IAM interface refactor (#1595)

* IAM modules refactor proposal

* policy

* subheading

* Update 20230816-iam-refactor.md

* log Julio's +1

* data-catalog-policy-tag

* dataproc

* dataproc

* folder

* folder

* folder

* folder

* project

* better filtering in test examples

* project

* folder

* folder

* organization

* fix variable descriptions

* kms

* net-vpc

* dataplex-datascan

* modules/iam-service-account

* modules/source-repository/

* blueprints/cloud-operations/vm-migration/

* blueprints/third-party-solutions/wordpress

* dataplex-datascan

* blueprints/cloud-operations/workload-identity-federation

* blueprints/data-solutions/cloudsql-multiregion/

* blueprints/data-solutions/composer-2

* Update 20230816-iam-refactor.md

* Update 20230816-iam-refactor.md

* capture discussion in architectural doc

* update variable names and refactor proposal

* project

* blueprints first round

* folder

* organization

* data-catalog-policy-tag

* re-enable folder inventory

* project module style fix

* dataproc

* source-repository

* source-repository tests

* dataplex-datascan

* dataplex-datascan tests

* net-vpc

* net-vpc test examples

* iam-service-account

* iam-service-account test examples

* kms

* boilerplate

* tfdoc

* fix module tests

* more blueprint fixes

* fix typo in data blueprints

* incomplete refactor of data platform foundations

* tfdoc

* data platform foundation

* refactor data platform foundation iam locals

* remove redundant example test

* shielded folder fix

* fix typo

* project factory

* project factory outputs

* tfdoc

* test workflow: less verbose tests, fix tf version

* re-enable -vv, shorter traceback, fix action version

* ignore github extension warning, re-enable action version

* fast bootstrap IAM, untested

* bootstrap stage IAM fixes

* stage 0 tests

* fast stage 1

* tenant stage 1

* minor changes to fast stage 0 and 1

* fast security stage

* fast mt stage 0

* fast mt stage 0

* fast pf

modules/project/variables.tf

@@ -26,6 +26,13 @@ variable "billing_account" {
   default     = null
 }
 
+variable "compute_metadata" {
+  description = "Optional compute metadata key/values. Only usable if compute API has been enabled."
+  type        = map(string)
+  nullable    = false
+  default     = {}
+}
+
 variable "contacts" {
   description = "List of essential contacts for this resource. Must be in the form EMAIL -> [NOTIFICATION_TYPES]. Valid notification types are ALL, SUSPENSION, SECURITY, TECHNICAL, BILLING, LEGAL, PRODUCT_UPDATES."
   type        = map(list(string))
@@ -44,6 +51,13 @@ variable "default_service_account" {
   description = "Project default service account setting: can be one of `delete`, `deprivilege`, `disable`, or `keep`."
   default     = "keep"
   type        = string
+  validation {
+    condition = (
+      var.default_service_account == null ||
+      contains(["delete", "deprivilege", "disable", "keep"], var.default_service_account)
+    )
+    error_message = "Only `delete`, `deprivilege`, `disable`, or `keep` are supported."
+  }
 }
 
 variable "descriptive_name" {
@@ -60,27 +74,28 @@ variable "group_iam" {
 }
 
 variable "iam" {
-  description = "IAM bindings in {ROLE => [MEMBERS]} format."
+  description = "Authoritative IAM bindings in {ROLE => [MEMBERS]} format."
   type        = map(list(string))
   default     = {}
   nullable    = false
 }
 
-variable "iam_additive" {
-  description = "IAM additive bindings in {ROLE => [MEMBERS]} format."
-  type        = map(list(string))
-  default     = {}
-  nullable    = false
+variable "iam_bindings" {
+  description = "Authoritative IAM bindings in {ROLE => {members = [], condition = {}}}."
+  type = map(object({
+    members = list(string)
+    condition = optional(object({
+      expression  = string
+      title       = string
+      description = optional(string)
+    }))
+  }))
+  nullable = false
+  default  = {}
 }
 
-variable "iam_additive_members" {
-  description = "IAM additive bindings in {MEMBERS => [ROLE]} format. This might break if members are dynamic values."
-  type        = map(list(string))
-  default     = {}
-}
-
-variable "iam_members" {
-  description = "Individual additive IAM bindings, use this when iam_additive does not work due to dynamic resources. Keys are arbitrary and only used for the internal loop."
+variable "iam_bindings_additive" {
+  description = "Individual additive IAM bindings. Keys are arbitrary."
   type = map(object({
     member = string
     role   = string
@@ -94,12 +109,6 @@ variable "iam_members" {
   default  = {}
 }
 
-variable "iam_policy" {
-  description = "IAM authoritative policy in {ROLE => [MEMBERS]} format. Roles and members not explicitly listed will be cleared, use with extreme caution."
-  type        = map(list(string))
-  default     = null
-}
-
 variable "labels" {
   description = "Resource labels."
   type        = map(string)
@@ -110,7 +119,7 @@ variable "labels" {
 variable "lien_reason" {
   description = "If non-empty, creates a project lien with this description."
   type        = string
-  default     = ""
+  default     = null
 }
 
 variable "logging_data_access" {
@@ -211,27 +220,6 @@ variable "org_policies_data_path" {
   default     = null
 }
 
-variable "oslogin" {
-  description = "Enable OS Login."
-  type        = bool
-  default     = false
-}
-
-variable "oslogin_admins" {
-  description = "List of IAM-style identities that will be granted roles necessary for OS Login administrators."
-  type        = list(string)
-  default     = []
-  nullable    = false
-
-}
-
-variable "oslogin_users" {
-  description = "List of IAM-style identities that will be granted roles necessary for OS Login users."
-  type        = list(string)
-  default     = []
-  nullable    = false
-}
-
 variable "parent" {
   description = "Parent folder or organization in 'folders/folder_id' or 'organizations/org_id' format."
   type        = string