fix(iac/gcp): drop attribute.account so both WIF onboarding paths agree

The Terraform module maps three attributes on the AWS branch (google.subject,
attribute.aws_role, attribute.account) while
arm/CUDly-CrossSubscription/setup-gcp-wif.sh maps only the first two. Nothing
reads attribute.account: its only two references in the tree were the mapping
line itself and the comment above it. It is not named by the
attribute_condition, by the impersonation grant's principalSet, or by any test.

Today that divergence is inert, because the script compares only the provider's
attributeCondition. Once the script also compares attributeMapping as an exact
set, it stops being inert: both paths default to pool 'cudly-pool' and provider
'cudly-provider', so a customer onboarded via the Terraform bundle who then runs
the script against the same project lands on this module's provider, fails the
set comparison on the one extra key, and is told to delete the provider and
re-run. That detaches every live federated session, and the next terraform apply
then fights the recreated provider. The verdict would also be wrong: the mapping
is not unsafe, it just carries one extra unused key.

Removing the key rather than teaching the script to expect it keeps the
comparison an exact set, which is what stops an unexpected attribute from being
introduced later and keyed on by a pool-wide
principalSet://.../attribute.X/... grant. Account pinning is unaffected: the
provider's aws.account_id block and the account number inside the pinned role
ARN both still constrain it.

Also corrects the comment above the mapping. It specifically anticipated this
attribute and concluded it was inert because the script "compares conditions,
not mappings" - true when written, false as soon as the script compares
mappings, and a future reader would have trusted it.

Migration: attribute_mapping is not ForceNew in the google provider (the field
is Optional with no ForceNew, and Update appends "attributeMapping" to the PATCH
updateMask), so dropping a key is an in-place update. It rides along with the
change this branch already makes to the same field and adds no replacement risk.

TestGCPTargetMappingMatchesSetupScript locks the two paths to the same mapping
set, parsing both files rather than restating either, and fails if a key is ever
added on one side alone.

Refs #1667

Author: cristim

iac/federation/gcp-target/terraform/main.tf

@@ -123,17 +123,24 @@ resource "google_iam_workload_identity_pool_provider" "cudly" {
   # refused. STS drops the path from assumed-role ARNs, so the same trick does
   # not work through an IAM role.
   #
-  # This expression, the attribute_condition below, and the impersonation grant's
-  # member are byte-identical to their counterparts in
-  # arm/CUDly-CrossSubscription/setup-gcp-wif.sh, so the two customer-facing
-  # onboarding paths pin the same identity and the script's condition check
-  # accepts a provider this module created. (The script does not map
-  # attribute.account, which is mapped here and unused by the condition; it
-  # compares conditions, not mappings, so the extra attribute is inert there.)
+  # This expression, the attribute_condition below, the impersonation grant's
+  # member, and the set of keys mapped here are byte-identical to their
+  # counterparts in arm/CUDly-CrossSubscription/setup-gcp-wif.sh, so the two
+  # customer-facing onboarding paths pin the same identity and configure the
+  # same provider. The two paths do converge on one provider rather than staying
+  # independent: both default to pool 'cudly-pool' and provider
+  # 'cudly-provider', so a customer who applies this module and then runs the
+  # script lands on the provider this resource created.
+  #
+  # Do not map an attribute here without mapping it in the script too. The
+  # script refuses to reuse a provider whose configuration differs from the one
+  # it would have written, and the only remedy it offers is deleting the
+  # provider, which detaches every live federated session. An extra key on one
+  # side alone is enough to trigger that, even when nothing reads its value.
+  # TestGCPTargetMappingMatchesSetupScript guards the parity.
   attribute_mapping = var.provider_type == "aws" ? {
     "google.subject"     = "assertion.arn"
     "attribute.aws_role" = "assertion.arn.contains('assumed-role') ? assertion.arn.extract('{account_arn}assumed-role/') + 'assumed-role/' + assertion.arn.extract('assumed-role/{role_name}/') : assertion.arn"
-    "attribute.account"  = "assertion.account"
   } : var.oidc_attribute_mapping
 
   # Both branches are non-null: aws_role_name and oidc_subject are validated

iac/gcp_target_wif_test.go

@@ -1,7 +1,9 @@
 package iac
 
 import (
+	"os"
 	"regexp"
+	"slices"
 	"strings"
 	"testing"
 )
@@ -119,6 +121,95 @@ func TestGCPTargetUpgradeOrderingIsPinned(t *testing.T) {
 	}
 }
 
+// setupScript is the shell onboarding path. It is the second way a customer can
+// configure the same pool and provider; both paths default to pool 'cudly-pool'
+// and provider 'cudly-provider', so a customer who uses one and then the other
+// lands on the same provider rather than on two independent ones.
+const setupScript = "../arm/CUDly-CrossSubscription/setup-gcp-wif.sh"
+
+// awsMappingBlock captures the body of the AWS branch of attribute_mapping in
+// main.tf, i.e. everything between the ternary's opening brace and the OIDC
+// alternative.
+var awsMappingBlock = regexp.MustCompile(`(?s)attribute_mapping = var\.provider_type == "aws" \? \{(.*?)\n\s*\} : var\.oidc_attribute_mapping`)
+
+// hclMappingPair matches one `"key" = "value"` entry inside that block.
+var hclMappingPair = regexp.MustCompile(`(?m)^\s*"([^"]+)"\s*=\s*"(.*)"\s*$`)
+
+// scriptMappingLiteral captures the quoted, comma-delimited mapping dict the
+// script hands to gcloud's --attribute-mapping. It is anchored on the
+// attribute.aws_role key so it selects the AWS dict and not the OIDC one.
+var scriptMappingLiteral = regexp.MustCompile(`"([^"]*attribute\.aws_role=[^"]*)"`)
+
+// tfAWSMapping returns main.tf's AWS attribute_mapping as sorted "key=value"
+// entries, the form both sides are compared in.
+func tfAWSMapping(t *testing.T) []string {
+	t.Helper()
+
+	block := awsMappingBlock.FindStringSubmatch(readMainTF(t))
+	if block == nil {
+		t.Fatalf("%s: AWS branch of attribute_mapping not found", gcpTargetMainTF)
+	}
+	pairs := hclMappingPair.FindAllStringSubmatch(block[1], -1)
+	if len(pairs) == 0 {
+		t.Fatalf("%s: AWS attribute_mapping has no entries", gcpTargetMainTF)
+	}
+
+	got := make([]string, 0, len(pairs))
+	for _, p := range pairs {
+		got = append(got, p[1]+"="+p[2])
+	}
+	slices.Sort(got)
+	return got
+}
+
+// scriptAWSMapping returns the script's AWS attribute mapping as sorted
+// "key=value" entries. Every literal carrying the mapping must agree, so the
+// script cannot create a provider with one mapping and reconcile against
+// another.
+func scriptAWSMapping(t *testing.T) []string {
+	t.Helper()
+
+	raw, err := os.ReadFile(setupScript)
+	if err != nil {
+		t.Fatalf("read %s: %v", setupScript, err)
+	}
+	literals := scriptMappingLiteral.FindAllStringSubmatch(string(raw), -1)
+	if len(literals) == 0 {
+		t.Fatalf("%s: no --attribute-mapping dict containing attribute.aws_role found", setupScript)
+	}
+	for _, l := range literals[1:] {
+		if l[1] != literals[0][1] {
+			t.Fatalf("%s: AWS attribute mapping is spelled two different ways:\n%s\n%s", setupScript, literals[0][1], l[1])
+		}
+	}
+
+	got := strings.Split(literals[0][1], ",")
+	slices.Sort(got)
+	return got
+}
+
+// TestGCPTargetMappingMatchesSetupScript pins the two onboarding paths to the
+// same attribute mapping.
+//
+// The script refuses to reuse a provider whose configuration differs from the
+// one it would have written, so a mapping this module writes but the script
+// does not expect is not a cosmetic divergence: a customer onboarded via the
+// Terraform bundle who later runs the script against the same project is told
+// to delete the provider and start over, which detaches every live federated
+// session and which the next terraform apply then fights. An extra key does
+// that even when nothing reads its value, so the whole set is compared here,
+// not just the keys the attribute_condition and the impersonation grant consume.
+func TestGCPTargetMappingMatchesSetupScript(t *testing.T) {
+	tfMapping := tfAWSMapping(t)
+	scriptMapping := scriptAWSMapping(t)
+
+	if !slices.Equal(tfMapping, scriptMapping) {
+		t.Errorf("AWS attribute mapping differs between the two onboarding paths; a provider created by one is unusable by the other.\n%s:\n  %s\n%s:\n  %s",
+			gcpTargetMainTF, strings.Join(tfMapping, "\n  "),
+			setupScript, strings.Join(scriptMapping, "\n  "))
+	}
+}
+
 // extractTemplate models the extract() function available in GCP's workload
 // identity attribute-mapping CEL. The template is a literal containing exactly
 // one {placeholder}; the result is the text between the literal prefix and