Incorrect attribute_condition in 'cowip' Workload Identity Pool Provider

[kishan-dhrangadhariya]

Description:
The attribute_condition for the resource:
module.multipartykeyhosting_secondary.module.workload_identity_pool.google_iam_workload_identity_pool_provider.workload_identity_pool appears to be incorrect.

Affected Files:

• coordinator/terraform/gcp/environments_mp_secondary/demo/mpkhs_secondary/mpkhs_secondary.tf
• coordinator/terraform/gcp/applications/multipartykeyhosting_secondary/main.tf
• coordinator/terraform/gcp/modules/workloadidentitypoolprovider/main.tf

Current Value:

attribute_condition = (var.enable_attestation ?
    <<-EOT
    assertion.swname == '${var.assertion_tee_swname}'
    && ${jsonencode(var.assertion_tee_support_attributes)}.all(a, a in assertion.submods.confidential_space.support_attributes)
    && (${join(" || ", [for allowed_wip_iam_principal in var.allowed_wip_iam_principals : "'${allowed_wip_iam_principal}' in assertion.google_service_accounts"])})
    EOT
    : "")

Proposed Fix:

attribute_condition = (var.enable_attestation ? <<-EOT
    assertion.swname == "${var.assertion_tee_swname}"
    && ${jsonencode(var.assertion_tee_support_attributes)}.all(a, a in assertion.submods.confidential_space.support_attributes)
    ${length(var.allowed_wip_iam_principals) > 0 ? "&& (" + join(" || ", [for allowed_wip_iam_principal in var.allowed_wip_iam_principals : "'${allowed_wip_iam_principal}' in assertion.google_service_accounts"]) + ")" : ""}
    EOT
    : "")

Potential Impact:

The file coordinator/terraform/gcp/modules/workloadidentitypoolprovider/main.tf is also referenced in the following resources:

• coordinator/terraform/gcp/environments_mp_secondary/demo/operator_wipp/operator_wipp.tf
• coordinator/terraform/gcp/applications/operator_workloadidentitypoolprovider/main.tf
• coordinator/terraform/gcp/environments_mp_primary/demo/operator_wipp/operator_wipp.tf
• coordinator/terraform/gcp/applications/operator_workloadidentitypoolprovider/main.tf

Applying the proposed fix will break the above-mentioned resources, which rely on the current implementation.

Next Steps:

Avoid referencing coordinator/terraform/gcp/modules/workloadidentitypoolprovider/main.tf from coordinator/terraform/gcp/environments_mp_secondary/demo/mpkhs_secondary/mpkhs_secondary.tf
Create a different implementation for it