hi all, I was trying to create IAP brand and client, strangely, the first attempt creating the brand actually throws an error saying the Support Email was invalid; on running pulumi up again, it then shows the entity has already exists with unconfiguredapp@google.com as the support Email. I retrieve the brand details using gcloud CLI and hard code it in my code and tried to create an IAP client using the brand ID, it shows the following error:

error: 1 error occurred:
        * Error creating Client: googleapi: Error 400: Precondition check failed.

I was running pulumi on my local, did I miss anything?

I’m also trying to use pulumi to set up IAP the error you encountered is probably because your brand is set up as public https://cloud.google.com/iap/docs/programmatic-oauth-clients#branding you cannot use the api to create an oauth client if your brand is public for me changing the brand to internal solve this issue