feat(iam3): Add resource target support to IAM v3 policy bindings

[alifirst01]

This PR adds support for target.resource as an alternative to target.principal_set in IAM v3 policy bindings across projects, folders, and organizations:

• google_iam_projects_policy_binding
• google_iam_folders_policy_binding
• google_iam_organizations_policy_binding

Context & Changes

In the IAM v3 policyBindings API, target is a oneof that accepts either a resource or a principal_set depending on the policy kind:

• Access Policies (policy_kind = "ACCESS"): Bind directly to a resource target.
• Principal Access Boundary Policies (policy_kind = "PRINCIPAL_ACCESS_BOUNDARY"): Bind to a principal_set target.

Previously, the provider only exposed target.principal_set. This change:

• Adds the resource property under target across Projects, Folders, and Organizations policy bindings.
• Enforces mutual exclusivity using exactly_one_of: [target.0.principal_set, target.0.resource].
• Adds acceptance tests covering creation, in-place update, and import state verification.

Tests

Acceptance tests covering the basic lifecycle, updates, and imports are passing:

• TestAccIAM3FoldersPolicyBinding_iamAccessPolicyBinding
• TestAccIAM3ProjectsPolicyBinding_iamAccessPolicyBinding
• TestAccIAM3OrganizationsPolicyBinding_iamAccessPolicyBinding

iam: added `target.resource` to `google_iam_projects_policy_binding`, `google_iam_folders_policy_binding`, and `google_iam_organizations_policy_binding`

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@ScottSuarez, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 6aa771a:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	12 files changed, 510 insertions(+), 6 deletions(-)
google-beta provider	View Diff	12 files changed, 510 insertions(+), 6 deletions(-)
terraform-google-conversion	View Diff	3 files changed, 33 insertions(+)

Breaking Change(s) Detected

The following breaking change(s) were detected within your pull request.

• Field target.principal_set within resource google_iam_folders_policy_binding was added to exactly one of - reference
• Field target.principal_set within resource google_iam_organizations_policy_binding was added to exactly one of - reference
• Field target.principal_set within resource google_iam_projects_policy_binding was added to exactly one of - reference
• Field target.resource within resource google_iam_folders_policy_binding was added to exactly one of - reference
• Field target.resource within resource google_iam_organizations_policy_binding was added to exactly one of - reference
• Field target.resource within resource google_iam_projects_policy_binding was added to exactly one of - reference

If you believe this detection to be incorrect please raise the concern with your reviewer.
If you intend to make this change you will need to wait for a major release window.
An override-breaking-change label can be added to allow merging.

Test report

Analytics

Total Tests	Passed	Skipped	Affected
14	11	0	3

Affected Service Packages

• iam3

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 3 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccIAM3FoldersPolicyBinding_iamAccessPolicyBinding
• TestAccIAM3OrganizationsPolicyBinding_iamAccessPolicyBinding
• TestAccIAM3ProjectsPolicyBinding_iamAccessPolicyBinding

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
❌ Error · Log	-	TestAccIAM3FoldersPolicyBinding_iamAccessPolicyBinding
❌ Error · Log	-	TestAccIAM3OrganizationsPolicyBinding_iamAccessPolicyBinding
❌ Error · Log	-	TestAccIAM3ProjectsPolicyBinding_iamAccessPolicyBinding

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@alifirst01, @ScottSuarez VCR tests complete for 6aa771a!