fix(iam-admin): remove redundant IAM project service to prevent state conflict (#13016)

blakeli0 · web-flow · commit 95cfd5e0327d · 2026-05-06T14:06:00.000-04:00
### Summary
This PR addresses a Terraform state conflict in the `java-iam-admin`
module's integration setup.

Previously, both the root `.cloud` module and the `java-iam-admin`
submodule were managing the `iam.googleapis.com` service activation on
the same project. In Terraform, managing the exact same physical cloud
resource in multiple places within the state tree causes resource
conflicts/fighting. This conflict was the root cause of the transient
`"Provider produced inconsistent result after apply"` failures during
`terraform apply`.

Since the root `.cloud` module already manages `iam.googleapis.com` and
introduces a 1-minute warmup sleep before applying any submodules,
`java-iam-admin` does **not** need to manage this API.

This fix removes the redundant `google_project_service.iam` activation
and its associated sleeps from the submodule, simplifying it to the
minimum required resources to successfully and stably create the service
account.

### Verification
- Bypasses the state conflict entirely, resolving the integration test
flakiness.
- Removes the submodule delay entirely, making the `java-iam-admin`
integration setup faster.
diff --git a/java-iam-admin/.cloud/main.tf b/java-iam-admin/.cloud/main.tf
@@ -5,12 +5,6 @@ terraform {
     }
   }
 }
-resource "google_project_service" "iam" {
-  service            = "iam.googleapis.com"
-  project            = var.inputs.project_id
-  count              = var.inputs.should_enable_apis_on_apply ? 1 : 0
-  disable_on_destroy = var.inputs.should_disable_apis_on_destroy
-}
 resource "random_id" "id" {
   byte_length = 3
 }
@@ -20,5 +14,4 @@ locals {
 resource "google_service_account" "service_account" {
   account_id   = local.service_account_id
   display_name = "Service Account"
-  depends_on   = [google_project_service.iam]
 }

Original file line number	Diff line number	Diff line change
`@@ -5,12 +5,6 @@ terraform {`
`5`	`5`	`}`
`6`	`6`	`}`
`7`	`7`	`}`
`8`		`-resource "google_project_service" "iam" {`
`9`		`- service = "iam.googleapis.com"`
`10`		`- project = var.inputs.project_id`
`11`		`- count = var.inputs.should_enable_apis_on_apply ? 1 : 0`
`12`		`- disable_on_destroy = var.inputs.should_disable_apis_on_destroy`
`13`		`-}`
`14`	`8`	`resource "random_id" "id" {`
`15`	`9`	`byte_length = 3`
`16`	`10`	`}`
`@@ -20,5 +14,4 @@ locals {`
`20`	`14`	`resource "google_service_account" "service_account" {`
`21`	`15`	`account_id = local.service_account_id`
`22`	`16`	`display_name = "Service Account"`
`23`		`- depends_on = [google_project_service.iam]`
`24`	`17`	`}`