IAM interface refactor (#1595)

* IAM modules refactor proposal

* policy

* subheading

* Update 20230816-iam-refactor.md

* log Julio's +1

* data-catalog-policy-tag

* dataproc

* dataproc

* folder

* folder

* folder

* folder

* project

* better filtering in test examples

* project

* folder

* folder

* organization

* fix variable descriptions

* kms

* net-vpc

* dataplex-datascan

* modules/iam-service-account

* modules/source-repository/

* blueprints/cloud-operations/vm-migration/

* blueprints/third-party-solutions/wordpress

* dataplex-datascan

* blueprints/cloud-operations/workload-identity-federation

* blueprints/data-solutions/cloudsql-multiregion/

* blueprints/data-solutions/composer-2

* Update 20230816-iam-refactor.md

* Update 20230816-iam-refactor.md

* capture discussion in architectural doc

* update variable names and refactor proposal

* project

* blueprints first round

* folder

* organization

* data-catalog-policy-tag

* re-enable folder inventory

* project module style fix

* dataproc

* source-repository

* source-repository tests

* dataplex-datascan

* dataplex-datascan tests

* net-vpc

* net-vpc test examples

* iam-service-account

* iam-service-account test examples

* kms

* boilerplate

* tfdoc

* fix module tests

* more blueprint fixes

* fix typo in data blueprints

* incomplete refactor of data platform foundations

* tfdoc

* data platform foundation

* refactor data platform foundation iam locals

* remove redundant example test

* shielded folder fix

* fix typo

* project factory

* project factory outputs

* tfdoc

* test workflow: less verbose tests, fix tf version

* re-enable -vv, shorter traceback, fix action version

* ignore github extension warning, re-enable action version

* fast bootstrap IAM, untested

* bootstrap stage IAM fixes

* stage 0 tests

* fast stage 1

* tenant stage 1

* minor changes to fast stage 0 and 1

* fast security stage

* fast mt stage 0

* fast mt stage 0

* fast pf

modules/folder/iam.tf

@@ -23,16 +23,6 @@ locals {
       for k, v in var.group_iam : "group:${k}" if try(index(v, r), null) != null
     ]
   }
-  _iam_additive_pairs = flatten([
-    for role, members in var.iam_additive : [
-      for member in members : { role = role, member = member }
-    ]
-  ])
-  _iam_additive_member_pairs = flatten([
-    for member, roles in var.iam_additive_members : [
-      for role in roles : { role = role, member = member }
-    ]
-  ])
   iam = {
     for role in distinct(concat(keys(var.iam), keys(local._group_iam))) :
     role => concat(
@@ -40,10 +30,6 @@ locals {
       try(local._group_iam[role], [])
     )
   }
-  iam_additive = {
-    for pair in concat(local._iam_additive_pairs, local._iam_additive_member_pairs) :
-    "${pair.role}-${pair.member}" => pair
-  }
 }
 
 resource "google_folder_iam_binding" "authoritative" {
@@ -53,19 +39,23 @@ resource "google_folder_iam_binding" "authoritative" {
   members  = each.value
 }
 
-resource "google_folder_iam_member" "additive" {
-  for_each = (
-    length(var.iam_additive) + length(var.iam_additive_members) > 0
-    ? local.iam_additive
-    : {}
-  )
-  folder = local.folder.name
-  role   = each.value.role
-  member = each.value.member
+resource "google_folder_iam_binding" "bindings" {
+  for_each = var.iam_bindings
+  folder   = local.folder.name
+  role     = each.key
+  members  = each.value.members
+  dynamic "condition" {
+    for_each = each.value.condition == null ? [] : [""]
+    content {
+      expression  = each.value.condition.expression
+      title       = each.value.condition.title
+      description = each.value.condition.description
+    }
+  }
 }
 
-resource "google_folder_iam_member" "members" {
-  for_each = var.iam_members
+resource "google_folder_iam_member" "bindings" {
+  for_each = var.iam_bindings_additive
   folder   = local.folder.name
   role     = each.value.role
   member   = each.value.member
@@ -78,34 +68,3 @@ resource "google_folder_iam_member" "members" {
     }
   }
 }
-
-resource "google_folder_iam_policy" "authoritative" {
-  count       = var.iam_policy != null ? 1 : 0
-  folder      = local.folder.name
-  policy_data = data.google_iam_policy.authoritative.0.policy_data
-}
-
-data "google_iam_policy" "authoritative" {
-  count = var.iam_policy != null ? 1 : 0
-  dynamic "binding" {
-    for_each = try(var.iam_policy, {})
-    content {
-      role    = binding.key
-      members = binding.value
-    }
-  }
-  dynamic "audit_config" {
-    for_each = var.logging_data_access
-    content {
-      service = audit_config.key
-      dynamic "audit_log_configs" {
-        for_each = audit_config.value
-        iterator = config
-        content {
-          log_type         = config.key
-          exempted_members = config.value
-        }
-      }
-    }
-  }
-}