IAM member deletion during Pub/Sub subscription replace causes pull errors in production – How to avoid this?

[shuheishintani]

Issue

When replacing a google_pubsub_subscription resource, any IAM members associated with the subscription are temporarily deleted. This results in Pub/Sub clients failing to perform Pull operations, causing downtime in our production environment.

As noted in Issue #2301, using replace_triggered_by ensures that the IAM members are automatically recreated when the google_pubsub_subscription is replaced. However, this does not resolve the problem of temporary removal, as the IAM members are still deleted briefly during the replacement process.

Questions

1. How can this issue be avoided in production?
   Is there a Terraform-based solution to prevent the temporary removal of IAM members when a Pub/Sub subscription is replaced?

2. Should replacing resources be avoided altogether?
   If resource replacement is not a best practice in production, what alternatives do you recommend to update the resource?

3. Detecting resource replacements beforehand
   Is there a mechanism to detect when a resource will be replaced during terraform plan so we can proactively address this in production?

Enviroment

• Terraform v1.2.0
• provider.google v3.54.0