That is not a problem with Pulumi or Terraform docs. It is how Google IAM API work. It is tricky and dangerous. And their docs are quite confusing