<p>GCP allows the Kubernetes service account to impersonate the IAM service account by adding an IAM policy binding between the two service accounts. This binding allows the Kubernetes service account to act as the IAM service account.</p>
<pre><code>gcloud iam service-accounts add-iam-policy-binding GSA_NAME@GSA_PROJECT.iam.gserviceaccount.com \
    --role roles/iam.workloadIdentityUser \
    --member &quot;serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]&quot;
</code></pre>
<p>We would like to create the same via Terraform resource and we tried this way, refer: <a href="https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account_iam#google_service_account_iam_binding" rel="nofollow noreferrer">article</a></p>
<pre><code>resource &quot;google_service_account_iam_binding&quot; &quot;service-account-iam&quot; {
  service_account_id = &quot;GSA_NAME@GSA_PROJECT.iam.gserviceaccount.com&quot;
  role               = &quot;roles/iam.workloadIdentityUser&quot;
  members = [
    &quot;serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]&quot;,
  ]
}
</code></pre>
<p>But we received the below error:</p>
<blockquote>
<p>Error: &quot;service_account_id&quot; (&quot;XXX@XXX.iam.gserviceaccount.com&quot;) doesn't match regexp &quot;projects/(?:(?:[-a-z0-9]{1,63}\.)<em>(?:a-z?):)?(?:[0-9]{1,19}|(?:a-z0-9?)|-)/serviceAccounts/((?:(?:[-a-z0-9]{1,63}\.)</em>(?:a-z?):)?(?:[0-9]{1,19}|(?:a-z0-9?))@[a-z]+.gserviceaccount.com$|[0-9]{1,20}-compute@developer.gserviceaccount.com|a-z@[-a-z0-9\.]{1,63}\.iam\.gserviceaccount\.com$)&quot;</p>
</blockquote>
<p>What's wrong here?</p>

<p><code>service_account_id</code> is the fully-qualified name of the service account to apply the policy to.</p>
<p><code>projects/PROJECT_ID/serviceAccounts/SERVICE_ACCOUNT_EMAIL</code></p>
