From 0bc989c8cd1c5d0ae2ea19e6ae53d6dcba289430 Mon Sep 17 00:00:00 2001 From: Lorenzo Stella Date: Tue, 7 Jul 2026 18:17:12 +0200 Subject: [PATCH] Guard IAP brand and client against destructive replaces support_email changes force brand replacement, but brands can't be deleted or recreated (one per project; IAP OAuth Admin API deprecated). The replace attempt on 2026-07-07 deleted the live IAP client first and broke all PAM logins with deleted_client until state was repaired. - prevent_destroy on the brand: such plans now fail before touching GCP - deletion_policy=ABANDON on the client: destroys/replaces leave the live client running in GCP and only drop it from state Co-Authored-By: Claude Fable 5 --- terraform/jitgroups-appengine/main.tf | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/terraform/jitgroups-appengine/main.tf b/terraform/jitgroups-appengine/main.tf index 340b9b69..dbe84474 100644 --- a/terraform/jitgroups-appengine/main.tf +++ b/terraform/jitgroups-appengine/main.tf @@ -260,10 +260,13 @@ resource "google_iap_brand" "iap_brand" { project = var.project_id support_email = var.admin_email application_title = "JIT Groups" - # lifecycle { - # # This resource can't be deleted. - # prevent_destroy = true - # } + lifecycle { + # Brands cannot be deleted or recreated (one per project, and the + # IAP OAuth Admin API is deprecated). A support_email change forces + # replacement, which first deletes the dependent IAP client and + # breaks all logins (2026-07-07 outage). Fail the plan instead. + prevent_destroy = true + } } # @@ -272,6 +275,12 @@ resource "google_iap_brand" "iap_brand" { resource "google_iap_client" "iap_client" { display_name = "JIT Groups" brand = google_iap_brand.iap_brand.name + + # Never delete the live OAuth client through the API: App Engine IAP + # keeps referencing it and every login fails with `deleted_client` + # (2026-07-07 outage). On destroy/replace, only remove it from state + # and leave the client running in GCP. + deletion_policy = "ABANDON" } #