stop project-owner from causing a diff

third_party/terraform/resources/resource_storage_bucket_acl.go

@@ -62,6 +62,13 @@ func resourceStorageRoleEntityCustomizeDiff(diff *schema.ResourceDiff, meta inte
 	conf := map[string]struct{}{}
 	for i := 0; i < count; i++ {
 		old, new := diff.GetChange(fmt.Sprintf("role_entity.%d", i))
+
+		// project-owners- is explicitly stripped from the roles that this
+		// resource will delete
+		if strings.Contains(old.(string), "OWNER:project-owners-") {
+			continue
+		}
+
 		state[old.(string)] = struct{}{}
 		conf[new.(string)] = struct{}{}
 	}

third_party/terraform/tests/resource_storage_bucket_acl_test.go

@@ -151,6 +151,23 @@ func TestAccStorageBucketAcl_unordered(t *testing.T) {
 	})
 }
 
+// Test that project owner doesn't get removed or cause a diff
+func TestAccStorageBucketAcl_RemoveOwner(t *testing.T) {
+	t.Parallel()
+
+	bucketName := testBucketName()
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccStorageBucketAclDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testGoogleStorageBucketsAclRemoveOwner(bucketName),
+			},
+		},
+	})
+}
+
 func testAccCheckGoogleStorageBucketAclDelete(bucket, roleEntityS string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		roleEntity, _ := getRoleEntityPair(roleEntityS)
@@ -283,3 +300,18 @@ resource "google_storage_bucket_acl" "acl" {
 }
 `, bucketName)
 }
+
+func testGoogleStorageBucketsAclRemoveOwner(bucketName string) string {
+	return fmt.Sprintf(`
+resource "google_storage_bucket" "bucket" {
+  name = "%s"
+}
+
+resource "google_storage_bucket_acl" "acl" {
+  bucket         = google_storage_bucket.bucket.name
+  role_entity = [
+	"READER:[email protected]"
+  ]
+}
+`, bucketName)
+}