I am using a Terraform google_project_iam_policy
resource to manage a number of roles for a project.
I have noticed that it does not always remove a member from a role when I am expecting it to - seemingly sometimes (but not always) if I use the cloud console to add a member to a role for a project, Terraform does not remove that when I reapply. I would expect it to remove that member from that role in line with the terraform resource definition.
I'd like to understand what is happening here: is terraform able to distinguish between these? is there some undisplayed state in the cloud console/gcloud projects get-iam-policy
that I am not seeing?