Repository: GoogleCloudPlatform/terraform-validator
Pull request #447 (2021-12-22 16:23:12)

Add support for google_cloud_run_service_iam
<!-- Put a description of what this PR is for here, along with any references to issues that this resolves or contributes to -->

Add support for google_cloud_run_service_iam


<!--
Replace each [ ] with [X] to check it. Switch to the preview view to make it easier to click on links.
These steps will speed up the review process, and we appreciate you spending time on them before sending
your code to be reviewed.
-->
If this PR is for Terraform, I acknowledge that I have:

- [X] Searched through the [issue tracker](https://github.com/hashicorp/terraform-provider-google/issues) for an open issue that this either resolves or contributes to, commented on it to claim it, and written "fixes {url}" or "part of {url}" in this PR description. If there were no relevant open issues, I opened one and commented that I would like to work on it (not necessary for very small changes).
- [ ] [Generated Terraform](https://github.com/GoogleCloudPlatform/magic-modules#generating-downstream-tools), and ran `make test` and `make lint` to ensure it passes unit and linter tests.
- [ ] Ensured that all new fields I added that can be set by a user appear in at least one [example](https://github.com/GoogleCloudPlatform/magic-modules/tree/master/templates/terraform/examples) (for generated resources) or [third_party test](https://github.com/GoogleCloudPlatform/magic-modules/tree/master/third_party/terraform/tests) (for handwritten resources or update tests).
- [ ] [Ran](https://github.com/hashicorp/terraform-provider-google/blob/master/.github/CONTRIBUTING.md#tests) relevant acceptance tests (If the acceptance tests do not yet pass or you are unable to run them, please let your reviewer know).
- [X] Read the [Release Notes Guide](https://github.com/GoogleCloudPlatform/magic-modules/blob/master/.ci/RELEASE_NOTES_GUIDE.md) before writing my release note below.

<!-- AUTOCHANGELOG for Downstream PRs.

Please select one of the following "release-note:" headings:
    - release-note:enhancement
    - release-note:bug
    - release-note:note
    - release-note:new-resource
    - release-note:new-datasource
    - release-note:deprecation
    - release-note:breaking-change
    - release-note:none
    
Unless you choose release-note:none, please add a release note.

See .ci/RELEASE_NOTES_GUIDE.md for writing good release notes.

You can add more release note blocks if you want more than one CHANGELOG
entry for this PR.
-->
**Release Note Template for Downstream PRs (will be copied)**

```release-note:enhancement

```

Derived from https://github.com/GoogleCloudPlatform/magic-modules/pull/5559


Patch:
diff --git a/converters/google/resources/cloud_run_service_iam.go b/converters/google/resources/cloud_run_service_iam.go
new file mode 100644
index 00000000..3743c37f
--- /dev/null
+++ b/converters/google/resources/cloud_run_service_iam.go
@@ -0,0 +1,120 @@
+// ----------------------------------------------------------------------------
+//
+//     ***     AUTO GENERATED CODE    ***    Type: MMv1     ***
+//
+// ----------------------------------------------------------------------------
+//
+//     This file is automatically generated by Magic Modules and manual
+//     changes will be clobbered when the file is regenerated.
+//
+//     Please read more about how to change this file in
+//     .github/CONTRIBUTING.md.
+//
+// ----------------------------------------------------------------------------
+
+package google
+
+import "fmt"
+
+// Provide a separate asset type constant so we don't have to worry about name conflicts between IAM and non-IAM converter files
+const CloudRunServiceIAMAssetType string = "run.googleapis.com/Service"
+
+func resourceConverterCloudRunServiceIamPolicy() ResourceConverter {
+	return ResourceConverter{
+		AssetType:         CloudRunServiceIAMAssetType,
+		Convert:           GetCloudRunServiceIamPolicyCaiObject,
+		MergeCreateUpdate: MergeCloudRunServiceIamPolicy,
+	}
+}
+
+func resourceConverterCloudRunServiceIamBinding() ResourceConverter {
+	return ResourceConverter{
+		AssetType:         CloudRunServiceIAMAssetType,
+		Convert:           GetCloudRunServiceIamBindingCaiObject,
+		FetchFullResource: FetchCloudRunServiceIamPolicy,
+		MergeCreateUpdate: MergeCloudRunServiceIamBinding,
+		MergeDelete:       MergeCloudRunServiceIamBindingDelete,
+	}
+}
+
+func resourceConverterCloudRunServiceIamMember() ResourceConverter {
+	return ResourceConverter{
+		AssetType:         CloudRunServiceIAMAssetType,
+		Convert:           GetCloudRunServiceIamMemberCaiObject,
+		FetchFullResource: FetchCloudRunServiceIamPolicy,
+		MergeCreateUpdate: MergeCloudRunServiceIamMember,
+		MergeDelete:       MergeCloudRunServiceIamMemberDelete,
+	}
+}
+
+func GetCloudRunServiceIamPolicyCaiObject(d TerraformResourceData, config *Config) ([]Asset, error) {
+	return newCloudRunServiceIamAsset(d, config, expandIamPolicyBindings)
+}
+
+func GetCloudRunServiceIamBindingCaiObject(d TerraformResourceData, config *Config) ([]Asset, error) {
+	return newCloudRunServiceIamAsset(d, config, expandIamRoleBindings)
+}
+
+func GetCloudRunServiceIamMemberCaiObject(d TerraformResourceData, config *Config) ([]Asset, error) {
+	return newCloudRunServiceIamAsset(d, config, expandIamMemberBindings)
+}
+
+func MergeCloudRunServiceIamPolicy(existing, incoming Asset) Asset {
+	existing.IAMPolicy = incoming.IAMPolicy
+	return existing
+}
+
+func MergeCloudRunServiceIamBinding(existing, incoming Asset) Asset {
+	return mergeIamAssets(existing, incoming, mergeAuthoritativeBindings)
+}
+
+func MergeCloudRunServiceIamBindingDelete(existing, incoming Asset) Asset {
+	return mergeDeleteIamAssets(existing, incoming, mergeDeleteAuthoritativeBindings)
+}
+
+func MergeCloudRunServiceIamMember(existing, incoming Asset) Asset {
+	return mergeIamAssets(existing, incoming, mergeAdditiveBindings)
+}
+
+func MergeCloudRunServiceIamMemberDelete(existing, incoming Asset) Asset {
+	return mergeDeleteIamAssets(existing, incoming, mergeDeleteAdditiveBindings)
+}
+
+func newCloudRunServiceIamAsset(
+	d TerraformResourceData,
+	config *Config,
+	expandBindings func(d TerraformResourceData) ([]IAMBinding, error),
+) ([]Asset, error) {
+	bindings, err := expandBindings(d)
+	if err != nil {
+		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
+	}
+
+	name, err := assetName(d, config, "//run.googleapis.com/{{service}}")
+	if err != nil {
+		return []Asset{}, err
+	}
+
+	return []Asset{{
+		Name: name,
+		Type: CloudRunServiceIAMAssetType,
+		IAMPolicy: &IAMPolicy{
+			Bindings: bindings,
+		},
+	}}, nil
+}
+
+func FetchCloudRunServiceIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
+	// Check if the identity field returns a value
+	if _, ok := d.GetOk("{{service}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
+
+	return fetchIamPolicy(
+		CloudRunServiceIamUpdaterProducer,
+		d,
+		config,
+		"//run.googleapis.com/{{service}}",
+		CloudRunServiceIAMAssetType,
+	)
+}
diff --git a/converters/google/resources/iam_cloud_run_service.go b/converters/google/resources/iam_cloud_run_service.go
new file mode 100644
index 00000000..49f592e9
--- /dev/null
+++ b/converters/google/resources/iam_cloud_run_service.go
@@ -0,0 +1,222 @@
+// ----------------------------------------------------------------------------
+//
+//     ***     AUTO GENERATED CODE    ***    Type: MMv1     ***
+//
+// ----------------------------------------------------------------------------
+//
+//     This file is automatically generated by Magic Modules and manual
+//     changes will be clobbered when the file is regenerated.
+//
+//     Please read more about how to change this file in
+//     .github/CONTRIBUTING.md.
+//
+// ----------------------------------------------------------------------------
+package google
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/errwrap"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"google.golang.org/api/cloudresourcemanager/v1"
+)
+
+var CloudRunServiceIamSchema = map[string]*schema.Schema{
+	"project": {
+		Type:     schema.TypeString,
+		Computed: true,
+		Optional: true,
+		ForceNew: true,
+	},
+	"location": {
+		Type:     schema.TypeString,
+		Computed: true,
+		Optional: true,
+		ForceNew: true,
+	},
+	"service": {
+		Type:             schema.TypeString,
+		Required:         true,
+		ForceNew:         true,
+		DiffSuppressFunc: compareSelfLinkOrResourceName,
+	},
+}
+
+type CloudRunServiceIamUpdater struct {
+	project  string
+	location string
+	service  string
+	d        TerraformResourceData
+	Config   *Config
+}
+
+func CloudRunServiceIamUpdaterProducer(d TerraformResourceData, config *Config) (ResourceIamUpdater, error) {
+	values := make(map[string]string)
+
+	project, _ := getProject(d, config)
+	if project != "" {
+		if err := d.Set("project", project); err != nil {
+			return nil, fmt.Errorf("Error setting project: %s", err)
+		}
+	}
+	values["project"] = project
+	location, _ := getLocation(d, config)
+	if location != "" {
+		if err := d.Set("location", location); err != nil {
+			return nil, fmt.Errorf("Error setting location: %s", err)
+		}
+	}
+	values["location"] = location
+	if v, ok := d.GetOk("service"); ok {
+		values["service"] = v.(string)
+	}
+
+	// We may have gotten either a long or short name, so attempt to parse long name if possible
+	m, err := getImportIdQualifiers([]string{"projects/(?P<project>[^/]+)/locations/(?P<location>[^/]+)/services/(?P<service>[^/]+)", "(?P<project>[^/]+)/(?P<location>[^/]+)/(?P<service>[^/]+)", "(?P<location>[^/]+)/(?P<service>[^/]+)", "(?P<service>[^/]+)"}, d, config, d.Get("service").(string))
+	if err != nil {
+		return nil, err
+	}
+
+	for k, v := range m {
+		values[k] = v
+	}
+
+	u := &CloudRunServiceIamUpdater{
+		project:  values["project"],
+		location: values["location"],
+		service:  values["service"],
+		d:        d,
+		Config:   config,
+	}
+
+	if err := d.Set("project", u.project); err != nil {
+		return nil, fmt.Errorf("Error setting project: %s", err)
+	}
+	if err := d.Set("location", u.location); err != nil {
+		return nil, fmt.Errorf("Error setting location: %s", err)
+	}
+	if err := d.Set("service", u.GetResourceId()); err != nil {
+		return nil, fmt.Errorf("Error setting service: %s", err)
+	}
+
+	return u, nil
+}
+
+func CloudRunServiceIdParseFunc(d *schema.ResourceData, config *Config) error {
+	values := make(map[string]string)
+
+	project, _ := getProject(d, config)
+	if project != "" {
+		values["project"] = project
+	}
+
+	location, _ := getLocation(d, config)
+	if location != "" {
+		values["location"] = location
+	}
+
+	m, err := getImportIdQualifiers([]string{"projects/(?P<project>[^/]+)/locations/(?P<location>[^/]+)/services/(?P<service>[^/]+)", "(?P<project>[^/]+)/(?P<location>[^/]+)/(?P<service>[^/]+)", "(?P<location>[^/]+)/(?P<service>[^/]+)", "(?P<service>[^/]+)"}, d, config, d.Id())
+	if err != nil {
+		return err
+	}
+
+	for k, v := range m {
+		values[k] = v
+	}
+
+	u := &CloudRunServiceIamUpdater{
+		project:  values["project"],
+		location: values["location"],
+		service:  values["service"],
+		d:        d,
+		Config:   config,
+	}
+	if err := d.Set("service", u.GetResourceId()); err != nil {
+		return fmt.Errorf("Error setting service: %s", err)
+	}
+	d.SetId(u.GetResourceId())
+	return nil
+}
+
+func (u *CloudRunServiceIamUpdater) GetResourceIamPolicy() (*cloudresourcemanager.Policy, error) {
+	url, err := u.qualifyServiceUrl("getIamPolicy")
+	if err != nil {
+		return nil, err
+	}
+
+	project, err := getProject(u.d, u.Config)
+	if err != nil {
+		return nil, err
+	}
+	var obj map[string]interface{}
+
+	userAgent, err := generateUserAgentString(u.d, u.Config.userAgent)
+	if err != nil {
+		return nil, err
+	}
+
+	policy, err := sendRequest(u.Config, "GET", project, url, userAgent, obj, isCloudRunCreationConflict)
+	if err != nil {
+		return nil, errwrap.Wrapf(fmt.Sprintf("Error retrieving IAM policy for %s: {{err}}", u.DescribeResource()), err)
+	}
+
+	out := &cloudresourcemanager.Policy{}
+	err = Convert(policy, out)
+	if err != nil {
+		return nil, errwrap.Wrapf("Cannot convert a policy to a resource manager policy: {{err}}", err)
+	}
+
+	return out, nil
+}
+
+func (u *CloudRunServiceIamUpdater) SetResourceIamPolicy(policy *cloudresourcemanager.Policy) error {
+	json, err := ConvertToMap(policy)
+	if err != nil {
+		return err
+	}
+
+	obj := make(map[string]interface{})
+	obj["policy"] = json
+
+	url, err := u.qualifyServiceUrl("setIamPolicy")
+	if err != nil {
+		return err
+	}
+	project, err := getProject(u.d, u.Config)
+	if err != nil {
+		return err
+	}
+
+	userAgent, err := generateUserAgentString(u.d, u.Config.userAgent)
+	if err != nil {
+		return err
+	}
+
+	_, err = sendRequestWithTimeout(u.Config, "POST", project, url, userAgent, obj, u.d.Timeout(schema.TimeoutCreate), isCloudRunCreationConflict)
+	if err != nil {
+		return errwrap.Wrapf(fmt.Sprintf("Error setting IAM policy for %s: {{err}}", u.DescribeResource()), err)
+	}
+
+	return nil
+}
+
+func (u *CloudRunServiceIamUpdater) qualifyServiceUrl(methodIdentifier string) (string, error) {
+	urlTemplate := fmt.Sprintf("{{CloudRunBasePath}}%s:%s", fmt.Sprintf("v1/projects/%s/locations/%s/services/%s", u.project, u.location, u.service), methodIdentifier)
+	url, err := replaceVars(u.d, u.Config, urlTemplate)
+	if err != nil {
+		return "", err
+	}
+	return url, nil
+}
+
+func (u *CloudRunServiceIamUpdater) GetResourceId() string {
+	return fmt.Sprintf("v1/projects/%s/locations/%s/services/%s", u.project, u.location, u.service)
+}
+
+func (u *CloudRunServiceIamUpdater) GetMutexKey() string {
+	return fmt.Sprintf("iam-cloudrun-service-%s", u.GetResourceId())
+}
+
+func (u *CloudRunServiceIamUpdater) DescribeResource() string {
+	return fmt.Sprintf("cloudrun service %q", u.GetResourceId())
+}
diff --git a/converters/google/resources/resource_converters.go b/converters/google/resources/resource_converters.go
index 0601bb5f..dc0502c8 100644
--- a/converters/google/resources/resource_converters.go
+++ b/converters/google/resources/resource_converters.go
@@ -84,6 +84,9 @@ func ResourceConverters() map[string][]ResourceConverter {
 		"google_cloudfunctions_function_iam_policy":        {resourceConverterCloudFunctionsCloudFunctionIamPolicy()},
 		"google_cloudfunctions_function_iam_binding":       {resourceConverterCloudFunctionsCloudFunctionIamBinding()},
 		"google_cloudfunctions_function_iam_member":        {resourceConverterCloudFunctionsCloudFunctionIamMember()},
+		"google_cloud_run_service_iam_policy":              {resourceConverterCloudRunServiceIamPolicy()},
+		"google_cloud_run_service_iam_binding":             {resourceConverterCloudRunServiceIamBinding()},
+		"google_cloud_run_service_iam_member":              {resourceConverterCloudRunServiceIamMember()},
 		"google_compute_disk_iam_policy":                   {resourceConverterComputeDiskIamPolicy()},
 		"google_compute_disk_iam_binding":                  {resourceConverterComputeDiskIamBinding()},
 		"google_compute_disk_iam_member":                   {resourceConverterComputeDiskIamMember()},


Test patch:
diff --git a/test/cli_test.go b/test/cli_test.go
index 9e553e3b..08097964 100644
--- a/test/cli_test.go
+++ b/test/cli_test.go
@@ -79,6 +79,9 @@ func TestCLI(t *testing.T) {
 		{name: "example_bigtable_instance"},
 		{name: "example_cloud_run_mapping"},
 		{name: "example_cloud_run_service"},
+		{name: "example_cloud_run_service_iam_binding"},
+		{name: "example_cloud_run_service_iam_member"},
+		{name: "example_cloud_run_service_iam_policy"},
 		{name: "example_compute_address"},
 		{name: "example_compute_disk"},
 		{name: "example_compute_disk_empty_image"},
diff --git a/test/read_test.go b/test/read_test.go
index 5639e6e1..5140ae49 100644
--- a/test/read_test.go
+++ b/test/read_test.go
@@ -38,6 +38,9 @@ func TestReadPlannedAssetsCoverage(t *testing.T) {
 		{name: "example_bigtable_instance"},
 		{name: "example_cloud_run_mapping"},
 		{name: "example_cloud_run_service"},
+		{name: "example_cloud_run_service_iam_binding"},
+		{name: "example_cloud_run_service_iam_member"},
+		{name: "example_cloud_run_service_iam_policy"},
 		{name: "example_compute_address"},
 		{name: "example_compute_disk"},
 		{name: "example_compute_disk_empty_image"},
diff --git a/testdata/templates/example_cloud_run_service_iam_binding.json b/testdata/templates/example_cloud_run_service_iam_binding.json
new file mode 100644
index 00000000..9bcc3354
--- /dev/null
+++ b/testdata/templates/example_cloud_run_service_iam_binding.json
@@ -0,0 +1,50 @@
+[
+  {
+    "name": "//run.googleapis.com/cloudrun-srv",
+    "asset_type": "run.googleapis.com/Service",
+    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
+    "iam_policy": {
+      "bindings": [
+        {
+          "role": "roles/viewer",
+          "members": ["user:jane@example.com"]
+        }
+      ]
+    }
+  },
+  {
+    "name": "//run.googleapis.com/projects/{{.Provider.project}}/locations/us-central1/services/cloudrun-srv",
+    "asset_type": "run.googleapis.com/Service",
+    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
+    "resource": {
+      "version": "v1",
+      "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/run/v1/rest",
+      "discovery_name": "Service",
+      "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
+      "data": {
+        "apiVersion": "serving.knative.dev/v1",
+        "kind": "Service",
+        "metadata": {
+          "name": "cloudrun-srv"
+        },
+        "spec": {
+          "template": {
+            "spec": {
+              "containers": [
+                {
+                  "image": "us-docker.pkg.dev/cloudrun/container/hello"
+                }
+              ]
+            }
+          },
+          "traffic": [
+            {
+              "latestRevision": true,
+              "percent": 100
+            }
+          ]
+        }
+      }
+    }
+  }
+]
diff --git a/testdata/templates/example_cloud_run_service_iam_binding.tf b/testdata/templates/example_cloud_run_service_iam_binding.tf
new file mode 100644
index 00000000..14d9e774
--- /dev/null
+++ b/testdata/templates/example_cloud_run_service_iam_binding.tf
@@ -0,0 +1,56 @@
+/**
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+terraform {
+  required_providers {
+    google = {
+      source = "hashicorp/google"
+      version = "~> {{.Provider.version}}"
+    }
+  }
+}
+
+provider "google" {
+  {{if .Provider.credentials }}credentials = "{{.Provider.credentials}}"{{end}}
+}
+
+resource "google_cloud_run_service" "default" {
+  name     = "cloudrun-srv"
+  location = "us-central1"
+
+  template {
+    spec {
+      containers {
+        image = "us-docker.pkg.dev/cloudrun/container/hello"
+      }
+    }
+  }
+
+  traffic {
+    percent         = 100
+    latest_revision = true
+  }
+}
+
+resource "google_cloud_run_service_iam_binding" "binding" {
+  location = google_cloud_run_service.default.location
+  project = google_cloud_run_service.default.project
+  service = google_cloud_run_service.default.name
+  role = "roles/viewer"
+  members = [
+    "user:jane@example.com",
+  ]
+}
diff --git a/testdata/templates/example_cloud_run_service_iam_binding.tfplan.json b/testdata/templates/example_cloud_run_service_iam_binding.tfplan.json
new file mode 100644
index 00000000..341f5d1b
--- /dev/null
+++ b/testdata/templates/example_cloud_run_service_iam_binding.tfplan.json
@@ -0,0 +1,329 @@
+{
+  "format_version": "0.2",
+  "terraform_version": "1.0.10",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_cloud_run_service.default",
+          "mode": "managed",
+          "type": "google_cloud_run_service",
+          "name": "default",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 1,
+          "values": {
+            "autogenerate_revision_name": false,
+            "location": "us-central1",
+            "name": "cloudrun-srv",
+            "template": [
+              {
+                "spec": [
+                  {
+                    "containers": [
+                      {
+                        "args": null,
+                        "command": null,
+                        "env": [],
+                        "env_from": [],
+                        "image": "us-docker.pkg.dev/cloudrun/container/hello",
+                        "volume_mounts": [],
+                        "working_dir": null
+                      }
+                    ],
+                    "service_account_name": null,
+                    "volumes": []
+                  }
+                ]
+              }
+            ],
+            "timeouts": null,
+            "traffic": [
+              {
+                "latest_revision": true,
+                "percent": 100,
+                "revision_name": null
+              }
+            ]
+          },
+          "sensitive_values": {
+            "metadata": [],
+            "status": [],
+            "template": [
+              {
+                "metadata": [],
+                "spec": [
+                  {
+                    "containers": [
+                      {
+                        "env": [],
+                        "env_from": [],
+                        "ports": [],
+                        "resources": [],
+                        "volume_mounts": []
+                      }
+                    ],
+                    "volumes": []
+                  }
+                ]
+              }
+            ],
+            "traffic": [
+              {}
+            ]
+          }
+        },
+        {
+          "address": "google_cloud_run_service_iam_binding.binding",
+          "mode": "managed",
+          "type": "google_cloud_run_service_iam_binding",
+          "name": "binding",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 0,
+          "values": {
+            "condition": [],
+            "location": "us-central1",
+            "members": [
+              "user:jane@example.com"
+            ],
+            "role": "roles/viewer",
+            "service": "cloudrun-srv"
+          },
+          "sensitive_values": {
+            "condition": [],
+            "members": [
+              false
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_cloud_run_service.default",
+      "mode": "managed",
+      "type": "google_cloud_run_service",
+      "name": "default",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "autogenerate_revision_name": false,
+          "location": "us-central1",
+          "name": "cloudrun-srv",
+          "template": [
+            {
+              "spec": [
+                {
+                  "containers": [
+                    {
+                      "args": null,
+                      "command": null,
+                      "env": [],
+                      "env_from": [],
+                      "image": "us-docker.pkg.dev/cloudrun/container/hello",
+                      "volume_mounts": [],
+                      "working_dir": null
+                    }
+                  ],
+                  "service_account_name": null,
+                  "volumes": []
+                }
+              ]
+            }
+          ],
+          "timeouts": null,
+          "traffic": [
+            {
+              "latest_revision": true,
+              "percent": 100,
+              "revision_name": null
+            }
+          ]
+        },
+        "after_unknown": {
+          "id": true,
+          "metadata": true,
+          "project": true,
+          "status": true,
+          "template": [
+            {
+              "metadata": true,
+              "spec": [
+                {
+                  "container_concurrency": true,
+                  "containers": [
+                    {
+                      "env": [],
+                      "env_from": [],
+                      "ports": true,
+                      "resources": true,
+                      "volume_mounts": []
+                    }
+                  ],
+                  "serving_state": true,
+                  "timeout_seconds": true,
+                  "volumes": []
+                }
+              ]
+            }
+          ],
+          "traffic": [
+            {}
+          ]
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "metadata": [],
+          "status": [],
+          "template": [
+            {
+              "metadata": [],
+              "spec": [
+                {
+                  "containers": [
+                    {
+                      "env": [],
+                      "env_from": [],
+                      "ports": [],
+                      "resources": [],
+                      "volume_mounts": []
+                    }
+                  ],
+                  "volumes": []
+                }
+              ]
+            }
+          ],
+          "traffic": [
+            {}
+          ]
+        }
+      }
+    },
+    {
+      "address": "google_cloud_run_service_iam_binding.binding",
+      "mode": "managed",
+      "type": "google_cloud_run_service_iam_binding",
+      "name": "binding",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "condition": [],
+          "location": "us-central1",
+          "members": [
+            "user:jane@example.com"
+          ],
+          "role": "roles/viewer",
+          "service": "cloudrun-srv"
+        },
+        "after_unknown": {
+          "condition": [],
+          "etag": true,
+          "id": true,
+          "members": [
+            false
+          ],
+          "project": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "condition": [],
+          "members": [
+            false
+          ]
+        }
+      }
+    }
+  ],
+  "configuration": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_cloud_run_service.default",
+          "mode": "managed",
+          "type": "google_cloud_run_service",
+          "name": "default",
+          "provider_config_key": "google",
+          "expressions": {
+            "location": {
+              "constant_value": "us-central1"
+            },
+            "name": {
+              "constant_value": "cloudrun-srv"
+            },
+            "template": [
+              {
+                "spec": [
+                  {
+                    "containers": [
+                      {
+                        "image": {
+                          "constant_value": "us-docker.pkg.dev/cloudrun/container/hello"
+                        }
+                      }
+                    ]
+                  }
+                ]
+              }
+            ],
+            "traffic": [
+              {
+                "latest_revision": {
+                  "constant_value": true
+                },
+                "percent": {
+                  "constant_value": 100
+                }
+              }
+            ]
+          },
+          "schema_version": 1
+        },
+        {
+          "address": "google_cloud_run_service_iam_binding.binding",
+          "mode": "managed",
+          "type": "google_cloud_run_service_iam_binding",
+          "name": "binding",
+          "provider_config_key": "google",
+          "expressions": {
+            "location": {
+              "references": [
+                "google_cloud_run_service.default.location",
+                "google_cloud_run_service.default"
+              ]
+            },
+            "members": {
+              "constant_value": [
+                "user:jane@example.com"
+              ]
+            },
+            "project": {
+              "references": [
+                "google_cloud_run_service.default.project",
+                "google_cloud_run_service.default"
+              ]
+            },
+            "role": {
+              "constant_value": "roles/viewer"
+            },
+            "service": {
+              "references": [
+                "google_cloud_run_service.default.name",
+                "google_cloud_run_service.default"
+              ]
+            }
+          },
+          "schema_version": 0
+        }
+      ]
+    }
+  }
+}
diff --git a/testdata/templates/example_cloud_run_service_iam_member.json b/testdata/templates/example_cloud_run_service_iam_member.json
new file mode 100644
index 00000000..3e780646
--- /dev/null
+++ b/testdata/templates/example_cloud_run_service_iam_member.json
@@ -0,0 +1,52 @@
+[
+  {
+    "name": "//run.googleapis.com/cloudrun-srv",
+    "asset_type": "run.googleapis.com/Service",
+    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
+    "iam_policy": {
+      "bindings": [
+        {
+          "role": "roles/viewer",
+          "members": [
+            "user:jane@example.com"
+          ]
+        }
+      ]
+    }
+  },
+  {
+    "name": "//run.googleapis.com/projects/{{.Provider.project}}/locations/us-central1/services/cloudrun-srv",
+    "asset_type": "run.googleapis.com/Service",
+    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
+    "resource": {
+      "version": "v1",
+      "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/run/v1/rest",
+      "discovery_name": "Service",
+      "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
+      "data": {
+        "apiVersion": "serving.knative.dev/v1",
+        "kind": "Service",
+        "metadata": {
+          "name": "cloudrun-srv"
+        },
+        "spec": {
+          "template": {
+            "spec": {
+              "containers": [
+                {
+                  "image": "us-docker.pkg.dev/cloudrun/container/hello"
+                }
+              ]
+            }
+          },
+          "traffic": [
+            {
+              "latestRevision": true,
+              "percent": 100
+            }
+          ]
+        }
+      }
+    }
+  }
+]
diff --git a/testdata/templates/example_cloud_run_service_iam_member.tf b/testdata/templates/example_cloud_run_service_iam_member.tf
new file mode 100644
index 00000000..858c67c7
--- /dev/null
+++ b/testdata/templates/example_cloud_run_service_iam_member.tf
@@ -0,0 +1,54 @@
+/**
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+terraform {
+  required_providers {
+    google = {
+      source = "hashicorp/google"
+      version = "~> {{.Provider.version}}"
+    }
+  }
+}
+
+provider "google" {
+  {{if .Provider.credentials }}credentials = "{{.Provider.credentials}}"{{end}}
+}
+
+resource "google_cloud_run_service" "default" {
+  name     = "cloudrun-srv"
+  location = "us-central1"
+
+  template {
+    spec {
+      containers {
+        image = "us-docker.pkg.dev/cloudrun/container/hello"
+      }
+    }
+  }
+
+  traffic {
+    percent         = 100
+    latest_revision = true
+  }
+}
+
+resource "google_cloud_run_service_iam_member" "member" {
+  location = google_cloud_run_service.default.location
+  project = google_cloud_run_service.default.project
+  service = google_cloud_run_service.default.name
+  role = "roles/viewer"
+  member = "user:jane@example.com"
+}
diff --git a/testdata/templates/example_cloud_run_service_iam_member.tfplan.json b/testdata/templates/example_cloud_run_service_iam_member.tfplan.json
new file mode 100644
index 00000000..ac3b905f
--- /dev/null
+++ b/testdata/templates/example_cloud_run_service_iam_member.tfplan.json
@@ -0,0 +1,314 @@
+{
+  "format_version": "0.2",
+  "terraform_version": "1.0.10",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_cloud_run_service.default",
+          "mode": "managed",
+          "type": "google_cloud_run_service",
+          "name": "default",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 1,
+          "values": {
+            "autogenerate_revision_name": false,
+            "location": "us-central1",
+            "name": "cloudrun-srv",
+            "template": [
+              {
+                "spec": [
+                  {
+                    "containers": [
+                      {
+                        "args": null,
+                        "command": null,
+                        "env": [],
+                        "env_from": [],
+                        "image": "us-docker.pkg.dev/cloudrun/container/hello",
+                        "volume_mounts": [],
+                        "working_dir": null
+                      }
+                    ],
+                    "service_account_name": null,
+                    "volumes": []
+                  }
+                ]
+              }
+            ],
+            "timeouts": null,
+            "traffic": [
+              {
+                "latest_revision": true,
+                "percent": 100,
+                "revision_name": null
+              }
+            ]
+          },
+          "sensitive_values": {
+            "metadata": [],
+            "status": [],
+            "template": [
+              {
+                "metadata": [],
+                "spec": [
+                  {
+                    "containers": [
+                      {
+                        "env": [],
+                        "env_from": [],
+                        "ports": [],
+                        "resources": [],
+                        "volume_mounts": []
+                      }
+                    ],
+                    "volumes": []
+                  }
+                ]
+              }
+            ],
+            "traffic": [
+              {}
+            ]
+          }
+        },
+        {
+          "address": "google_cloud_run_service_iam_member.member",
+          "mode": "managed",
+          "type": "google_cloud_run_service_iam_member",
+          "name": "member",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 0,
+          "values": {
+            "condition": [],
+            "location": "us-central1",
+            "member": "user:jane@example.com",
+            "role": "roles/viewer",
+            "service": "cloudrun-srv"
+          },
+          "sensitive_values": {
+            "condition": []
+          }
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_cloud_run_service.default",
+      "mode": "managed",
+      "type": "google_cloud_run_service",
+      "name": "default",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "autogenerate_revision_name": false,
+          "location": "us-central1",
+          "name": "cloudrun-srv",
+          "template": [
+            {
+              "spec": [
+                {
+                  "containers": [
+                    {
+                      "args": null,
+                      "command": null,
+                      "env": [],
+                      "env_from": [],
+                      "image": "us-docker.pkg.dev/cloudrun/container/hello",
+                      "volume_mounts": [],
+                      "working_dir": null
+                    }
+                  ],
+                  "service_account_name": null,
+                  "volumes": []
+                }
+              ]
+            }
+          ],
+          "timeouts": null,
+          "traffic": [
+            {
+              "latest_revision": true,
+              "percent": 100,
+              "revision_name": null
+            }
+          ]
+        },
+        "after_unknown": {
+          "id": true,
+          "metadata": true,
+          "project": true,
+          "status": true,
+          "template": [
+            {
+              "metadata": true,
+              "spec": [
+                {
+                  "container_concurrency": true,
+                  "containers": [
+                    {
+                      "env": [],
+                      "env_from": [],
+                      "ports": true,
+                      "resources": true,
+                      "volume_mounts": []
+                    }
+                  ],
+                  "serving_state": true,
+                  "timeout_seconds": true,
+                  "volumes": []
+                }
+              ]
+            }
+          ],
+          "traffic": [
+            {}
+          ]
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "metadata": [],
+          "status": [],
+          "template": [
+            {
+              "metadata": [],
+              "spec": [
+                {
+                  "containers": [
+                    {
+                      "env": [],
+                      "env_from": [],
+                      "ports": [],
+                      "resources": [],
+                      "volume_mounts": []
+                    }
+                  ],
+                  "volumes": []
+                }
+              ]
+            }
+          ],
+          "traffic": [
+            {}
+          ]
+        }
+      }
+    },
+    {
+      "address": "google_cloud_run_service_iam_member.member",
+      "mode": "managed",
+      "type": "google_cloud_run_service_iam_member",
+      "name": "member",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "condition": [],
+          "location": "us-central1",
+          "member": "user:jane@example.com",
+          "role": "roles/viewer",
+          "service": "cloudrun-srv"
+        },
+        "after_unknown": {
+          "condition": [],
+          "etag": true,
+          "id": true,
+          "project": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "condition": []
+        }
+      }
+    }
+  ],
+  "configuration": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_cloud_run_service.default",
+          "mode": "managed",
+          "type": "google_cloud_run_service",
+          "name": "default",
+          "provider_config_key": "google",
+          "expressions": {
+            "location": {
+              "constant_value": "us-central1"
+            },
+            "name": {
+              "constant_value": "cloudrun-srv"
+            },
+            "template": [
+              {
+                "spec": [
+                  {
+                    "containers": [
+                      {
+                        "image": {
+                          "constant_value": "us-docker.pkg.dev/cloudrun/container/hello"
+                        }
+                      }
+                    ]
+                  }
+                ]
+              }
+            ],
+            "traffic": [
+              {
+                "latest_revision": {
+                  "constant_value": true
+                },
+                "percent": {
+                  "constant_value": 100
+                }
+              }
+            ]
+          },
+          "schema_version": 1
+        },
+        {
+          "address": "google_cloud_run_service_iam_member.member",
+          "mode": "managed",
+          "type": "google_cloud_run_service_iam_member",
+          "name": "member",
+          "provider_config_key": "google",
+          "expressions": {
+            "location": {
+              "references": [
+                "google_cloud_run_service.default.location",
+                "google_cloud_run_service.default"
+              ]
+            },
+            "member": {
+              "constant_value": "user:jane@example.com"
+            },
+            "project": {
+              "references": [
+                "google_cloud_run_service.default.project",
+                "google_cloud_run_service.default"
+              ]
+            },
+            "role": {
+              "constant_value": "roles/viewer"
+            },
+            "service": {
+              "references": [
+                "google_cloud_run_service.default.name",
+                "google_cloud_run_service.default"
+              ]
+            }
+          },
+          "schema_version": 0
+        }
+      ]
+    }
+  }
+}
diff --git a/testdata/templates/example_cloud_run_service_iam_policy.json b/testdata/templates/example_cloud_run_service_iam_policy.json
new file mode 100644
index 00000000..5ef9005e
--- /dev/null
+++ b/testdata/templates/example_cloud_run_service_iam_policy.json
@@ -0,0 +1,52 @@
+[
+  {
+    "name": "//run.googleapis.com/cloudrun-srv",
+    "asset_type": "run.googleapis.com/Service",
+    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
+    "iam_policy": {
+      "bindings": [
+        {
+          "role": "roles/editor",
+          "members": [
+            "user:jane@example.com"
+          ]
+        }
+      ]
+    }
+  },
+  {
+    "name": "//run.googleapis.com/projects/{{.Provider.project}}/locations/us-central1/services/cloudrun-srv",
+    "asset_type": "run.googleapis.com/Service",
+    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
+    "resource": {
+      "version": "v1",
+      "discovery_document_uri": "https://www.googleapis.com/discovery/v1/apis/run/v1/rest",
+      "discovery_name": "Service",
+      "parent": "//cloudresourcemanager.googleapis.com/projects/{{.Provider.project}}",
+      "data": {
+        "apiVersion": "serving.knative.dev/v1",
+        "kind": "Service",
+        "metadata": {
+          "name": "cloudrun-srv"
+        },
+        "spec": {
+          "template": {
+            "spec": {
+              "containers": [
+                {
+                  "image": "us-docker.pkg.dev/cloudrun/container/hello"
+                }
+              ]
+            }
+          },
+          "traffic": [
+            {
+              "latestRevision": true,
+              "percent": 100
+            }
+          ]
+        }
+      }
+    }
+  }
+]
diff --git a/testdata/templates/example_cloud_run_service_iam_policy.tf b/testdata/templates/example_cloud_run_service_iam_policy.tf
new file mode 100644
index 00000000..0e64eeb0
--- /dev/null
+++ b/testdata/templates/example_cloud_run_service_iam_policy.tf
@@ -0,0 +1,64 @@
+/**
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+terraform {
+  required_providers {
+    google = {
+      source = "hashicorp/google"
+      version = "~> {{.Provider.version}}"
+    }
+  }
+}
+
+provider "google" {
+  {{if .Provider.credentials }}credentials = "{{.Provider.credentials}}"{{end}}
+}
+
+resource "google_cloud_run_service" "default" {
+  name     = "cloudrun-srv"
+  location = "us-central1"
+
+  template {
+    spec {
+      containers {
+        image = "us-docker.pkg.dev/cloudrun/container/hello"
+      }
+    }
+  }
+
+  traffic {
+    percent         = 100
+    latest_revision = true
+  }
+}
+
+resource "google_cloud_run_service_iam_policy" "policy" {
+  location = google_cloud_run_service.default.location
+  project = google_cloud_run_service.default.project
+  service = google_cloud_run_service.default.name
+  policy_data = jsonencode(
+    {
+      bindings = [
+        {
+          members = [
+            "user:jane@example.com",
+          ]
+          role = "roles/editor"
+        }
+      ]
+    }
+  )
+}
diff --git a/testdata/templates/example_cloud_run_service_iam_policy.tfplan.json b/testdata/templates/example_cloud_run_service_iam_policy.tfplan.json
new file mode 100644
index 00000000..5d8ba47a
--- /dev/null
+++ b/testdata/templates/example_cloud_run_service_iam_policy.tfplan.json
@@ -0,0 +1,300 @@
+{
+  "format_version": "0.2",
+  "terraform_version": "1.0.10",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_cloud_run_service.default",
+          "mode": "managed",
+          "type": "google_cloud_run_service",
+          "name": "default",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 1,
+          "values": {
+            "autogenerate_revision_name": false,
+            "location": "us-central1",
+            "name": "cloudrun-srv",
+            "template": [
+              {
+                "spec": [
+                  {
+                    "containers": [
+                      {
+                        "args": null,
+                        "command": null,
+                        "env": [],
+                        "env_from": [],
+                        "image": "us-docker.pkg.dev/cloudrun/container/hello",
+                        "volume_mounts": [],
+                        "working_dir": null
+                      }
+                    ],
+                    "service_account_name": null,
+                    "volumes": []
+                  }
+                ]
+              }
+            ],
+            "timeouts": null,
+            "traffic": [
+              {
+                "latest_revision": true,
+                "percent": 100,
+                "revision_name": null
+              }
+            ]
+          },
+          "sensitive_values": {
+            "metadata": [],
+            "status": [],
+            "template": [
+              {
+                "metadata": [],
+                "spec": [
+                  {
+                    "containers": [
+                      {
+                        "env": [],
+                        "env_from": [],
+                        "ports": [],
+                        "resources": [],
+                        "volume_mounts": []
+                      }
+                    ],
+                    "volumes": []
+                  }
+                ]
+              }
+            ],
+            "traffic": [
+              {}
+            ]
+          }
+        },
+        {
+          "address": "google_cloud_run_service_iam_policy.policy",
+          "mode": "managed",
+          "type": "google_cloud_run_service_iam_policy",
+          "name": "policy",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 0,
+          "values": {
+            "location": "us-central1",
+            "policy_data": "{\"bindings\":[{\"members\":[\"user:jane@example.com\"],\"role\":\"roles/editor\"}]}",
+            "service": "cloudrun-srv"
+          },
+          "sensitive_values": {}
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_cloud_run_service.default",
+      "mode": "managed",
+      "type": "google_cloud_run_service",
+      "name": "default",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "autogenerate_revision_name": false,
+          "location": "us-central1",
+          "name": "cloudrun-srv",
+          "template": [
+            {
+              "spec": [
+                {
+                  "containers": [
+                    {
+                      "args": null,
+                      "command": null,
+                      "env": [],
+                      "env_from": [],
+                      "image": "us-docker.pkg.dev/cloudrun/container/hello",
+                      "volume_mounts": [],
+                      "working_dir": null
+                    }
+                  ],
+                  "service_account_name": null,
+                  "volumes": []
+                }
+              ]
+            }
+          ],
+          "timeouts": null,
+          "traffic": [
+            {
+              "latest_revision": true,
+              "percent": 100,
+              "revision_name": null
+            }
+          ]
+        },
+        "after_unknown": {
+          "id": true,
+          "metadata": true,
+          "project": true,
+          "status": true,
+          "template": [
+            {
+              "metadata": true,
+              "spec": [
+                {
+                  "container_concurrency": true,
+                  "containers": [
+                    {
+                      "env": [],
+                      "env_from": [],
+                      "ports": true,
+                      "resources": true,
+                      "volume_mounts": []
+                    }
+                  ],
+                  "serving_state": true,
+                  "timeout_seconds": true,
+                  "volumes": []
+                }
+              ]
+            }
+          ],
+          "traffic": [
+            {}
+          ]
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "metadata": [],
+          "status": [],
+          "template": [
+            {
+              "metadata": [],
+              "spec": [
+                {
+                  "containers": [
+                    {
+                      "env": [],
+                      "env_from": [],
+                      "ports": [],
+                      "resources": [],
+                      "volume_mounts": []
+                    }
+                  ],
+                  "volumes": []
+                }
+              ]
+            }
+          ],
+          "traffic": [
+            {}
+          ]
+        }
+      }
+    },
+    {
+      "address": "google_cloud_run_service_iam_policy.policy",
+      "mode": "managed",
+      "type": "google_cloud_run_service_iam_policy",
+      "name": "policy",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "location": "us-central1",
+          "policy_data": "{\"bindings\":[{\"members\":[\"user:jane@example.com\"],\"role\":\"roles/editor\"}]}",
+          "service": "cloudrun-srv"
+        },
+        "after_unknown": {
+          "etag": true,
+          "id": true,
+          "project": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {}
+      }
+    }
+  ],
+  "configuration": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_cloud_run_service.default",
+          "mode": "managed",
+          "type": "google_cloud_run_service",
+          "name": "default",
+          "provider_config_key": "google",
+          "expressions": {
+            "location": {
+              "constant_value": "us-central1"
+            },
+            "name": {
+              "constant_value": "cloudrun-srv"
+            },
+            "template": [
+              {
+                "spec": [
+                  {
+                    "containers": [
+                      {
+                        "image": {
+                          "constant_value": "us-docker.pkg.dev/cloudrun/container/hello"
+                        }
+                      }
+                    ]
+                  }
+                ]
+              }
+            ],
+            "traffic": [
+              {
+                "latest_revision": {
+                  "constant_value": true
+                },
+                "percent": {
+                  "constant_value": 100
+                }
+              }
+            ]
+          },
+          "schema_version": 1
+        },
+        {
+          "address": "google_cloud_run_service_iam_policy.policy",
+          "mode": "managed",
+          "type": "google_cloud_run_service_iam_policy",
+          "name": "policy",
+          "provider_config_key": "google",
+          "expressions": {
+            "location": {
+              "references": [
+                "google_cloud_run_service.default.location",
+                "google_cloud_run_service.default"
+              ]
+            },
+            "policy_data": {},
+            "project": {
+              "references": [
+                "google_cloud_run_service.default.project",
+                "google_cloud_run_service.default"
+              ]
+            },
+            "service": {
+              "references": [
+                "google_cloud_run_service.default.name",
+                "google_cloud_run_service.default"
+              ]
+            }
+          },
+          "schema_version": 0
+        }
+      ]
+    }
+  }
+}