Hi, how can I assign a role to a gcp service account? I tried the below but it fails with

gcp:serviceAccount:IAMMember (log-writer-iam):
  error: 1 error occurred:
        * Error applying IAM policy for service account 'projects/secret-stash-stadium/serviceAccounts/web-sa@secret-stash-stadium.iam.gserviceaccount.com': Error setting IAM policy for service account 'projects/secret-stash-stadium/serviceAccounts/web-sa@secret-stash-stadium.iam.gserviceaccount.com': googleapi: Error 400: Invalid service account (<pulumi.output.output object at 0x10c8f3310>)., badRequest

What am I doing wrong?

sa = serviceaccount.Account(
        resource_name="sa",
        account_id="web-sa",
    )

    log_writer_iam = serviceaccount.IAMMember(
        resource_name="log-writer-iam",
        member=f"serviceAccount:{sa.email}",
        role="roles/logging.logWriter",
        service_account_id=sa.name,
    )

hey ya, try this

sa = serviceaccount.Account(
    resource_name="sa",
    account_id="web-sa",
)
log_writer_iam = serviceaccount.IAMMember(
    resource_name="log-writer-iam",
    member=sa.email.apply(lambda email: f"serviceAccount:{email}"),
    role="roles/logging.logWriter",
    service_account_id=sa.name,
)

Thanks for the reply! Nope, same error.

ah, im only just starting to get my head round accessing outputs myself. I was part this post via someone at pulumi yesterday which was useful https://www.leebriggs.co.uk/blog/2021/05/09/pulumi-apply.html

It's probably the f string thing, try pulumi.Output.concat('serviceAccount:', sa.email)

none of this works, tried fstring, tried apply, tried concat