### Execute Interactive Kitchen-Terraform Commands

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/CONTRIBUTING.md

Commands to be run inside the interactive Docker container to manage the lifecycle of example modules during testing.

```bash
kitchen_do create <EXAMPLE_NAME>
kitchen_do converge <EXAMPLE_NAME>
kitchen_do verify <EXAMPLE_NAME>
kitchen_do destroy <EXAMPLE_NAME>
```

--------------------------------

### Execute Module Testing and Documentation Commands

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/CONTRIBUTING.md

Common Makefile commands used to prepare the test environment, execute integration tests, and automatically generate documentation from Terraform files.

```makefile
make docker_test_prepare
make docker_test_integration
make docker_run
make generate_docs
```

--------------------------------

### Configure Test Environment Variables

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/CONTRIBUTING.md

Sets the necessary environment variables and service account credentials required to run integration tests for the Terraform module.

```bash
export SERVICE_ACCOUNT_JSON=$(< credentials.json)
export TF_VAR_org_id="your_org_id"
export TF_VAR_folder_id="your_folder_id"
export TF_VAR_billing_account="your_billing_account_id"
```

--------------------------------

### Manage Project IAM Bindings with Terraform

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/README.md

This example demonstrates how to use the `projects_iam` submodule to manage IAM role bindings for multiple projects. It allows specifying roles and the members associated with them. The default mode is 'additive'.

```hcl
module "projects_iam_bindings" {
  source  = "terraform-google-modules/iam/google//modules/projects_iam"
  version = "~> 8.2"

  projects = ["project-123456", "project-9876543"]

  bindings = {
    "roles/storage.admin" = [
      "group:test_sa_group@lnescidev.com",
      "user:someone@google.com",
    ]

    "roles/compute.networkAdmin" = [
      "group:test_sa_group@lnescidev.com",
      "user:someone@google.com",
    ]

    "roles/compute.imageUser" = [
      "user:someone@google.com",
    ]
  }
}
```

--------------------------------

### Upgrade IAM Module with Dynamic Resource Bindings and Count (Terraform)

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/docs/upgrading_to_iam_3.0.md

This example demonstrates upgrading the IAM module to version 3.0 with dynamic project IDs and using `projects_num` and `projects_bindings_num` for static counts. It also shows the initialization of various resource-specific binding variables.

```terraform
module "project_factory" {
  source  = "terraform-google-modules/project-factory/google"
  version = "~> 3.2"

  billing_account = "a-billing-account"
  name            = "iam-test"
  org_id          = "an-org"

  random_project_id = true
}

module "iam" {
  source  = "terraform-google-modules/iam/google"
  version = "~> 3.0"

  projects = [module.project_factory.project_id]

  projects_num = 1

  projects_bindings = {
    "roles/storage.admin" = [
      "serviceAccount:${module.project_factory.service_account_email}",
    ]
  }

  projects_bindings_num = 1

  pubsub_topics_bindings = {}
  pubsub_subscriptions_bindings = {}
  storage_buckets_bindings = {}
  subnets_bindings = {}
  subnets_region = ""
  organizations_bindings = {}
  kms_crypto_keys_bindings = {}
  kms_key_rings_bindings = {}
  service_accounts_bindings = {}
  folders_bindings = {}
}
```

--------------------------------

### IAM 3.0 Dynamic Configuration Example

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/docs/upgrading_to_iam_4.0.md

This HCL code snippet demonstrates a dynamic configuration in Terraform Google IAM version 3.0, applying IAM bindings to multiple projects. It utilizes 'count' for dynamic resource creation, which could lead to inconsistent behavior and race conditions during updates.

```hcl
module "project_factory_0" {
  source  = "terraform-google-modules/project-factory/google"
  version = "~> 3.2"

  billing_account = "a-billing-account"
  name            = "iam-test-0"
  org_id          = "an-org"

  random_project_id = true
}

module "project_factory_1" {
  source  = "terraform-google-modules/project-factory/google"
  version = "~> 3.2"

  billing_account = "a-billing-account"
  name            = "iam-test-1"
  org_id          = "an-org"

  random_project_id = true
}

module "iam" {
  source  = "terraform-google-modules/iam/google//modules/projects_iam"
  version = "~> 3.0"

  projects = [module.project_factory_0.project_id, module.project_factory_1.project_id]
  projects_num = 2

  bindings = {
    "roles/storage.admin" = [
      "serviceAccount:${module.project_factory_0.service_account_email}",
      "serviceAccount:${module.project_factory_1.service_account_email}"
    ]
  }
  bindings_num = 2
}
```

--------------------------------

### Terraform IAM 2.0 Static vs Dynamic Binding Configuration

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/docs/upgrading_to_iam_3.0.md

Comparison of Terraform configurations for the Google IAM module. The first example demonstrates a working configuration with static project IDs, while the second illustrates a failure scenario when using dynamic module outputs as project IDs in version 2.0.

```hcl
# This does work with IAM 2.0

module "iam" {
  source  = "terraform-google-modules/iam/google"
  version = "~> 2.0"

  projects = ["project-123456"]

  bindings = {
    "roles/storage.admin" = [
      "serviceAccount:a-service-account@cft.tips",
    ]
  }
}
```

```hcl
# This does not work with IAM 2.0

module "project_factory" {
  source  = "terraform-google-modules/project-factory/google"
  version = "~> 3.2"

  billing_account = "a-billing-account"
  name            = "iam-test"
  org_id          = "an-org"

  random_project_id = true
}

module "iam" {
  source  = "terraform-google-modules/iam/google"
  version = "~> 2.0"

  projects = [module.project_factory.project_id]

  bindings = {
    "roles/storage.admin" = [
      "serviceAccount:${module.project_factory.service_account_email}",
    ]
  }
}
```

--------------------------------

### Manage Project IAM Bindings with Terraform

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Configures IAM roles for multiple GCP projects using the projects_iam module. It supports both additive and authoritative modes and includes examples of conditional IAM bindings.

```hcl
module "projects_iam_bindings" {
  source  = "terraform-google-modules/iam/google//modules/projects_iam"
  version = "~> 8.2"

  projects = ["project-123456", "project-9876543"]
  mode     = "additive"

  bindings = {
    "roles/storage.admin" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:dev-team@example.com",
      "user:admin@example.com",
    ]

    "roles/compute.networkAdmin" = [
      "group:network-team@example.com",
      "user:network-admin@example.com",
    ]

    "roles/compute.imageUser" = [
      "user:developer@example.com",
    ]
  }

  conditional_bindings = [
    {
      role        = "roles/editor"
      title       = "expires_after_2024_12_31"
      description = "Temporary editor access expiring at end of 2024"
      expression  = "request.time < timestamp(\"2025-01-01T00:00:00Z\")"
      members     = ["user:contractor@example.com"]
    }
  ]
}
```

--------------------------------

### Upgrade IAM Module with Dynamic Bindings and Count Variables (Terraform)

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/docs/upgrading_to_iam_3.0.md

This example illustrates upgrading the IAM module to version 3.0 while incorporating dynamic project IDs and service account emails. It highlights the use of `projects_num` and `bindings_num` to manage counts for dynamic content.

```terraform
module "project_factory" {
  source  = "terraform-google-modules/project-factory/google"
  version = "~> 3.2"

  billing_account = "a-billing-account"
  name            = "iam-test"
  org_id          = "an-org"

  random_project_id = true
}

module "iam" {
  source  = "terraform-google-modules/iam/google//modules/projects_iam"
  version = "~> 3.0"

  projects = [module.project_factory.project_id]

  projects_num = 1

  bindings = {
    "roles/storage.admin" = [
      "serviceAccount:${module.project_factory.service_account_email}",
    ]
  }

  bindings_num = 1
}
```

--------------------------------

### Configure Organization IAM Bindings with Terraform

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/modules/organizations_iam/README.md

This snippet demonstrates how to instantiate the organization IAM module. It defines bindings for specific roles and includes an example of a conditional IAM binding with an expiration expression.

```hcl
module "organization-iam-bindings" {
  source   = "terraform-google-modules/iam/google//modules/organizations_iam"
  version  = "~> 8.0"

  organizations = ["my-organization_one", "my-organization_two"]
  mode          = "authoritative"

  bindings = {
    "roles/resourcemanager.organizationViewer" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
    "roles/resourcemanager.projectDeleter" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
  }
  conditional_bindings = [
    {
      role = "roles/editor"
      title = "expires_after_2019_12_31"
      description = "Expiring at midnight of 2019-12-31"
      expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")"
      members = ["user:my-user@my-org.com"]
    }
  ]
}
```

--------------------------------

### Manage Storage Bucket IAM Bindings in Authoritative Mode with Terraform

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/README.md

This example shows how to manage IAM role bindings for a storage bucket using the `storage_buckets_iam` submodule in 'authoritative' mode. This mode ensures that only the roles and members defined in the module are applied, removing any others. It's useful for strict access control.

```hcl
module "storage_buckets_iam_bindings" {
  source  = "terraform-google-modules/iam/google//modules/storage_buckets_iam"
  version = "~> 8.0"

  storage_buckets = ["my-storage-bucket"]

  mode = "authoritative"

  bindings = {
    "roles/storage.legacyBucketReader" = [
      "user:josemanuelt@google.com",
      "group:test_sa_group@lnescidev.com",
    ]

    "roles/storage.legacyBucketWriter" = [
      "user:josemanuelt@google.com",
      "group:test_sa_group@lnescidev.com",
    ]
  }
}
```

--------------------------------

### Assign KMS Key Ring IAM Roles with Terraform

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/modules/kms_key_rings_iam/README.md

This example demonstrates how to assign IAM roles to KMS Key Rings using the terraform-google-modules/iam/google//modules/kms_key_rings_iam module. It configures additive mode and specifies bindings for cryptoKeyEncrypter and cryptoKeyDecrypter roles, as well as a conditional binding for the admin role.

```terraform
module "kms_key_ring-iam-bindings" {
  source   = "terraform-google-modules/iam/google//modules/kms_key_rings_iam"
  version  = "~> 8.0"

  kms_key_rings = ["my-kms_key_ring_one", "my-kms_key_ring_two"]
  mode          = "additive"

  bindings = {
    "roles/cloudkms.cryptoKeyEncrypter" = [
      "user:my-user@my-org.com",
      "group:my-group@my-org.com",
    ]
    "roles/cloudkms.cryptoKeyDecrypter" = [
      "user:my-user@my-org.com",
      "group:my-group@my-org.com",
    ]
  }
  conditional_bindings = [
    {
      role = "roles/cloudkms.admin"
      title = "expires_after_2019_12_31"
      description = "Expiring at midnight of 2019-12-31"
      expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")"
      members = ["user:my-user@my-org.com"]
    }
  ]
}
```

--------------------------------

### Manage Organization IAM Bindings with Terraform

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Configures IAM roles at the organization level using the organizations_iam module. This setup is typically used for organization-wide policies and authoritative access control.

```hcl
module "organization_iam_bindings" {
  source  = "terraform-google-modules/iam/google//modules/organizations_iam"
  version = "~> 8.2"

  organizations = ["123456789012"]
  mode          = "authoritative"

  bindings = {
    "roles/resourcemanager.organizationViewer" = [
      "serviceAccount:audit-sa@my-project.iam.gserviceaccount.com",
      "group:security-team@example.com",
    ]

    "roles/resourcemanager.projectDeleter" = [
      "group:platform-admins@example.com",
    ]
  }

  conditional_bindings = [
    {
      role        = "roles/resourcemanager.organizationAdmin"
      title       = "emergency_access"
      description = "Break-glass emergency admin access"
      expression  = "request.time < timestamp(\"2024-12-31T23:59:59Z\")"
      members     = ["user:oncall-admin@example.com"]
    }
  ]
}
```

--------------------------------

### Configure Folder IAM Bindings with Terraform

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/modules/folders_iam/README.md

This snippet demonstrates how to instantiate the folder IAM module. It defines standard role bindings for service accounts, groups, and users, as well as conditional bindings with time-based constraints.

```hcl
module "folder-iam" {
  source  = "terraform-google-modules/iam/google//modules/folders_iam"
  version = "~> 8.2"

  folders = ["my-folder-name"]

  mode = "additive"

  bindings = {
    "roles/resourcemanager.folderEditor" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
    ]

    "roles/resourcemanager.folderViewer" = [
      "user:my-user@my-org.com",
    ]
  }

  conditional_bindings = [
    {
      role = "roles/editor"
      title = "expires_after_2019_12_31"
      description = "Expiring at midnight of 2019-12-31"
      expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")"
      members = ["user:my-user@my-org.com"]
    }
  ]
}
```

--------------------------------

### Manage Artifact Registry IAM Bindings

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Configures additive IAM bindings for Artifact Registry repositories. Controls access for CI/CD pipelines and developer teams.

```hcl
module "artifact_registry_iam_bindings" {
  source  = "terraform-google-modules/iam/google//modules/artifact_registry_iam"
  version = "~> 8.2"

  project      = "my-project"
  repositories = ["docker-repo", "npm-repo"]
  location     = "us-central1"
  mode         = "additive"

  bindings = {
    "roles/artifactregistry.reader" = [
      "serviceAccount:ci-cd-sa@my-project.iam.gserviceaccount.com",
      "group:developers@example.com",
    ]

    "roles/artifactregistry.writer" = [
      "serviceAccount:build-sa@my-project.iam.gserviceaccount.com",
    ]

    "roles/artifactregistry.admin" = [
      "group:devops-team@example.com",
    ]
  }
}
```

--------------------------------

### Configure KMS Crypto Keys IAM Bindings

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Provides fine-grained IAM control for specific Cloud KMS crypto keys. Supports both authoritative mode for strict policy enforcement and conditional access bindings.

```hcl
module "kms_crypto_key_iam_bindings" {
  source  = "terraform-google-modules/iam/google//modules/kms_crypto_keys_iam"
  version = "~> 8.2"

  kms_crypto_keys = [
    "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/app-key",
    "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/data-key",
  ]
  mode = "authoritative"

  bindings = {
    "roles/cloudkms.cryptoKeyEncrypter" = [
      "serviceAccount:app-sa@my-project.iam.gserviceaccount.com",
    ]

    "roles/cloudkms.cryptoKeyDecrypter" = [
      "serviceAccount:app-sa@my-project.iam.gserviceaccount.com",
    ]

    "roles/cloudkms.cryptoKeyEncrypterDecrypter" = [
      "group:data-team@example.com",
    ]
  }

  conditional_bindings = [
    {
      role        = "roles/cloudkms.admin"
      title       = "temp_key_admin"
      description = "Temporary key admin access"
      expression  = "request.time < timestamp(\"2024-03-15T00:00:00Z\")"
      members     = ["user:security-engineer@example.com"]
    }
  ]
}
```

--------------------------------

### Manage BigQuery Datasets IAM Bindings

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Configures additive IAM bindings for specific BigQuery datasets. It requires the project ID and a map of roles to member lists.

```hcl
module "bigquery_dataset_iam_bindings" {
  source  = "terraform-google-modules/iam/google//modules/bigquery_datasets_iam"
  version = "~> 8.2"

  project           = "my-analytics-project"
  bigquery_datasets = ["analytics_dataset", "reporting_dataset"]
  mode              = "additive"

  bindings = {
    "roles/bigquery.dataViewer" = [
      "serviceAccount:analytics-sa@my-project.iam.gserviceaccount.com",
      "group:data-analysts@example.com",
      "user:analyst@example.com",
    ]

    "roles/bigquery.dataEditor" = [
      "serviceAccount:etl-sa@my-project.iam.gserviceaccount.com",
      "group:data-engineers@example.com",
    ]

    "roles/bigquery.dataOwner" = [
      "group:data-admins@example.com",
    ]
  }
}
```

--------------------------------

### Configure BigQuery Dataset IAM Bindings with Terraform

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/modules/bigquery_datasets_iam/README.md

This snippet demonstrates how to instantiate the bigquery_datasets_iam module. It requires a project ID, a list of target dataset names, and a map of roles to member identities.

```hcl
module "bigquery_dataset-iam-bindings" {
  source  = "terraform-google-modules/iam/google//modules/bigquery_datasets_iam"
  version = "~> 8.2"

  project            = "my-bigquery_dataset_project"
  bigquery_datasets  = ["my_big_query_one", "my_bigquery_dataset_two"]
  mode               = "additive"

  bindings = {
    "roles/bigquery.dataViewer" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
    "roles/bigquery.dataEditor" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
  }
}
```

--------------------------------

### Assign IAM Roles to Tag Values with Terraform

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/modules/tag_values_iam/README.md

This example demonstrates how to use the 'tag_values_iam' module to assign IAM roles to specific tag values. It configures bindings for roles like 'roles/viewer' and associates them with service accounts, groups, or users. The 'authoritative' mode ensures that only the specified members have the role.

```terraform
module "tag_keys_iam_binding" {
  source  = "terraform-google-modules/iam/google//modules/tag_values_iam"
  version = "~> 8.2"
  tag_values = [
    google_tags_tag_value.tag_value.name,
  ]
  mode = "authoritative"

  bindings = {
    "roles/viewer" = [
      "serviceAccount:${var.sa_email}",
      "group:${var.group_email}",
      "user:${var.user_email}",
    ]
  }
}
```

--------------------------------

### Configure Storage Bucket IAM Bindings with Terraform

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/modules/storage_buckets_iam/README.md

This snippet demonstrates how to instantiate the storage_buckets_iam module to apply IAM roles to multiple buckets. It includes both standard role-to-member mappings and conditional bindings with time-based expressions.

```hcl
module "storage_bucket-iam-bindings" {
  source   = "terraform-google-modules/iam/google//modules/storage_buckets_iam"
  version  = "~> 8.0"

  storage_buckets = ["my-storage_bucket_one", "my-storage_bucket_two"]
  mode            = "additive"

  bindings = {
    "roles/storage.legacyBucketReader" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
    "roles/storage.legacyBucketWriter" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
  }
  conditional_bindings = [
    {
      role = "roles/storage.admin"
      title = "expires_after_2019_12_31"
      description = "Expiring at midnight of 2019-12-31"
      expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")"
      members = ["user:my-user@my-org.com"]
    }
  ]
}
```

--------------------------------

### Configure Subnet IAM Bindings with Terraform

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/modules/subnets_iam/README.md

This snippet demonstrates how to instantiate the subnet IAM module. It defines the target project, region, subnets, and a map of roles to members, including support for conditional IAM bindings.

```hcl
module "subnet-iam-bindings" {
  source = "terraform-google-modules/iam/google//modules/subnets_iam"
  version = "~> 8.2"

  subnets        = ["my-subnet_one", "my-subnet_two"]
  subnets_region = "my-region"
  project        = "my-project"
  mode           = "authoritative"
  bindings = {
    "roles/compute.networkUser" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
    "roles/compute.networkViewer" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
  }
  conditional_bindings = [
    {
      role = "roles/compute.networkAdmin"
      title = "expires_after_2019_12_31"
      description = "Expiring at midnight of 2019-12-31"
      expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")"
      members = ["user:my-user@my-org.com"]
    }
  ]
}
```

--------------------------------

### Configure Pub/Sub Subscriptions IAM Bindings

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Manages additive IAM bindings for multiple Pub/Sub subscriptions. It assigns specific roles to service accounts and groups to control message consumption and viewing permissions.

```hcl
module "pubsub_subscription_iam_bindings" {
  source  = "terraform-google-modules/iam/google//modules/pubsub_subscriptions_iam"
  version = "~> 8.2"

  project              = "my-pubsub-project"
  pubsub_subscriptions = ["orders-subscription", "notifications-subscription"]
  mode                 = "additive"

  bindings = {
    "roles/pubsub.subscriber" = [
      "serviceAccount:consumer-sa@my-project.iam.gserviceaccount.com",
      "serviceAccount:worker-service@my-project.iam.gserviceaccount.com",
    ]

    "roles/pubsub.viewer" = [
      "group:ops-team@example.com",
    ]

    "roles/pubsub.editor" = [
      "group:pubsub-admins@example.com",
    ]
  }
}
```

--------------------------------

### Manage Pub/Sub Topic IAM Bindings with Terraform

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Configures IAM roles for Google Cloud Pub/Sub topics using the pubsub_topics_iam module. It controls permissions for publishing messages and managing topic configurations.

```hcl
module "pubsub_topic_iam_bindings" {
  source  = "terraform-google-modules/iam/google//modules/pubsub_topics_iam"
  version = "~> 8.2"

  project       = "my-pubsub-project"
  pubsub_topics = ["orders-topic", "notifications-topic"]
  mode          = "authoritative"

  bindings = {
    "roles/pubsub.publisher" = [
      "serviceAccount:publisher-sa@my-project.iam.gserviceaccount.com",
      "serviceAccount:order-service@my-project.iam.gserviceaccount.com",
    ]

    "roles/pubsub.viewer" = [
      "group:monitoring-team@example.com",
    ]

    "roles/pubsub.admin" = [
      "group:platform-team@example.com",
    ]
  }
}
```

--------------------------------

### Manage Cloud DNS Zones IAM Bindings

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Configures authoritative IAM bindings for Cloud DNS managed zones. Requires a reference to existing DNS zones and specific IAM roles.

```hcl
resource "google_dns_managed_zone" "example_zone" {
  name        = "example-zone"
  dns_name    = "example.com."
  description = "Example DNS zone"
  project     = var.project_id
}

module "dns_zones_iam_binding" {
  source  = "terraform-google-modules/iam/google//modules/dns_zones_iam"
  version = "~> 8.2"

  project = var.project_id
  managed_zones = [
    google_dns_managed_zone.example_zone.name,
  ]
  mode = "authoritative"

  bindings = {
    "roles/dns.reader" = [
      "serviceAccount:dns-reader@my-project.iam.gserviceaccount.com",
      "group:network-team@example.com",
    ]

    "roles/dns.admin" = [
      "group:dns-admins@example.com",
    ]
  }
}
```

--------------------------------

### Configure KMS Key Rings IAM Bindings

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Manages IAM bindings for Cloud KMS key rings, including support for conditional access. It allows defining roles for encryption and decryption operations across multiple key rings.

```hcl
module "kms_key_ring_iam_bindings" {
  source  = "terraform-google-modules/iam/google//modules/kms_key_rings_iam"
  version = "~> 8.2"

  kms_key_rings = [
    "projects/my-project/locations/us-central1/keyRings/my-keyring",
    "projects/my-project/locations/europe-west1/keyRings/eu-keyring",
  ]
  mode = "additive"

  bindings = {
    "roles/cloudkms.cryptoKeyEncrypter" = [
      "serviceAccount:encrypt-sa@my-project.iam.gserviceaccount.com",
      "group:encryption-users@example.com",
    ]

    "roles/cloudkms.cryptoKeyDecrypter" = [
      "serviceAccount:decrypt-sa@my-project.iam.gserviceaccount.com",
    ]
  }

  conditional_bindings = [
    {
      role        = "roles/cloudkms.admin"
      title       = "kms_admin_limited"
      description = "Limited KMS admin for key rotation"
      expression  = "request.time < timestamp(\"2024-06-30T00:00:00Z\")"
      members     = ["user:kms-admin@example.com"]
    }
  ]
}
```

--------------------------------

### Manage Cloud Run Services IAM Bindings

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Configures authoritative IAM bindings for Cloud Run services, including public access settings. Requires project, location, and service names.

```hcl
module "cloud_run_services_iam_bindings" {
  source  = "terraform-google-modules/iam/google//modules/cloud_run_services_iam"
  version = "~> 8.2"

  project            = "my-serverless-project"
  location           = "us-central1"
  cloud_run_services = ["api-service", "backend-service"]
  mode               = "authoritative"

  bindings = {
    "roles/run.invoker" = [
      "serviceAccount:api-gateway@my-project.iam.gserviceaccount.com",
      "allUsers",  # Public access
    ]

    "roles/run.admin" = [
      "group:platform-team@example.com",
    ]

    "roles/run.viewer" = [
      "group:developers@example.com",
    ]
  }
}
```

--------------------------------

### Configure Artifact Registry IAM Bindings with Terraform

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/modules/artifact_registry_iam/README.md

This snippet demonstrates how to instantiate the artifact_registry_iam module. It requires the project ID, repository names, and location, while accepting a map of roles to members for fine-grained access control.

```hcl
module "artifact-registry-repository-iam-bindings" {
  source  = "terraform-google-modules/iam/google//modules/artifact_registry_iam"
  version = "~> 8.2"

  project      = "my-project"
  repositories = ["my-project_one", "my-project_two"]
  location     = "us-central1"
  mode         = "additive"

  bindings = {
    "roles/artifactregistry.writer" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
  }
}
```

--------------------------------

### Manage Billing Accounts IAM Bindings

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Configures additive IAM bindings for GCP billing accounts. It maps specific billing roles to service accounts or groups.

```hcl
module "billing_account_iam" {
  source  = "terraform-google-modules/iam/google//modules/billing_accounts_iam"
  version = "~> 8.2"

  billing_account_ids = ["XXXXXX-XXXXXX-XXXXXX"]
  mode                = "additive"

  bindings = {
    "roles/billing.viewer" = [
      "serviceAccount:cost-sa@my-project.iam.gserviceaccount.com",
      "group:finance-team@example.com",
    ]

    "roles/billing.user" = [
      "group:project-creators@example.com",
    ]

    "roles/billing.admin" = [
      "group:billing-admins@example.com",
    ]
  }
}
```

--------------------------------

### Create Custom IAM Roles

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Creates custom IAM roles at the organization or project level. Allows defining specific permissions and base roles for granular access control.

```hcl
# Custom role at organization level
module "custom_role_org" {
  source  = "terraform-google-modules/iam/google//modules/custom_role_iam"
  version = "~> 8.2"

  target_level         = "org"
  target_id            = "123456789012"
  role_id              = "custom_security_auditor"
  title                = "Custom Security Auditor"
  description          = "Custom role for security auditing with limited permissions"
  base_roles           = ["roles/iam.securityReviewer"]
  permissions          = ["logging.logs.list", "logging.logEntries.list"]
  excluded_permissions = ["iam.serviceAccounts.setIamPolicy"]
  members              = ["user:auditor@example.com", "group:security-team@example.com"]
}
```

--------------------------------

### Configure Cloud Run Service IAM Bindings with Terraform

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/modules/cloud_run_services_iam/README.md

This snippet demonstrates how to instantiate the cloud_run_services_iam module. It requires specifying the project ID, a list of target services, and a map of roles to member identities.

```hcl
module "cloud-run-services-iam-bindings" {
  source  = "terraform-google-modules/iam/google//modules/cloud_run_services_iam"
  version = "~> 8.2"

  project            = "my_cloud_run_project"
  cloud_run_services = ["my_cloud_run_service_one", "my_cloud_run_service_two"]
  mode               = "authoritative"

  bindings = {
    "roles/run.invoker" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
    "roles/run.admin" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
  }
}
```

--------------------------------

### Manage Secure Source Manager IAM

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Controls access to Secure Source Manager instances and repositories. It allows for additive IAM bindings for specific roles such as instance accessor or manager.

```hcl
module "ssm_instance_iam_binding" {
  source  = "terraform-google-modules/iam/google//modules/secure_source_manager_iam"
  version = "~> 8.2"

  project  = var.project_id
  location = "us-central1"

  entity_ids = {
    instance_ids   = ["my-ssm-instance"]
    repository_ids = ["my-repo-1", "my-repo-2"]
  }
  mode = "additive"

  bindings = {
    "roles/securesourcemanager.instanceAccessor" = [
      "serviceAccount:ci-cd-sa@my-project.iam.gserviceaccount.com",
      "group:developers@example.com",
    ]

    "roles/securesourcemanager.instanceManager" = [
      "group:platform-team@example.com",
    ]
  }
}
```

--------------------------------

### Manage Folder IAM Bindings with Terraform

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Configures IAM roles for GCP folders using the folders_iam module. This enables hierarchical permission management across folder structures.

```hcl
module "folder_iam" {
  source  = "terraform-google-modules/iam/google//modules/folders_iam"
  version = "~> 8.2"

  folders = ["folders/123456789"]
  mode    = "additive"

  bindings = {
    "roles/resourcemanager.folderEditor" = [
      "serviceAccount:folder-admin@my-project.iam.gserviceaccount.com",
      "group:folder-managers@example.com",
    ]

    "roles/resourcemanager.folderViewer" = [
      "user:auditor@example.com",
      "group:developers@example.com",
    ]
  }

  conditional_bindings = [
    {
      role        = "roles/editor"
      title       = "temp_folder_access"
      description = "Temporary folder editor access"
      expression  = "request.time < timestamp(\"2024-06-30T00:00:00Z\")"
      members     = ["user:temp-user@example.com"]
    }
  ]
}
```

--------------------------------

### Manage Storage Bucket IAM Bindings with Terraform

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Configures IAM roles for Google Cloud Storage buckets using the storage_buckets_iam module. It supports both standard role bindings and conditional access policies for granular control.

```hcl
module "storage_bucket_iam_bindings" {
  source  = "terraform-google-modules/iam/google//modules/storage_buckets_iam"
  version = "~> 8.2"

  storage_buckets = ["my-data-bucket", "my-backup-bucket"]
  mode            = "authoritative"

  bindings = {
    "roles/storage.legacyBucketReader" = [
      "serviceAccount:reader-sa@my-project.iam.gserviceaccount.com",
      "group:data-analysts@example.com",
    ]

    "roles/storage.legacyBucketWriter" = [
      "serviceAccount:writer-sa@my-project.iam.gserviceaccount.com",
      "group:data-engineers@example.com",
    ]

    "roles/storage.admin" = [
      "group:storage-admins@example.com",
    ]
  }

  conditional_bindings = [
    {
      role        = "roles/storage.objectViewer"
      title       = "expires_quarterly"
      description = "Quarterly review required for object access"
      expression  = "request.time < timestamp(\"2024-04-01T00:00:00Z\")"
      members     = ["user:external-auditor@example.com"]
    }
  ]
}
```

--------------------------------

### Assign Secure Source Manager Instance IAM Roles (Terraform)

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/modules/secure_source_manager_iam/README.md

This Terraform code snippet demonstrates how to use the `terraform-google-modules/iam/google//modules/secure_source_manager_instance_iam` module to assign IAM roles to Secure Source Manager instances. It configures bindings for roles like `roles/securesourcemanager.instanceAccessor` and `roles/securesourcemanager.instanceManager` for specified instances, service accounts, groups, and users. The `mode` is set to `additive` to append new bindings.

```terraform
module "ssm_instance_iam_binding" {
  source    = "terraform-google-modules/iam/google//modules/secure_source_manager_instance_iam"
  version   = "~> 8.0"

  project   = var.project_id
  location  = "us-central1"

  instance_ids = [
    google_secure_source_manager_instance.default.instance_id,
  ]
  mode = "additive"

  bindings = {
    "roles/securesourcemanager.instanceAccessor" = [
      "serviceAccount:${var.sa_email}",
      "group:${var.group_email}",
      "user:${var.user_email}",
    ]
    "roles/securesourcemanager.instanceManager" = [
      "serviceAccount:${var.sa_email}",
      "group:${var.group_email}",
      "user:${var.user_email}",
    ]
  }
}
```

--------------------------------

### Create Custom IAM Role at Project Level

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Defines a custom IAM role with specific permissions and base roles at the project level. It allows for granular control by including specific permissions and excluding others while assigning the role to members.

```hcl
module "custom_role_project" {
  source  = "terraform-google-modules/iam/google//modules/custom_role_iam"
  version = "~> 8.2"

  target_level         = "project"
  target_id            = "my-project-id"
  role_id              = "custom_developer_role"
  title                = "Custom Developer Role"
  description          = "Custom role for developers with specific GKE and Cloud Build permissions"
  base_roles           = ["roles/container.developer"]
  permissions          = [
    "cloudbuild.builds.create",
    "cloudbuild.builds.get",
    "cloudbuild.builds.list",
  ]
  excluded_permissions = ["container.clusters.delete"]
  members              = [
    "serviceAccount:dev-sa@my-project-id.iam.gserviceaccount.com",
    "group:developers@example.com",
  ]
}
```

--------------------------------

### Configure Secret Manager IAM Bindings

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Manages access to Secret Manager secrets. Supports additive bindings for secret access, viewing, and administration, including time-bound conditional access.

```hcl
module "secret_manager_iam" {
  source  = "terraform-google-modules/iam/google//modules/secret_manager_iam"
  version = "~> 8.2"

  project = "my-project-id"
  secrets = ["database-credentials", "api-keys", "tls-certificates"]
  mode    = "additive"

  bindings = {
    "roles/secretmanager.secretAccessor" = [
      "serviceAccount:app-sa@my-project.iam.gserviceaccount.com",
      "serviceAccount:backend-sa@my-project.iam.gserviceaccount.com",
    ]

    "roles/secretmanager.viewer" = [
      "group:developers@example.com",
    ]

    "roles/secretmanager.admin" = [
      "group:security-team@example.com",
    ]
  }

  conditional_bindings = [
    {
      role        = "roles/secretmanager.secretAccessor"
      title       = "temp_secret_access"
      description = "Temporary secret access for debugging"
      expression  = "request.time < timestamp(\"2024-02-28T00:00:00Z\")"
      members     = ["user:oncall-engineer@example.com"]
    }
  ]
}
```

--------------------------------

### Configure DNS Zone IAM Bindings with Terraform

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/modules/dns_zones_iam/README.md

This snippet demonstrates how to implement the dns_zones_iam module to assign specific IAM roles to a list of members across defined managed zones. It supports both additive and authoritative modes for policy management.

```hcl
module "dns_zones_iam_binding" {
  source  = "terraform-google-modules/iam/google//modules/dns_zones_iam"
  version = "~> 8.2"

  project = var.project_id
  managed_zones = [
    google_dns_managed_zone.dns_zone_one.name,
  ]
  mode = "authoritative"

  bindings = {
    "roles/viewer" = [
      "serviceAccount:${var.sa_email}",
      "group:${var.group_email}",
      "user:${var.user_email}",
    ]
    "roles/dns.reader" = [
      "serviceAccount:${var.sa_email}",
      "group:${var.group_email}",
      "user:${var.user_email}",
    ]
  }
}
```

--------------------------------

### Terraform IAM Module v4.0 Root Module Configuration

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/docs/upgrading_to_iam_5.0.md

This HCL code snippet demonstrates the configuration of the Terraform Google IAM module using the root module in version 4.0. It includes setting project IDs and defining IAM bindings for various resources like projects, pub/sub topics, and storage buckets.

```hcl
 module "iam" {
   source  = "terraform-google-modules/iam/google"
   version = ">= 4.0.0 < 5.0.0"

   projects = ["project-123456"]

   projects_bindings = {
     "roles/storage.admin" = [
       "serviceAccount:a-service-account@cft.tips",
     ]
   }

   pubsub_topics_bindings = {}
   pubsub_subscriptions_bindings = {}
   storage_buckets_bindings = {}
   subnets_bindings = {}
   subnets_region = ""
   organizations_bindings = {}
   kms_crypto_keys_bindings = {}
   kms_key_rings_bindings = {}
   service_accounts_bindings = {}
   folders_bindings = {}
 }

```

--------------------------------

### Configure Tag Keys IAM Binding with Terraform

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/modules/tag_keys_iam/README.md

This snippet demonstrates how to instantiate the tag_keys_iam module to apply IAM roles to specified tag keys. It requires a map of roles to members and supports defining the binding mode as either additive or authoritative.

```hcl
module "tag_keys_iam_binding" {
  source  = "terraform-google-modules/iam/google//modules/tag_keys_iam"
  version = "~> 8.2"
  tag_keys = [
    google_tags_tag_key.tag_key.name,
  ]
  mode = "authoritative"

  bindings = {
    "roles/viewer" = [
      "serviceAccount:${var.sa_email}",
      "group:${var.group_email}",
      "user:${var.user_email}",
    ]
  }
}
```

--------------------------------

### Terraform IAM Module v5.0 Projects IAM Submodule Upgrade

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/docs/upgrading_to_iam_5.0.md

This HCL code snippet illustrates the upgrade path to version 5.0 of the Terraform Google IAM module, specifically using the `projects_iam` submodule. It shows the removal of the root module source and the renaming of the `projects_bindings` variable to `bindings`.

```hcl
 module "iam" {
   source  = "terraform-google-modules/iam/google//modules/projects_iam"
   version = ">= 5.0.0"

   projects = ["project-123456"]

   bindings = {
     "roles/storage.admin" = [
        "serviceAccount:a-service-account@cft.tips",
     ]
   }
 }

```

--------------------------------

### Manage Service Account IAM Bindings with Terraform

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Configures IAM roles for specific Google Service Accounts using the service_accounts_iam module. This requires defining the target project and supports additive binding modes.

```hcl
resource "google_service_account" "app_service_account" {
  account_id   = "my-app-service-account"
  display_name = "Application Service Account"
  project      = "my-project-id"
}

module "service_account_iam_bindings" {
  source  = "terraform-google-modules/iam/google//modules/service_accounts_iam"
  version = "~> 8.2"

  service_accounts = [google_service_account.app_service_account.email]
  project          = "my-project-id"
  mode             = "additive"

  bindings = {
    "roles/iam.serviceAccountKeyAdmin" = [
      "group:security-team@example.com",
    ]

    "roles/iam.serviceAccountTokenCreator" = [
      "serviceAccount:ci-cd-sa@my-project.iam.gserviceaccount.com",
      "group:devops-team@example.com",
    ]

    "roles/iam.serviceAccountUser" = [
      "user:developer@example.com",
    ]
  }

  conditional_bindings = [
    {
      role        = "roles/iam.serviceAccountAdmin"
      title       = "limited_sa_admin"
      description = "Limited service account admin access"
      expression  = "request.time < timestamp(\"2024-12-31T00:00:00Z\")"
      members     = ["user:sa-admin@example.com"]
    }
  ]
}
```

--------------------------------

### Upgrade IAM Module Source and Version (Terraform)

Source: https://github.com/terraform-google-modules/terraform-google-iam/blob/main/docs/upgrading_to_iam_3.0.md

This snippet demonstrates how to update the source path and version to upgrade the IAM module to version 3.0. It shows the transition from the generic 'google' source to the more specific 'google//modules/projects_iam' and updates the version constraint.

```terraform
module "iam" {
  source  = "terraform-google-modules/iam/google//modules/projects_iam"
  version = "~> 3.0"

  projects = ["project-123456"]

  bindings = {
    "roles/storage.admin" = [
      "serviceAccount:a-service-account@cft.tips",
    ]
  }
}
```

--------------------------------

### Manage Subnet IAM Bindings with Terraform

Source: https://context7.com/terraform-google-modules/terraform-google-iam/llms.txt

Configures IAM roles for VPC subnets within a specific region using the subnets_iam module. It allows for authoritative management of network access permissions.

```hcl
module "subnet_iam_bindings" {
  source  = "terraform-google-modules/iam/google//modules/subnets_iam"
  version = "~> 8.2"

  subnets        = ["subnet-prod", "subnet-staging"]
  subnets_region = "us-central1"
  project        = "my-network-project"
  mode           = "authoritative"

  bindings = {
    "roles/compute.networkUser" = [
      "serviceAccount:gke-sa@my-project.iam.gserviceaccount.com",
      "group:app-developers@example.com",
    ]

    "roles/compute.networkViewer" = [
      "group:network-viewers@example.com",
      "user:network-analyst@example.com",
    ]
  }

  conditional_bindings = [
    {
      role        = "roles/compute.networkAdmin"
      title       = "temp_network_admin"
      description = "Temporary network admin for migration"
      expression  = "request.time < timestamp(\"2024-03-31T00:00:00Z\")"
      members     = ["user:network-engineer@example.com"]
    }
  ]
}
```