Service agent permissions removed from Shared VPC project

[NitriKx]

TL;DR

After upgrading from the 14.1 to 17 we are seeing some changes on the shared VPC permissions, probably due to #934

Expected behavior

No changes if we do not change the configuration

Observed behavior

  # module.project_structure.module.shared_vpc_access.google_project_iam_member.composer_host_agent[0] will be destroyed
  # (because index [0] is out of range for count)
  - resource "google_project_iam_member" "composer_host_agent" {
      - etag    = "xxxx=" -> null
      - id      = "shared-vpc-project/roles/composer.sharedVpcAgent/serviceAccount:service-xxxxxxxxxxxxxx@cloudcomposer-accounts.iam.gserviceaccount.com" -> null
      - member  = "serviceAccount:service-xxxxxxxxxxxxxx@cloudcomposer-accounts.iam.gserviceaccount.com" -> null
      - project = "shared-vpc-project" -> null
      - role    = "roles/composer.sharedVpcAgent" -> null
    }

  # module.project_structure.module.shared_vpc_access.google_project_iam_member.gke_host_agent[0] will be destroyed
  # (because index [0] is out of range for count)
  - resource "google_project_iam_member" "gke_host_agent" {
      - etag    = "xxxxx=" -> null
      - id      = "shared-vpc-project/roles/container.hostServiceAgentUser/serviceAccount:service-xxxxxxxxxxxxxx@container-engine-robot.iam.gserviceaccount.com" -> null
      - member  = "serviceAccount:service-xxxxxxxxxxxxxx@container-engine-robot.iam.gserviceaccount.com" -> null
      - project = "shared-vpc-project" -> null
      - role    = "roles/container.hostServiceAgentUser" -> null
    }

  # module.project_structure.module.shared_vpc_access.google_project_iam_member.service_shared_vpc_user["composer.googleapis.com"] will be destroyed
  # (because key ["composer.googleapis.com"] is not in for_each map)
  - resource "google_project_iam_member" "service_shared_vpc_user" {
      - etag    = "xxxxx=" -> null
      - id      = "shared-vpc-project/roles/compute.networkUser/serviceAccount:service-xxxxxxxxxxxxxx@cloudcomposer-accounts.iam.gserviceaccount.com" -> null
      - member  = "serviceAccount:service-xxxxxxxxxxxxxx@cloudcomposer-accounts.iam.gserviceaccount.com" -> null
      - project = "shared-vpc-project" -> null
      - role    = "roles/compute.networkUser" -> null
    }

  # module.project_structure.module.shared_vpc_access.google_project_iam_member.service_shared_vpc_user["container.googleapis.com"] will be destroyed
  # (because key ["container.googleapis.com"] is not in for_each map)
  - resource "google_project_iam_member" "service_shared_vpc_user" {
      - etag    = "xxxxx=" -> null
      - id      = "shared-vpc-project/roles/compute.networkUser/serviceAccount:service-xxxxxxxxxxxxxx@container-engine-robot.iam.gserviceaccount.com" -> null
      - member  = "serviceAccount:service-xxxxxxxxxxxxxx@container-engine-robot.iam.gserviceaccount.com" -> null
      - project = "shared-vpc-project" -> null
      - role    = "roles/compute.networkUser" -> null
      - 

Terraform Configuration

We are both defining the `activate_apis` and `activate_api_identities` variables, depending if the API supports the `google_project_service_identity` TF resource or not

Terraform Version

Terraform v1.9.7

Additional information

I suppose we should change

    active_apis                        = var.activate_apis

by something like that

    active_apis                        = toset(concat(var.activate_apis, var.activate_api_identities))

Indeed the value before #934 was including both activate_apis and activate_api_identities
Ref: https://github.com/terraform-google-modules/terraform-google-project-factory/blob/master/modules/project_services/main.tf#L19