_iam_member" "name_of_sa_project_prod" {
    for_each = toset([
        "roles/bigquery.dataOwner",
        "roles/bigquery.jobUser"
    ])
    role = each.key
    project = google_project.test_prod.project_id
    member = "serviceAccount:${google_service_account.sa_account.email}"
}

但是由于我更换了笔记本电脑，我需要在运行之前将所有状态导入回来

terraform apply

。我尝试过以下方法：

terraform import module.module_name.google_project_iam_member.name_bigquery_dev.owner["user:name@project_name.iam.gserviceaccount.comr"] "project_name roles/owner user:[email protected]"

但我收到以下错误：

Index brackets must contain either a literal number or a literal string.

This character is not used within the language.

我也尝试过这个：

terraform import module.module_name.google_project_iam_member.name_bigquery_dev["roles/bigquery.dataOwner"] "project_name roles/owner user:sa_name@project_name.iam.gserviceaccount.com"

但是这个给了我以下错误：

│ Index brackets must contain either a literal number or a literal string.

文档只给出了这个例子：

terraform import google_project_iam_binding.default "{{project_id}} roles/viewer"

但我不确定如何在我的“for_each”情况下应用它？

Answer 1

在 shell 中执行

import

命令时，必须将完整的资源命名空间转换为文字字符串，以便 shell 正确解释它：

terraform import 'module.module_name.google_project_iam_member.name_bigquery_dev["roles/bigquery.dataOwner"]' "project_name roles/owner user:sa_name@project_name.iam.gserviceaccount.com"