Make allAuthenticatedUsers case sensitive in iam members

.changelog/5853.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+iam: fixed an issue where special identifiers `allAuthenticatedUsers` and `allUsers` were flattened to lower case in IAM members.
+```

google/iam.go

@@ -244,7 +244,11 @@ func subtractFromBindings(bindings []*cloudresourcemanager.Binding, toRemove ...
 }
 
 func iamMemberIsCaseSensitive(member string) bool {
-	return strings.HasPrefix(member, "principalSet:") || strings.HasPrefix(member, "principal:") || strings.HasPrefix(member, "principalHierarchy:")
+	// allAuthenticatedUsers and allUsers are special identifiers that are case sensitive. See:
+	// https://cloud.google.com/iam/docs/overview#all-authenticated-users
+	return strings.Contains(member, "allAuthenticatedUsers") || strings.Contains(member, "allUsers") ||
+		strings.HasPrefix(member, "principalSet:") || strings.HasPrefix(member, "principal:") ||
+		strings.HasPrefix(member, "principalHierarchy:")
 }
 
 // normalizeIamMemberCasing returns the case adjusted value of an iamMember

google/resource_privateca_ca_pool_iam_test.go

@@ -0,0 +1,95 @@
+package google
+
+import (
+	"fmt"
+	"reflect"
+	"sort"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+)
+
+func TestAccPrivatecaCaPoolIamMemberAllAuthenticatedUsersCasing(t *testing.T) {
+	t.Parallel()
+
+	capool := "tf-test-pool-iam-" + randString(t, 10)
+	project := getTestProjectFromEnv()
+	region := getTestRegionFromEnv()
+
+	vcrTest(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPrivatecaCaPoolIamMember_allAuthenticatedUsers(capool, region, project),
+				Check: testAccCheckPrivatecaCaPoolIam(t, capool, region, project, "roles/privateca.certificateManager", []string{
+					fmt.Sprintf("group:%s.svc.id.goog:/allAuthenticatedUsers/", project),
+				}),
+			},
+		},
+	})
+}
+
+func testAccCheckPrivatecaCaPoolIam(t *testing.T, capool, region, project, role string, members []string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		d := &ResourceDataMock{
+			FieldsInSchema: map[string]interface{}{
+				"ca_pool": capool,
+				"role":    role,
+				"member":  "",
+			},
+		}
+		u := &PrivatecaCaPoolIamUpdater{
+			project:  project,
+			location: region,
+			caPool:   capool,
+			d:        d,
+			Config:   googleProviderConfig(t),
+		}
+		p, err := u.GetResourceIamPolicy()
+		if err != nil {
+			return err
+		}
+
+		for _, binding := range p.Bindings {
+			if binding.Role == role {
+				sort.Strings(members)
+				sort.Strings(binding.Members)
+
+				if reflect.DeepEqual(members, binding.Members) {
+					return nil
+				}
+
+				return fmt.Errorf("Binding found but expected members is %v, got %v", members, binding.Members)
+			}
+		}
+
+		return fmt.Errorf("No binding for role %q", role)
+	}
+}
+
+func testAccPrivatecaCaPoolIamMember_allAuthenticatedUsers(capool, region, project string) string {
+	return fmt.Sprintf(`
+resource "google_privateca_ca_pool" "default" {
+  name     = "%s"
+  location = "%s"
+  tier     = "ENTERPRISE"
+  publishing_options {
+    publish_ca_cert = true
+    publish_crl     = true
+  }
+  labels = {
+    foo = "bar"
+  }
+}
+
+resource "google_privateca_ca_pool_iam_member" "member" {
+  ca_pool  = google_privateca_ca_pool.default.id
+  role     = "roles/privateca.certificateManager"
+  member   = "group:%s.svc.id.goog:/allAuthenticatedUsers/"
+}
+
+`, capool, region, project)
+}