From 90295669ecfd8944d8aeaa0b172b25eb6ed966b5 Mon Sep 17 00:00:00 2001
From: jeffreyhung <17494876+Jeffreyhung@users.noreply.github.com>
Date: Mon, 27 Jul 2026 10:50:03 -0700
Subject: [PATCH] add getAuthString for tf-plan

---
 terraform/iam.tf | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/terraform/iam.tf b/terraform/iam.tf
index f30af27..23a5ba5 100644
--- a/terraform/iam.tf
+++ b/terraform/iam.tf
@@ -369,8 +369,10 @@ resource "google_project_iam_custom_role" "tf_plan_reader" {
     # Fleet / GKE Hub
     "gkehub.memberships.get",
     "gkehub.memberships.list",
-    # Memorystore Redis
+    # Memorystore Redis (getAuthString is required to refresh auth_string on
+    # google_redis_instance — used by kubernetes_secret.redis_auth during plan)
     "redis.instances.get",
+    "redis.instances.getAuthString",
     "redis.instances.list",
     # Private Service Access connection used by Memorystore
     "servicenetworking.services.get",