Thanks for the PR! 🚀
✅ Lint checks have passed.

Also

these datasources are run immediately and fail in plan phase

Could you show an example. Usually you can defer datasources to apply time using depends_on within datasources.

Also

these datasources are run immediately and fail in plan phase

Could you show an example. Usually you can defer datasources to apply time using depends_on within datasources.

Example code:

terraform {
  required_version = ">= 0.13"

  required_providers {
    google      = ">= 3.71.0"
  }
}

provider "google" {
  region = "europe-central2"
}

module "project" {
  source  = "terraform-google-modules/project-factory/google//modules/fabric-project"
  version = "11.0.0"

  name            = "test-project-name-43413"
  billing_account = "<BILLING_ACCOUNT_ID>"
  parent          = "folders/<FOLDER_ID>"
  prefix          = "dev"

  auto_create_network = false

  activate_apis = [
    "compute.googleapis.com",
  ]
}

data "google_storage_project_service_account" "gcs_account" {
  project = module.project.project_id
}

output "project-id" {
  value = module.project.project_id
}

That causes datasource to fail:

$ terraform plan

 Error: Error when reading or editing GCS service account not found: googleapi: Error 400: Unknown project id: 'dev-test-project-name-43413', invalid

   with data.google_storage_project_service_account.gcs_account,
   on main.tf line 29, in data "google_storage_project_service_account" "gcs_account":
   29: data "google_storage_project_service_account" "gcs_account" {

Of course explicitly depending on project solves this issue, but it's counter-intuitive.

data "google_storage_project_service_account" "gcs_account" {
  project = module.project.project_id
  depends_on = [module.project]
}

Especially if you look into project_id output in modules/fabric-project/outputs.tf, where there is explicit depends_on not even on project but on project services. Which makes sense, because you don't want to use project_id if it doesn't have APIs enabled.

output "project_id" {
  description = "Project id (depends on services)."
  value       = google_project.project.project_id
  depends_on  = [google_project_service.project_services]
}

But this depends_on in output does not work, because project_id is available immediately. I'm not sure if this is not a bug in terraform, anyway current behaviour is surprising. project_id is often used in many resources and specifying explicitly dependencies on module.project is possible, but tedious.