I am raising two sets of stacks, one

green

, and one

blue

. We are seeing the appropriate resources after up

green

, but after up

blue

, we see that the IAM bindings disappear from

green

and disabling those identities because they lose their permissions. The resources are named uniquely, have different urns, and of course different stack names. What am I missing here? How would pulumi or the gcp libs decide to take away from one when creating another?

@important-leather-28796 are you saying here that you’re doing

pulumi stack init

to create an entirely new stack, then provisioning those resources is deleting the blue stack?

Two stacks, both inited. up one, good. up the other, IAM bindings disappear from the first.

@important-leather-28796 this is expected behaviour for the

gcp.projects.IAMBinding

resource, from the docs: https://www.pulumi.com/registry/packages/gcp/api-docs/projects/iambinding/

Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the project are preserved.

I think you want

IamMember

both stacks continue to exist, and pulumi reports all good, and no canges

i think this is an idiosyncrasy of the gcloud API. Ie, you use an IAM binding, add another IAM binding resource and it removes all previous resources. I bet if you look in your blue stack the resource still exists but the backend GCP has removed it

That’s got to be it

I’d suggest remove reference to iambinding and I think you’ll need to use iamMember, but I gcp is my least used cloud. I have to drop, but please update me on the fix

I’ll change and confirm right now. Thank you