Create projects without default owner role

[JohannesRudolph]

We are using stackit-landing-zone together with a multi-cloud management platform. We don't want to hand out owner permissions to our application teams as it allows them to perform various privileged operations that the platform team wants exclusive control over (e.g. project lifecycle, tags, for some landing zone variants also IAM).

Currently the terraform provider forces us to provide an owner_email which ends up as a member on the project create payload.
The docs for the project create endpoint https://docs.api.eu01.stackit.cloud/documentation/resource-manager/version/unversioned#tag/Projects/operation/create-project
say of members:

"The initial members assigned to the project. At least one subject needs to be a user,
and not a client or service account."

The doc is wrong, as it works just fine with a service account. I've filed this under a support ticket SSD-25050 to request clarification of the docs.

However, I'd like to set no initial owner member at all (ie empty members parameter). I'm happy with having an SA + org level permissions to manage the project. What I'd like to request for the stackit-landing-zone reference implementation is to support a "owner-less" projects by default (in the sense of: projects without a member that has the owner role assigned, only custom roles). I understand supporting this feature request requires the interplay of multiple components (resource-manager API, tofu provider, this repo), so I'm posting this here to document the use case from the landing zone side.

[tim-szostakowski-rewion]

Hello. The Owner_Email attribut cannot be empty upon project creation, but you might want to permit a general user account or service account as owner instead of the account of member from the application team.

[tim-szostakowski-rewion]

That being said, your request is more a feature request rather than a issue related to this module.