add support for invoker_iam_disabled

[emalihin]

Cloud run v2 service supports invoker_iam_disabled = true which is a recommended way to allow public cloud run access

resource "google_cloud_run_v2_service" "default" {
   name     = "SERVICE"
   location = "REGION"
   invoker_iam_disabled = true

   template {
      containers {
      image = "IMAGE_URL"
      }
   }
}

Add support of invoker_iam_disabled to these modules.

[natevw]

UPDATE — below is essentially off-topic, sorry! I was just looking at the URL of this Github project and didn't realize it was some separate utility.

In my case the actual problem was that I had pinned an older version of the provider in my config:

required_providers {
     google = {
       source  = "hashicorp/google"
-      version = "~> 5.0"
     }
   }

Whereas the current provider is v7.23.0 or something so I was way out of date. Removing that line and then re-doing the terraform init --upgrade and after that the validation error on terraform apply goes away.

Apologies again for the noise; leaving in case someone else in a similar situation finds this.

---

Yeah I'm pretty confused by this too. I found the same docs at https://docs.cloud.google.com/run/docs/authenticating/public and tried to use it as shown:

resource "google_cloud_run_v2_service" "app" {
  name     = var.service_name
  location = var.region
  invoker_iam_disabled = true

# …

But that leads to a hard fail:

Error: Unsupported argument
│ 
│   on main.tf line 27, in resource "google_cloud_run_v2_service" "app":
│   27:   invoker_iam_disabled = true
│ 
│ An argument named "invoker_iam_disabled" is not expected here.

This attribute is documented at https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_v2_service#invoker_iam_disabled-1 and seems to have been added already back in 2024 via https://github.com/GoogleCloudPlatform/magic-modules/pull/11954/changes. Just to be sure I did a terraform init --upgrade but I already had the lasted provider and no change to the error.

---

Workaround:

I had been using the method shown in e.g. https://docs.cloud.google.com/run/docs/samples/cloudrun-access-control-parent-tag to add permisions:

resource "google_cloud_run_v2_service_iam_member" "public_access" {
  name     = google_cloud_run_v2_service.app.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

This makes the service appear in a funny/deprecated way in the Console UI so I was trying to do it more directly:

I guess I'll just go back to doing that but it's really unclear why I can't simply add the supposed invoker_iam_disabled = true attribute!