IssueTracker

Problem you have encountered:

Type gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding doesn't support conditions in bindings, which is a feature lack.

iam-test.yaml

imports:
- path: iam-test.jinja
resources:
- name: iam
  type: iam-test.jinja

iam-test.jinja

resources:

- type: gcp-types/iam-v1:projects.serviceAccounts
  name: my-gsa
  properties:
    accountId: my-gsa
    displayName: my-gsa
  accessControl:
    gcpIamPolicy:
      bindings:
      - role: roles/iam.workloadIdentityUser
        members:
        - "serviceAccount:{{ env["project"] }}.svc.id.goog[my-namespace/my-ksa]"

- name: my-gsa-binding
  type: gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding
  properties:
    resource: {{ env["project"] }}
    member: "serviceAccount:my-gsa@my-project.iam.gserviceaccount.com"
    role: roles/storage.objectViewer
    condition:
      expression: resource.name == "projects/_/buckets/my_unique_app_bucket"
      title: access to my_unique_app_bucket
  metadata:
      dependsOn:
      - my-gsa

What you expected to happen: Condition gets applied as it is with gcloud.

Steps to reproduce: Apply DM template and configuration.

$ gcloud deployment-manager deployments create iam-test --config=iam-test.yaml --verbosity=debug
...
Waiting for create [operation-1614873050523-5bcb7ee88a629-332ec2d7-979d1ee6]...failed.
DEBUG: (gcloud.deployment-manager.deployments.create) Error in Operation [operation-1614873050523-5bcb7ee88a629-332ec2d7-979d1ee6]: errors:
- code: RESOURCE_ERROR
  location: /deployments/iam-test/resources/my-gsa-binding
  message: '{"ResourceType":"gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding","ResourceErrorCode":"400","ResourceErrorMessage":{"code":400,"message":"Invalid
    JSON payload received. Unknown name \"condition\": Cannot find field.","status":"INVALID_ARGUMENT","details":[{"@type":"type.googleapis.com/google.rpc.BadRequest","fieldViolations":[{"description":"Invalid
    JSON payload received. Unknown name \"condition\": Cannot find field."}]}],"statusMessage":"Bad
    Request","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects/my-project:setIamPolicy","httpMethod":"POST"}}'
Traceback (most recent call last):
  File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/googlecloudsdk/calliope/cli.py", line 982, in Execute
    resources = calliope_command.Run(cli=self, args=args)
  File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/googlecloudsdk/calliope/backend.py", line 809, in Run
    resources = command_instance.Run(args)
  File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/surface/deployment_manager/deployments/create.py", line 213, in Run
    response = self._HandleOperationError(error,
  File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/surface/deployment_manager/deployments/create.py", line 252, in _HandleOperationError
    raise error
  File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/surface/deployment_manager/deployments/create.py", line 201, in Run
    operation = dm_write.WaitForOperation(
  File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/googlecloudsdk/command_lib/deployment_manager/dm_write.py", line 126, in WaitForOperation
    raise exceptions.OperationError(
googlecloudsdk.api_lib.deployment_manager.exceptions.OperationError: Error in Operation [operation-1614873050523-5bcb7ee88a629-332ec2d7-979d1ee6]: errors:
- code: RESOURCE_ERROR
  location: /deployments/iam-test/resources/my-gsa-binding
  message: '{"ResourceType":"gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding","ResourceErrorCode":"400","ResourceErrorMessage":{"code":400,"message":"Invalid
    JSON payload received. Unknown name \"condition\": Cannot find field.","status":"INVALID_ARGUMENT","details":[{"@type":"type.googleapis.com/google.rpc.BadRequest","fieldViolations":[{"description":"Invalid
    JSON payload received. Unknown name \"condition\": Cannot find field."}]}],"statusMessage":"Bad
    Request","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects/my-project:setIamPolicy","httpMethod":"POST"}}'

ERROR: (gcloud.deployment-manager.deployments.create) Error in Operation [operation-1614873050523-5bcb7ee88a629-332ec2d7-979d1ee6]: errors:
- code: RESOURCE_ERROR
  location: /deployments/iam-test/resources/my-gsa-binding
  message: '{"ResourceType":"gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding","ResourceErrorCode":"400","ResourceErrorMessage":{"code":400,"message":"Invalid
    JSON payload received. Unknown name \"condition\": Cannot find field.","status":"INVALID_ARGUMENT","details":[{"@type":"type.googleapis.com/google.rpc.BadRequest","fieldViolations":[{"description":"Invalid
    JSON payload received. Unknown name \"condition\": Cannot find field."}]}],"statusMessage":"Bad
    Request","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects/my-project:setIamPolicy","httpMethod":"POST"}}'

Other information (workarounds you have tried, documentation consulted, etc): Setting the condition via UI COnsole or issuing the gcloud command works:

gcloud projects add-iam-policy-binding my-project --member='serviceAccount:my-gsa@my-project.iam.gserviceaccount.com' --role='roles/storage.objectViewer' --condition='title=bucket access,description=my-gsa restricted access,expression=resource.name.startsWith("projects/_/buckets/my_unique_app_bucket")'

But this breaks the ability to manage the infrastructure solely by DM in IaC manner.

Additionally, there is no adequate documentation for the cloudresourcemanager-v1:virtual.projects.iamMemberBinding gcp-type except a single resource snippet