FACTUAL ACTIVITY RECORD · An activity record based on work that took place
Making the API Gateway service-agent IAM reference deterministic
Replacing a nullable provider attribute with the official project-number-derived identity
Purpose
A partial Terraform application created the API Gateway service identity, but the provider returned its email attribute as null, preventing construction of the Token Creator binding member. Creation ordering needed to remain intact without relying on nullable output.
Implementation
In service-identity derivation, the API Gateway service-agent email is now derived from the confirmed project number and the official naming format. The service-identity resource remains as the creation-order dependency.
runtime IAM policy grants only Token Creator on the dedicated gateway service account to the derived service agent. infrastructure verification gained a regression check against returning to the nullable provider attribute.
Rendering diagram…
What was confirmed
Verification results
Terraform formatting, backend-free initialization, validation, and the GCP static audit passed.
The failing reference was replaced without broadening the existing IAM scope.
A new plan from the partial state and its actual application had not been verified by the cutoff.
Basis for completion
This scope ended when the service agent could be derived uniquely from the official format while creation ordering and least-privilege IAM remained statically verifiable.