Fix org policy service to be enabled before organization policies applied (#3547)

* Fix org policy service to be enabled before organization policies applied

tests/fast/stages/s0_org_setup/hardened.yaml

@@ -2096,12 +2096,6 @@ values:
     project: ft0-prod-iac-core-0
     service: networksecurity.googleapis.com
     timeouts: null
-  module.factory.module.projects["iac-0"].google_project_service.project_services["orgpolicy.googleapis.com"]:
-    disable_dependent_services: false
-    disable_on_destroy: false
-    project: ft0-prod-iac-core-0
-    service: orgpolicy.googleapis.com
-    timeouts: null
   module.factory.module.projects["iac-0"].google_project_service.project_services["pubsub.googleapis.com"]:
     disable_dependent_services: false
     disable_on_destroy: false
@@ -2120,6 +2114,12 @@ values:
     project: ft0-prod-iac-core-0
     service: servicenetworking.googleapis.com
     timeouts: null
+  module.factory.module.projects["iac-0"].google_project_service.org_policy_service[0]:
+    disable_dependent_services: false
+    disable_on_destroy: false
+    project: ft0-prod-iac-core-0
+    service: orgpolicy.googleapis.com
+    timeouts: null
   module.factory.module.projects["iac-0"].google_project_service.project_services["serviceusage.googleapis.com"]:
     disable_dependent_services: false
     disable_on_destroy: false

tests/fast/stages/s0_org_setup/simple.yaml

@@ -1325,12 +1325,6 @@ values:
     project: ft0-prod-iac-core-0
     service: networksecurity.googleapis.com
     timeouts: null
-  module.factory.module.projects["iac-0"].google_project_service.project_services["orgpolicy.googleapis.com"]:
-    disable_dependent_services: false
-    disable_on_destroy: false
-    project: ft0-prod-iac-core-0
-    service: orgpolicy.googleapis.com
-    timeouts: null
   module.factory.module.projects["iac-0"].google_project_service.project_services["pubsub.googleapis.com"]:
     disable_dependent_services: false
     disable_on_destroy: false
@@ -1343,6 +1337,12 @@ values:
     project: ft0-prod-iac-core-0
     service: servicenetworking.googleapis.com
     timeouts: null
+  module.factory.module.projects["iac-0"].google_project_service.org_policy_service[0]:
+    disable_dependent_services: false
+    disable_on_destroy: false
+    project: ft0-prod-iac-core-0
+    service: orgpolicy.googleapis.com
+    timeouts: null
   module.factory.module.projects["iac-0"].google_project_service.project_services["serviceusage.googleapis.com"]:
     disable_dependent_services: false
     disable_on_destroy: false

tests/modules/organization/test_plan_org_policies_modules.py

@@ -39,6 +39,9 @@ def test_policy_implementation():
       '-  parent = "projects/${local.project.project_id}"\n',
       '+  name   = "${local.folder_id}/policies/${each.value}"\n',
       '+  parent = local.folder_id\n',
+      '@@ -196,2 +195,0 @@\n',
+      '-\n',
+      '-  depends_on = [google_project_service.org_policy_service]\n',
   ]
 
   diff2 = difflib.unified_diff(lines['folder'], lines['organization'], 'folder',