[CloudSQL] Handle CLOUD_IAM_GROUP username edgecases

[jackweinbender]

Although some of the issues surrounding the use of CLOUD_IAM_GROUP users with cloudsql I believe are google's own problems, in this case, I think this PR will address some of the problems with TF not being able to locate CLOUD_IAM_GROUP type resources, as discussed in hashicorp/terraform-provider-google#17040.

The issue, I believe, is that group users retain the domain as a part of their username while standard users and service accounts have the domain stripped. You can see on L369 of the PR that this fact is already accounted for in part, but the same exception wasn't included in the diffSuppress function (L21ff.).

I've also included comments to make some of this explicit, since it's a bit counterintuitive.

Release Note Template for Downstream PRs (will be copied)

sql: fix `diffSuppressIamUserName` function to handle `CLOUD_IAM_GROUP` correctly

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[github-actions]

Hello! I am a robot. Tests will require approval from a repository maintainer to run.

@slevenick, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 1 file changed, 18 insertions(+), 3 deletions(-))
google-beta provider: Diff ( 1 file changed, 18 insertions(+), 3 deletions(-))

Errors

google provider:

• The diff processor failed to build. This is usually due to the downstream provider failing to compile.

google-beta provider:

• The diff processor failed to build. This is usually due to the downstream provider failing to compile.

[slevenick]

Failing due to resource_sql_user.go:32:5: undefined: slices

Have you been able to test this change?

[modular-magician]

Tests analytics

Total tests: 0
Passed tests: 0
Skipped tests: 0
Affected tests: 0

Click here to see the affected service packages

• sql

$\textcolor{red}{\textsf{Errors occurred during RECORDING mode. Please fix them to complete your PR.}}$ View the [build log](https://storage.cloud.google.com/ci-vcr-logs/beta/refs/heads/auto-pr-10666/artifacts/ab92fc57-b36f-42b7-b8bd-e8cf89fb24c5/build-log/replaying_test.log)

[jackweinbender]

@slevenick I'm just an idiot and forgot to migrate the slices import into this repo when I moved it.

[slevenick]

Is this behavior documented somewhere? I want to make sure this is intended behavior and not something that gets changed later and leaves us in a bad spot

[jackweinbender]

I haven't been able to find this in any documentation—the docs on this are pretty poor overall.

But the (apparent) rule I'm making explicit here is one we already account for on L368: "If the current user type isn't pg or CLOUD_IAM_GROUP, split the domain off the supplied email address." The implication being that the domain is retained by CLOUD_IAM_GROUP. So, we have a precedent, this PR just brings this block into alignment with how we're treating CLOUD_IAM_GROUP elsewhere.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 1 file changed, 19 insertions(+), 3 deletions(-))
google-beta provider: Diff ( 1 file changed, 19 insertions(+), 3 deletions(-))

[modular-magician]

Tests analytics

Total tests: 93
Passed tests: 78
Skipped tests: 15
Affected tests: 0

Click here to see the affected service packages

• sql

$\textcolor{green}{\textsf{All tests passed!}}$
View the build log

[jackweinbender]

Is there anything else you need me to do here, @slevenick?

[OscarVanL]

How timely, I was just having a world of pain trying to setup group IAM on a CloudSQL instance. Is there any chance this is likely to be merged/released soon?

[slevenick]

I think this looks good. Can you add a test that uses a CLOUD_IAM_GROUP?

[github-actions]

@GoogleCloudPlatform/terraform-team This PR has been waiting for review for 7 days. Please take a look! Use the label disable-review-reminders to disable these notifications.

[slevenick]

Please add a test that uses CLOUD_IAM_GROUP