Repository: GoogleCloudPlatform/terraform-validator
Pull request #459 (2022-01-07 18:58:55)

Modify iam resource template for terraform converter
<!-- Put a description of what this PR is for here, along with any references to issues that this resolves or contributes to -->
Modify iam template to adapt to multiple fields in asset name template. 
- Since most of the iam resource have no test cases, so only cloud run service is impacted
- For storage bucket, the url starts with b/{bucket}, hence disable the auto generation and use a handwritten one. The handwritten one is actually the same as the original auto generated file. 
- Other handwritten iam resource need similar change too, but will put into another PR. 


<!--
Replace each [ ] with [X] to check it. Switch to the preview view to make it easier to click on links.
These steps will speed up the review process, and we appreciate you spending time on them before sending
your code to be reviewed.
-->
If this PR is for Terraform, I acknowledge that I have:

- [X] Searched through the [issue tracker](https://github.com/hashicorp/terraform-provider-google/issues) for an open issue that this either resolves or contributes to, commented on it to claim it, and written "fixes {url}" or "part of {url}" in this PR description. If there were no relevant open issues, I opened one and commented that I would like to work on it (not necessary for very small changes).
- [ ] [Generated Terraform](https://github.com/GoogleCloudPlatform/magic-modules#generating-downstream-tools), and ran `make test` and `make lint` to ensure it passes unit and linter tests.
- [ ] Ensured that all new fields I added that can be set by a user appear in at least one [example](https://github.com/GoogleCloudPlatform/magic-modules/tree/master/templates/terraform/examples) (for generated resources) or [third_party test](https://github.com/GoogleCloudPlatform/magic-modules/tree/master/third_party/terraform/tests) (for handwritten resources or update tests).
- [ ] [Ran](https://github.com/hashicorp/terraform-provider-google/blob/master/.github/CONTRIBUTING.md#tests) relevant acceptance tests (If the acceptance tests do not yet pass or you are unable to run them, please let your reviewer know).
- [X] Read the [Release Notes Guide](https://github.com/GoogleCloudPlatform/magic-modules/blob/master/.ci/RELEASE_NOTES_GUIDE.md) before writing my release note below.

<!-- AUTOCHANGELOG for Downstream PRs.

Please select one of the following "release-note:" headings:
    - release-note:enhancement
    - release-note:bug
    - release-note:note
    - release-note:new-resource
    - release-note:new-datasource
    - release-note:deprecation
    - release-note:breaking-change
    - release-note:none
    
Unless you choose release-note:none, please add a release note.

See .ci/RELEASE_NOTES_GUIDE.md for writing good release notes.

You can add more release note blocks if you want more than one CHANGELOG
entry for this PR.
-->
**Release Note Template for Downstream PRs (will be copied)**

```release-note:none

```

Derived from https://github.com/GoogleCloudPlatform/magic-modules/pull/5594


Patch:
diff --git a/converters/google/resources/apigee_environment_iam.go b/converters/google/resources/apigee_environment_iam.go
index 3e4c128e..c145983b 100644
--- a/converters/google/resources/apigee_environment_iam.go
+++ b/converters/google/resources/apigee_environment_iam.go
@@ -90,7 +90,7 @@ func newApigeeEnvironmentIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//apigee.googleapis.com/{{environment}}")
+	name, err := assetName(d, config, "//apigee.googleapis.com/{{org_id}}/environments/{{env_id}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,7 +106,10 @@ func newApigeeEnvironmentIamAsset(
 
 func FetchApigeeEnvironmentIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{environment}}"); !ok {
+	if _, ok := d.GetOk("{{org_id}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
+	if _, ok := d.GetOk("{{env_id}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
@@ -114,7 +117,7 @@ func FetchApigeeEnvironmentIamPolicy(d TerraformResourceData, config *Config) (A
 		ApigeeEnvironmentIamUpdaterProducer,
 		d,
 		config,
-		"//apigee.googleapis.com/{{environment}}",
+		"//apigee.googleapis.com/{{org_id}}/environments/{{env_id}}",
 		ApigeeEnvironmentIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/big_query_table_iam.go b/converters/google/resources/big_query_table_iam.go
index 1c02f99a..b53d5215 100644
--- a/converters/google/resources/big_query_table_iam.go
+++ b/converters/google/resources/big_query_table_iam.go
@@ -90,7 +90,7 @@ func newBigQueryTableIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//bigquery.googleapis.com/{{table}}")
+	name, err := assetName(d, config, "//bigquery.googleapis.com/projects/{{project}}/datasets/{{dataset_id}}/tables/{{table_id}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,7 +106,10 @@ func newBigQueryTableIamAsset(
 
 func FetchBigQueryTableIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{table}}"); !ok {
+	if _, ok := d.GetOk("{{dataset_id}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
+	if _, ok := d.GetOk("{{table_id}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
@@ -114,7 +117,7 @@ func FetchBigQueryTableIamPolicy(d TerraformResourceData, config *Config) (Asset
 		BigQueryTableIamUpdaterProducer,
 		d,
 		config,
-		"//bigquery.googleapis.com/{{table}}",
+		"//bigquery.googleapis.com/projects/{{project}}/datasets/{{dataset_id}}/tables/{{table_id}}",
 		BigQueryTableIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/cloud_functions_cloud_function_iam.go b/converters/google/resources/cloud_functions_cloud_function_iam.go
index 015b1705..8ad73b22 100644
--- a/converters/google/resources/cloud_functions_cloud_function_iam.go
+++ b/converters/google/resources/cloud_functions_cloud_function_iam.go
@@ -90,7 +90,7 @@ func newCloudFunctionsCloudFunctionIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//cloudfunctions.googleapis.com/{{cloudfunction}}")
+	name, err := assetName(d, config, "//cloudfunctions.googleapis.com/projects/{{project}}/locations/{{region}}/functions/{{cloud_function}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,7 +106,10 @@ func newCloudFunctionsCloudFunctionIamAsset(
 
 func FetchCloudFunctionsCloudFunctionIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{cloudfunction}}"); !ok {
+	if _, ok := d.GetOk("{{region}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
+	if _, ok := d.GetOk("{{cloud_function}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
@@ -114,7 +117,7 @@ func FetchCloudFunctionsCloudFunctionIamPolicy(d TerraformResourceData, config *
 		CloudFunctionsCloudFunctionIamUpdaterProducer,
 		d,
 		config,
-		"//cloudfunctions.googleapis.com/{{cloudfunction}}",
+		"//cloudfunctions.googleapis.com/projects/{{project}}/locations/{{region}}/functions/{{cloud_function}}",
 		CloudFunctionsCloudFunctionIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/cloud_run_service_iam.go b/converters/google/resources/cloud_run_service_iam.go
index 3743c37f..4f6b3c4e 100644
--- a/converters/google/resources/cloud_run_service_iam.go
+++ b/converters/google/resources/cloud_run_service_iam.go
@@ -90,7 +90,7 @@ func newCloudRunServiceIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//run.googleapis.com/{{service}}")
+	name, err := assetName(d, config, "//run.googleapis.com/projects/{{project}}/locations/{{location}}/services/{{service}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,6 +106,9 @@ func newCloudRunServiceIamAsset(
 
 func FetchCloudRunServiceIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
+	if _, ok := d.GetOk("{{location}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
 	if _, ok := d.GetOk("{{service}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
@@ -114,7 +117,7 @@ func FetchCloudRunServiceIamPolicy(d TerraformResourceData, config *Config) (Ass
 		CloudRunServiceIamUpdaterProducer,
 		d,
 		config,
-		"//run.googleapis.com/{{service}}",
+		"//run.googleapis.com/projects/{{project}}/locations/{{location}}/services/{{service}}",
 		CloudRunServiceIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/compute_disk_iam.go b/converters/google/resources/compute_disk_iam.go
index 579d6ea7..606d778a 100644
--- a/converters/google/resources/compute_disk_iam.go
+++ b/converters/google/resources/compute_disk_iam.go
@@ -90,7 +90,7 @@ func newComputeDiskIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//compute.googleapis.com/{{disk}}")
+	name, err := assetName(d, config, "//compute.googleapis.com/projects/{{project}}/zones/{{zone}}/disks/{{name}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,7 +106,10 @@ func newComputeDiskIamAsset(
 
 func FetchComputeDiskIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{disk}}"); !ok {
+	if _, ok := d.GetOk("{{zone}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
+	if _, ok := d.GetOk("{{name}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
@@ -114,7 +117,7 @@ func FetchComputeDiskIamPolicy(d TerraformResourceData, config *Config) (Asset,
 		ComputeDiskIamUpdaterProducer,
 		d,
 		config,
-		"//compute.googleapis.com/{{disk}}",
+		"//compute.googleapis.com/projects/{{project}}/zones/{{zone}}/disks/{{name}}",
 		ComputeDiskIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/compute_image_iam.go b/converters/google/resources/compute_image_iam.go
index fed976f8..774238e8 100644
--- a/converters/google/resources/compute_image_iam.go
+++ b/converters/google/resources/compute_image_iam.go
@@ -90,7 +90,7 @@ func newComputeImageIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//compute.googleapis.com/{{image}}")
+	name, err := assetName(d, config, "//compute.googleapis.com/projects/{{project}}/global/images/{{image}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -114,7 +114,7 @@ func FetchComputeImageIamPolicy(d TerraformResourceData, config *Config) (Asset,
 		ComputeImageIamUpdaterProducer,
 		d,
 		config,
-		"//compute.googleapis.com/{{image}}",
+		"//compute.googleapis.com/projects/{{project}}/global/images/{{image}}",
 		ComputeImageIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/compute_instance_iam.go b/converters/google/resources/compute_instance_iam.go
index b5dc594f..ad5bcb9a 100644
--- a/converters/google/resources/compute_instance_iam.go
+++ b/converters/google/resources/compute_instance_iam.go
@@ -90,7 +90,7 @@ func newComputeInstanceIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//compute.googleapis.com/{{instance}}")
+	name, err := assetName(d, config, "//compute.googleapis.com/projects/{{project}}/zones/{{zone}}/instances/{{instance}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,7 +106,10 @@ func newComputeInstanceIamAsset(
 
 func FetchComputeInstanceIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{instance}}"); !ok {
+	if _, ok := d.GetOk("{{zone}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
+	if _, ok := d.GetOk("{{instance_name}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
@@ -114,7 +117,7 @@ func FetchComputeInstanceIamPolicy(d TerraformResourceData, config *Config) (Ass
 		ComputeInstanceIamUpdaterProducer,
 		d,
 		config,
-		"//compute.googleapis.com/{{instance}}",
+		"//compute.googleapis.com/projects/{{project}}/zones/{{zone}}/instances/{{instance}}",
 		ComputeInstanceIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/compute_region_disk_iam.go b/converters/google/resources/compute_region_disk_iam.go
index c28a1e91..7c22d444 100644
--- a/converters/google/resources/compute_region_disk_iam.go
+++ b/converters/google/resources/compute_region_disk_iam.go
@@ -90,7 +90,7 @@ func newComputeRegionDiskIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//compute.googleapis.com/{{regiondisk}}")
+	name, err := assetName(d, config, "//compute.googleapis.com/projects/{{project}}/regions/{{region}}/disks/{{name}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,7 +106,10 @@ func newComputeRegionDiskIamAsset(
 
 func FetchComputeRegionDiskIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{regiondisk}}"); !ok {
+	if _, ok := d.GetOk("{{region}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
+	if _, ok := d.GetOk("{{name}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
@@ -114,7 +117,7 @@ func FetchComputeRegionDiskIamPolicy(d TerraformResourceData, config *Config) (A
 		ComputeRegionDiskIamUpdaterProducer,
 		d,
 		config,
-		"//compute.googleapis.com/{{regiondisk}}",
+		"//compute.googleapis.com/projects/{{project}}/regions/{{region}}/disks/{{name}}",
 		ComputeRegionDiskIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/compute_subnetwork_iam.go b/converters/google/resources/compute_subnetwork_iam.go
index 502cb340..426523d6 100644
--- a/converters/google/resources/compute_subnetwork_iam.go
+++ b/converters/google/resources/compute_subnetwork_iam.go
@@ -90,7 +90,7 @@ func newComputeSubnetworkIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//compute.googleapis.com/{{subnetwork}}")
+	name, err := assetName(d, config, "//compute.googleapis.com/projects/{{project}}/regions/{{region}}/subnetworks/{{subnetwork}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,6 +106,9 @@ func newComputeSubnetworkIamAsset(
 
 func FetchComputeSubnetworkIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
+	if _, ok := d.GetOk("{{region}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
 	if _, ok := d.GetOk("{{subnetwork}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
@@ -114,7 +117,7 @@ func FetchComputeSubnetworkIamPolicy(d TerraformResourceData, config *Config) (A
 		ComputeSubnetworkIamUpdaterProducer,
 		d,
 		config,
-		"//compute.googleapis.com/{{subnetwork}}",
+		"//compute.googleapis.com/projects/{{project}}/regions/{{region}}/subnetworks/{{subnetwork}}",
 		ComputeSubnetworkIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/data_catalog_entry_group_iam.go b/converters/google/resources/data_catalog_entry_group_iam.go
index 2cc36ec0..165e13fa 100644
--- a/converters/google/resources/data_catalog_entry_group_iam.go
+++ b/converters/google/resources/data_catalog_entry_group_iam.go
@@ -90,7 +90,7 @@ func newDataCatalogEntryGroupIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//datacatalog.googleapis.com/{{entrygroup}}")
+	name, err := assetName(d, config, "//datacatalog.googleapis.com/projects/{{project}}/locations/{{region}}/entry_groups/{{entry_group}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,7 +106,10 @@ func newDataCatalogEntryGroupIamAsset(
 
 func FetchDataCatalogEntryGroupIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{entrygroup}}"); !ok {
+	if _, ok := d.GetOk("{{region}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
+	if _, ok := d.GetOk("{{entry_group}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
@@ -114,7 +117,7 @@ func FetchDataCatalogEntryGroupIamPolicy(d TerraformResourceData, config *Config
 		DataCatalogEntryGroupIamUpdaterProducer,
 		d,
 		config,
-		"//datacatalog.googleapis.com/{{entrygroup}}",
+		"//datacatalog.googleapis.com/projects/{{project}}/locations/{{region}}/entry_groups/{{entry_group}}",
 		DataCatalogEntryGroupIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/data_catalog_tag_template_iam.go b/converters/google/resources/data_catalog_tag_template_iam.go
index 37b4ad02..f2df937a 100644
--- a/converters/google/resources/data_catalog_tag_template_iam.go
+++ b/converters/google/resources/data_catalog_tag_template_iam.go
@@ -90,7 +90,7 @@ func newDataCatalogTagTemplateIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//datacatalog.googleapis.com/{{tagtemplate}}")
+	name, err := assetName(d, config, "//datacatalog.googleapis.com/projects/{{project}}/locations/{{region}}/tag_templates/{{tag_template}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,7 +106,10 @@ func newDataCatalogTagTemplateIamAsset(
 
 func FetchDataCatalogTagTemplateIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{tagtemplate}}"); !ok {
+	if _, ok := d.GetOk("{{region}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
+	if _, ok := d.GetOk("{{tag_template}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
@@ -114,7 +117,7 @@ func FetchDataCatalogTagTemplateIamPolicy(d TerraformResourceData, config *Confi
 		DataCatalogTagTemplateIamUpdaterProducer,
 		d,
 		config,
-		"//datacatalog.googleapis.com/{{tagtemplate}}",
+		"//datacatalog.googleapis.com/projects/{{project}}/locations/{{region}}/tag_templates/{{tag_template}}",
 		DataCatalogTagTemplateIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/healthcare_consent_store_iam.go b/converters/google/resources/healthcare_consent_store_iam.go
index 6ad5fa5d..510b4ec1 100644
--- a/converters/google/resources/healthcare_consent_store_iam.go
+++ b/converters/google/resources/healthcare_consent_store_iam.go
@@ -90,7 +90,7 @@ func newHealthcareConsentStoreIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//healthcare.googleapis.com/{{consentstore}}")
+	name, err := assetName(d, config, "//healthcare.googleapis.com/{{dataset}}/consent_stores/{{consent_store_id}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,7 +106,10 @@ func newHealthcareConsentStoreIamAsset(
 
 func FetchHealthcareConsentStoreIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{consentstore}}"); !ok {
+	if _, ok := d.GetOk("{{dataset}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
+	if _, ok := d.GetOk("{{consent_store_id}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
@@ -114,7 +117,7 @@ func FetchHealthcareConsentStoreIamPolicy(d TerraformResourceData, config *Confi
 		HealthcareConsentStoreIamUpdaterProducer,
 		d,
 		config,
-		"//healthcare.googleapis.com/{{consentstore}}",
+		"//healthcare.googleapis.com/{{dataset}}/consent_stores/{{consent_store_id}}",
 		HealthcareConsentStoreIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/iap_tunnel_iam.go b/converters/google/resources/iap_tunnel_iam.go
index bd127822..1eba1c4e 100644
--- a/converters/google/resources/iap_tunnel_iam.go
+++ b/converters/google/resources/iap_tunnel_iam.go
@@ -90,7 +90,7 @@ func newIapTunnelIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//iap.googleapis.com/{{tunnel}}")
+	name, err := assetName(d, config, "//iap.googleapis.com/projects/{{project}}/iap_tunnel")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,15 +106,12 @@ func newIapTunnelIamAsset(
 
 func FetchIapTunnelIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{tunnel}}"); !ok {
-		return Asset{}, ErrEmptyIdentityField
-	}
 
 	return fetchIamPolicy(
 		IapTunnelIamUpdaterProducer,
 		d,
 		config,
-		"//iap.googleapis.com/{{tunnel}}",
+		"//iap.googleapis.com/projects/{{project}}/iap_tunnel",
 		IapTunnelIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/iap_tunnel_instance_iam.go b/converters/google/resources/iap_tunnel_instance_iam.go
index cdf0aee5..baa496f1 100644
--- a/converters/google/resources/iap_tunnel_instance_iam.go
+++ b/converters/google/resources/iap_tunnel_instance_iam.go
@@ -90,7 +90,7 @@ func newIapTunnelInstanceIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//iap.googleapis.com/{{tunnelinstance}}")
+	name, err := assetName(d, config, "//iap.googleapis.com/projects/{{project}}/iap_tunnel/zones/{{zone}}/instances/{{instance}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,7 +106,10 @@ func newIapTunnelInstanceIamAsset(
 
 func FetchIapTunnelInstanceIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{tunnelinstance}}"); !ok {
+	if _, ok := d.GetOk("{{zone}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
+	if _, ok := d.GetOk("{{instance}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
@@ -114,7 +117,7 @@ func FetchIapTunnelInstanceIamPolicy(d TerraformResourceData, config *Config) (A
 		IapTunnelInstanceIamUpdaterProducer,
 		d,
 		config,
-		"//iap.googleapis.com/{{tunnelinstance}}",
+		"//iap.googleapis.com/projects/{{project}}/iap_tunnel/zones/{{zone}}/instances/{{instance}}",
 		IapTunnelInstanceIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/iap_web_iam.go b/converters/google/resources/iap_web_iam.go
index cbb8d6d8..56301391 100644
--- a/converters/google/resources/iap_web_iam.go
+++ b/converters/google/resources/iap_web_iam.go
@@ -90,7 +90,7 @@ func newIapWebIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//iap.googleapis.com/{{web}}")
+	name, err := assetName(d, config, "//iap.googleapis.com/projects/{{project}}/iap_web")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,15 +106,12 @@ func newIapWebIamAsset(
 
 func FetchIapWebIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{web}}"); !ok {
-		return Asset{}, ErrEmptyIdentityField
-	}
 
 	return fetchIamPolicy(
 		IapWebIamUpdaterProducer,
 		d,
 		config,
-		"//iap.googleapis.com/{{web}}",
+		"//iap.googleapis.com/projects/{{project}}/iap_web",
 		IapWebIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/notebooks_instance_iam.go b/converters/google/resources/notebooks_instance_iam.go
index 34c5f5c4..d7e8328d 100644
--- a/converters/google/resources/notebooks_instance_iam.go
+++ b/converters/google/resources/notebooks_instance_iam.go
@@ -90,7 +90,7 @@ func newNotebooksInstanceIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//notebooks.googleapis.com/{{instance}}")
+	name, err := assetName(d, config, "//notebooks.googleapis.com/projects/{{project}}/locations/{{location}}/instances/{{instance_name}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,7 +106,10 @@ func newNotebooksInstanceIamAsset(
 
 func FetchNotebooksInstanceIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{instance}}"); !ok {
+	if _, ok := d.GetOk("{{location}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
+	if _, ok := d.GetOk("{{instance_name}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
@@ -114,7 +117,7 @@ func FetchNotebooksInstanceIamPolicy(d TerraformResourceData, config *Config) (A
 		NotebooksInstanceIamUpdaterProducer,
 		d,
 		config,
-		"//notebooks.googleapis.com/{{instance}}",
+		"//notebooks.googleapis.com/projects/{{project}}/locations/{{location}}/instances/{{instance_name}}",
 		NotebooksInstanceIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/notebooks_runtime_iam.go b/converters/google/resources/notebooks_runtime_iam.go
index b7811f3c..01b6a2f4 100644
--- a/converters/google/resources/notebooks_runtime_iam.go
+++ b/converters/google/resources/notebooks_runtime_iam.go
@@ -90,7 +90,7 @@ func newNotebooksRuntimeIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//notebooks.googleapis.com/{{runtime}}")
+	name, err := assetName(d, config, "//notebooks.googleapis.com/projects/{{project}}/locations/{{location}}/runtimes/{{runtime_name}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,7 +106,10 @@ func newNotebooksRuntimeIamAsset(
 
 func FetchNotebooksRuntimeIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{runtime}}"); !ok {
+	if _, ok := d.GetOk("{{location}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
+	if _, ok := d.GetOk("{{runtime_name}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
@@ -114,7 +117,7 @@ func FetchNotebooksRuntimeIamPolicy(d TerraformResourceData, config *Config) (As
 		NotebooksRuntimeIamUpdaterProducer,
 		d,
 		config,
-		"//notebooks.googleapis.com/{{runtime}}",
+		"//notebooks.googleapis.com/projects/{{project}}/locations/{{location}}/runtimes/{{runtime_name}}",
 		NotebooksRuntimeIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/privateca_ca_pool_iam.go b/converters/google/resources/privateca_ca_pool_iam.go
index b455bb68..82c44223 100644
--- a/converters/google/resources/privateca_ca_pool_iam.go
+++ b/converters/google/resources/privateca_ca_pool_iam.go
@@ -90,7 +90,7 @@ func newPrivatecaCaPoolIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//privateca.googleapis.com/{{capool}}")
+	name, err := assetName(d, config, "//privateca.googleapis.com/projects/{{project}}/locations/{{location}}/ca_pools/{{ca_pool}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,7 +106,10 @@ func newPrivatecaCaPoolIamAsset(
 
 func FetchPrivatecaCaPoolIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{capool}}"); !ok {
+	if _, ok := d.GetOk("{{location}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
+	if _, ok := d.GetOk("{{ca_pool}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
@@ -114,7 +117,7 @@ func FetchPrivatecaCaPoolIamPolicy(d TerraformResourceData, config *Config) (Ass
 		PrivatecaCaPoolIamUpdaterProducer,
 		d,
 		config,
-		"//privateca.googleapis.com/{{capool}}",
+		"//privateca.googleapis.com/projects/{{project}}/locations/{{location}}/ca_pools/{{ca_pool}}",
 		PrivatecaCaPoolIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/pubsub_topic_iam.go b/converters/google/resources/pubsub_topic_iam.go
index 84c10640..367988d9 100644
--- a/converters/google/resources/pubsub_topic_iam.go
+++ b/converters/google/resources/pubsub_topic_iam.go
@@ -90,7 +90,7 @@ func newPubsubTopicIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//pubsub.googleapis.com/{{topic}}")
+	name, err := assetName(d, config, "//pubsub.googleapis.com/projects/{{project}}/topics/{{topic}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -114,7 +114,7 @@ func FetchPubsubTopicIamPolicy(d TerraformResourceData, config *Config) (Asset,
 		PubsubTopicIamUpdaterProducer,
 		d,
 		config,
-		"//pubsub.googleapis.com/{{topic}}",
+		"//pubsub.googleapis.com/projects/{{project}}/topics/{{topic}}",
 		PubsubTopicIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/resource_converters.go b/converters/google/resources/resource_converters.go
index 3619f024..0a3a837c 100644
--- a/converters/google/resources/resource_converters.go
+++ b/converters/google/resources/resource_converters.go
@@ -64,6 +64,9 @@ func ResourceConverters() map[string][]ResourceConverter {
 		"google_pubsub_subscription_iam_policy":            {resourceConverterPubsubSubscriptionIamPolicy()},
 		"google_pubsub_subscription_iam_binding":           {resourceConverterPubsubSubscriptionIamBinding()},
 		"google_pubsub_subscription_iam_member":            {resourceConverterPubsubSubscriptionIamMember()},
+		"google_storage_bucket_iam_policy":                 {resourceConverterStorageBucketIamPolicy()},
+		"google_storage_bucket_iam_binding":                {resourceConverterStorageBucketIamBinding()},
+		"google_storage_bucket_iam_member":                 {resourceConverterStorageBucketIamMember()},
 		"google_pubsub_topic":                              {resourceConverterPubsubTopic()},
 		"google_kms_crypto_key":                            {resourceConverterKMSCryptoKey()},
 		"google_kms_key_ring":                              {resourceConverterKMSKeyRing()},
@@ -139,9 +142,6 @@ func ResourceConverters() map[string][]ResourceConverter {
 		"google_endpoints_service_iam_policy":              {resourceConverterServiceManagementServiceIamPolicy()},
 		"google_endpoints_service_iam_binding":             {resourceConverterServiceManagementServiceIamBinding()},
 		"google_endpoints_service_iam_member":              {resourceConverterServiceManagementServiceIamMember()},
-		"google_storage_bucket_iam_policy":                 {resourceConverterStorageBucketIamPolicy()},
-		"google_storage_bucket_iam_binding":                {resourceConverterStorageBucketIamBinding()},
-		"google_storage_bucket_iam_member":                 {resourceConverterStorageBucketIamMember()},
 		"google_project": {
 			resourceConverterProject(),
 			resourceConverterProjectBillingInfo(),
diff --git a/converters/google/resources/secret_manager_secret_iam.go b/converters/google/resources/secret_manager_secret_iam.go
index 38e34079..865dfb57 100644
--- a/converters/google/resources/secret_manager_secret_iam.go
+++ b/converters/google/resources/secret_manager_secret_iam.go
@@ -90,7 +90,7 @@ func newSecretManagerSecretIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//secretmanager.googleapis.com/{{secret}}")
+	name, err := assetName(d, config, "//secretmanager.googleapis.com/projects/{{project}}/secrets/{{secret_id}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,7 +106,7 @@ func newSecretManagerSecretIamAsset(
 
 func FetchSecretManagerSecretIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{secret}}"); !ok {
+	if _, ok := d.GetOk("{{secret_id}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
@@ -114,7 +114,7 @@ func FetchSecretManagerSecretIamPolicy(d TerraformResourceData, config *Config)
 		SecretManagerSecretIamUpdaterProducer,
 		d,
 		config,
-		"//secretmanager.googleapis.com/{{secret}}",
+		"//secretmanager.googleapis.com/projects/{{project}}/secrets/{{secret_id}}",
 		SecretManagerSecretIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/service_management_service_iam.go b/converters/google/resources/service_management_service_iam.go
index fdc51883..2632ca9b 100644
--- a/converters/google/resources/service_management_service_iam.go
+++ b/converters/google/resources/service_management_service_iam.go
@@ -90,7 +90,7 @@ func newServiceManagementServiceIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//servicemanagement.googleapis.com/{{service}}")
+	name, err := assetName(d, config, "//servicemanagement.googleapis.com/services/{{service_name}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -106,7 +106,7 @@ func newServiceManagementServiceIamAsset(
 
 func FetchServiceManagementServiceIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
 	// Check if the identity field returns a value
-	if _, ok := d.GetOk("{{service}}"); !ok {
+	if _, ok := d.GetOk("{{service_name}}"); !ok {
 		return Asset{}, ErrEmptyIdentityField
 	}
 
@@ -114,7 +114,7 @@ func FetchServiceManagementServiceIamPolicy(d TerraformResourceData, config *Con
 		ServiceManagementServiceIamUpdaterProducer,
 		d,
 		config,
-		"//servicemanagement.googleapis.com/{{service}}",
+		"//servicemanagement.googleapis.com/services/{{service_name}}",
 		ServiceManagementServiceIAMAssetType,
 	)
 }
diff --git a/converters/google/resources/storage_bucket_iam.go b/converters/google/resources/storage_bucket_iam.go
index f9bf9e0d..d395560b 100644
--- a/converters/google/resources/storage_bucket_iam.go
+++ b/converters/google/resources/storage_bucket_iam.go
@@ -1,17 +1,3 @@
-// ----------------------------------------------------------------------------
-//
-//     ***     AUTO GENERATED CODE    ***    Type: MMv1     ***
-//
-// ----------------------------------------------------------------------------
-//
-//     This file is automatically generated by Magic Modules and manual
-//     changes will be clobbered when the file is regenerated.
-//
-//     Please read more about how to change this file in
-//     .github/CONTRIBUTING.md.
-//
-// ----------------------------------------------------------------------------
-
 package google
 
 import "fmt"


Test patch:
diff --git a/converters/google/resources/binary_authorization_attestor_iam.go b/converters/google/resources/binary_authorization_attestor_iam.go
index 2b7c90c2..f01709d3 100644
--- a/converters/google/resources/binary_authorization_attestor_iam.go
+++ b/converters/google/resources/binary_authorization_attestor_iam.go
@@ -90,7 +90,7 @@ func newBinaryAuthorizationAttestorIamAsset(
 		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
 	}
 
-	name, err := assetName(d, config, "//binaryauthorization.googleapis.com/{{attestor}}")
+	name, err := assetName(d, config, "//binaryauthorization.googleapis.com/projects/{{project}}/attestors/{{attestor}}")
 	if err != nil {
 		return []Asset{}, err
 	}
@@ -114,7 +114,7 @@ func FetchBinaryAuthorizationAttestorIamPolicy(d TerraformResourceData, config *
 		BinaryAuthorizationAttestorIamUpdaterProducer,
 		d,
 		config,
-		"//binaryauthorization.googleapis.com/{{attestor}}",
+		"//binaryauthorization.googleapis.com/projects/{{project}}/attestors/{{attestor}}",
 		BinaryAuthorizationAttestorIAMAssetType,
 	)
 }
diff --git a/testdata/templates/example_cloud_run_service_iam_binding.json b/testdata/templates/example_cloud_run_service_iam_binding.json
index 9bcc3354..95d3ed4d 100644
--- a/testdata/templates/example_cloud_run_service_iam_binding.json
+++ b/testdata/templates/example_cloud_run_service_iam_binding.json
@@ -1,17 +1,4 @@
 [
-  {
-    "name": "//run.googleapis.com/cloudrun-srv",
-    "asset_type": "run.googleapis.com/Service",
-    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
-    "iam_policy": {
-      "bindings": [
-        {
-          "role": "roles/viewer",
-          "members": ["user:jane@example.com"]
-        }
-      ]
-    }
-  },
   {
     "name": "//run.googleapis.com/projects/{{.Provider.project}}/locations/us-central1/services/cloudrun-srv",
     "asset_type": "run.googleapis.com/Service",
@@ -45,6 +32,16 @@
           ]
         }
       }
+    },
+    "iam_policy": {
+      "bindings": [
+        {
+          "role": "roles/viewer",
+          "members": [
+            "user:jane@example.com"
+          ]
+        }
+      ]
     }
   }
 ]
diff --git a/testdata/templates/example_cloud_run_service_iam_member.json b/testdata/templates/example_cloud_run_service_iam_member.json
index 3e780646..95d3ed4d 100644
--- a/testdata/templates/example_cloud_run_service_iam_member.json
+++ b/testdata/templates/example_cloud_run_service_iam_member.json
@@ -1,19 +1,4 @@
 [
-  {
-    "name": "//run.googleapis.com/cloudrun-srv",
-    "asset_type": "run.googleapis.com/Service",
-    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
-    "iam_policy": {
-      "bindings": [
-        {
-          "role": "roles/viewer",
-          "members": [
-            "user:jane@example.com"
-          ]
-        }
-      ]
-    }
-  },
   {
     "name": "//run.googleapis.com/projects/{{.Provider.project}}/locations/us-central1/services/cloudrun-srv",
     "asset_type": "run.googleapis.com/Service",
@@ -47,6 +32,16 @@
           ]
         }
       }
+    },
+    "iam_policy": {
+      "bindings": [
+        {
+          "role": "roles/viewer",
+          "members": [
+            "user:jane@example.com"
+          ]
+        }
+      ]
     }
   }
 ]
diff --git a/testdata/templates/example_cloud_run_service_iam_policy.json b/testdata/templates/example_cloud_run_service_iam_policy.json
index 5ef9005e..c96b2045 100644
--- a/testdata/templates/example_cloud_run_service_iam_policy.json
+++ b/testdata/templates/example_cloud_run_service_iam_policy.json
@@ -1,19 +1,4 @@
 [
-  {
-    "name": "//run.googleapis.com/cloudrun-srv",
-    "asset_type": "run.googleapis.com/Service",
-    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
-    "iam_policy": {
-      "bindings": [
-        {
-          "role": "roles/editor",
-          "members": [
-            "user:jane@example.com"
-          ]
-        }
-      ]
-    }
-  },
   {
     "name": "//run.googleapis.com/projects/{{.Provider.project}}/locations/us-central1/services/cloudrun-srv",
     "asset_type": "run.googleapis.com/Service",
@@ -47,6 +32,16 @@
           ]
         }
       }
+    },
+    "iam_policy": {
+      "bindings": [
+        {
+          "role": "roles/editor",
+          "members": [
+            "user:jane@example.com"
+          ]
+        }
+      ]
     }
   }
 ]