Guard IAP brand and client against destructive replaces#12
Merged
Conversation
support_email changes force brand replacement, but brands can't be deleted or recreated (one per project; IAP OAuth Admin API deprecated). The replace attempt on 2026-07-07 deleted the live IAP client first and broke all PAM logins with deleted_client until state was repaired. - prevent_destroy on the brand: such plans now fail before touching GCP - deletion_policy=ABANDON on the client: destroys/replaces leave the live client running in GCP and only drop it from state Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
During the 2026-07-07 incident (wavemm-iam#325 → GoogleCloudPlatform#327), changing
admin_emailforced a replacement ofgoogle_iap_brand. Brands can't be deleted or recreated (one per project, IAP OAuth Admin API deprecated), but the replace attempt deleted the livegoogle_iap_clientfirst, breaking every PAM login withError 401: deleted_clientfor ~5.5h until the brand and a replacement client were imported back into state.What
prevent_destroy = true(uncomments the existing hint) — any plan that would replace the brand now fails at plan time, before touching GCP.deletion_policy = "ABANDON"— destroys/replaces leave the client running in GCP and only remove it from state, so IAP never ends up pointing at a deleted client.terraform validatepasses (google provider v7). No change to the app sources zip, so bumping the submodule in wavemm-iam won't trigger a redeploy — only a metadata-only apply.🤖 Generated with Claude Code