Google ACE Practice Question: Refer to the exhibit

Exhibit

resource "google_project_iam_member" "project" {
  project = "my-project"
  role    = "roles/editor"
  members = ["user:john@example.com"]
}

Refer to the exhibit. The Terraform plan above returns the error: Error: "member" is required. What is the issue?

⚠ Common exam trap

Google Cloud often tests the subtle difference between singular and plural argument names in Terraform resources (e.g., 'member' vs 'members'), tricking candidates who assume both forms are interchangeable or who confuse IAM member with IAM binding syntax.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The member argument should be 'member' (singular) not 'members'.

The Terraform error 'Error: "member" is required' indicates that the resource block is using the plural argument 'members' instead of the singular 'member'. In the Google Cloud Terraform provider, the google_project_iam_member resource expects a single 'member' argument (e.g., 'user:email@example.com'), not a list. The correct syntax is 'member = "user:email@example.com"', not 'members = ["user:email@example.com"]'. This is a common syntax error when transitioning from other IAM resources that accept lists.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The Terraform provider version is outdated.
Why it's wrong here
An outdated Terraform provider typically surfaces as an 'unsupported resource' error or a 'required argument missing' error when a resource property has been renamed or newly added by the provider. However, the google_project_iam_member resource has always used the singular 'member' attribute, so no provider update could change that expectation. Moreover, this error occurs during Terraform's static configuration validation, before any API interaction, meaning the provider version is irrelevant to why 'members' is rejected.
✗
The project ID is incorrect.
Why it's wrong here
An incorrect project ID would not cause a Terraform plan-time schema validation failure; instead, it would produce an API error such as 'Project not found' (404) or 'Permission denied' (403) when Terraform tries to read or modify the IAM policy. The error in the plan indicates the configuration itself is invalid because 'members' is not a valid argument for google_project_iam_member. Since this validation happens locally before any API call, the actual project ID string is never even evaluated for correctness at this stage.
✗
The member argument must be a service account, not a user.
Why it's wrong here
Google Cloud IAM supports multiple principal types, including user accounts (e.g., 'user:alice@example.com'), service accounts ('serviceAccount:svc@...'), Google Groups, and domains. The google_project_iam_member resource is explicitly designed to accept any of these valid member types, so a user is a perfectly legitimate principal for project IAM. The error is not about the principal type but about the argument name; replacing a user with a service account would still fail because 'members' (plural) is not an accepted argument on this resource.
✓
The member argument should be 'member' (singular) not 'members'.
Why this is correct
The resource google_project_iam_member defines its IAM principal using a singular 'member' argument, whereas the plural 'members' argument is only valid on google_project_iam_binding (which manages a full set of members for a specific role). Terraform's schema validation for the google_project_iam_member resource does not recognize 'members' and therefore raises an 'unexpected argument' error during the plan. To fix this, change the argument key from 'members' to 'member', ensuring the configuration matches the resource's expected singular attribute for assigning one principal to a project role.

Go deeper

Google ACE Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question