# Can you explain why Terraform plan gives for IAM gives "deleted:serviceAccount" result?

**URL:** <https://discuss.hashicorp.com/t/can-you-explain-why-terraform-plan-gives-for-iam-gives-deleted-serviceaccount-result/55173>\
**Category:** Google\
**Created:** [June 19, 2023, 3:09pm UTC](https://discuss.hashicorp.com/t/can-you-explain-why-terraform-plan-gives-for-iam-gives-deleted-serviceaccount-result/55173 "2023-06-19T15:09:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mike.james](https://avatars.discourse-cdn.com/v4/letter/m/53a042/32.png) [@mike.james](https://discuss.hashicorp.com/u/mike.james)\
**Post date:** [June 19, 2023, 3:09pm UTC](https://discuss.hashicorp.com/t/can-you-explain-why-terraform-plan-gives-for-iam-gives-deleted-serviceaccount-result/55173/1 "2023-06-19T15:09:52Z")

</div>

When I ran terraform plan on this shared project, I see the following type of output that I’ve never seen before. Why is the serviceAccount displayed this way? If it was deleted, why does it appear at all? And how do I reconcile this with my TF code. btw, the github actions were created / deleted by a different developer.

```auto
# google_project_iam_binding.kubernetes_engine_developer_role will be updated in-place
  ~ resource "google_project_iam_binding" "kubernetes_engine_developer_role" {
        id = "clutch-platform-dev/roles/container.developer"
      ~ members = [
          - "deleted:serviceAccount:github-actions-gke-gcr@my-platform-dev.iam.gserviceaccount.com?uid=104021681630303037318",

```

---

<div class="post-metadata">

**Author:** ![maxb](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/maxb/32/26655_2.png) [@maxb](https://discuss.hashicorp.com/u/maxb)\
**Post date:** [June 19, 2023, 3:54pm UTC](https://discuss.hashicorp.com/t/can-you-explain-why-terraform-plan-gives-for-iam-gives-deleted-serviceaccount-result/55173/2 "2023-06-19T15:54:50Z")

</div>

I’ve never encountered exactly this, but this is what I’d **guess** this is saying:

- A Google service account was deleted
- The deleted service account’s ID still exists within the IAM role binding
- Terraform is now planning to remove that

---

<div class="post-metadata">

**Author:** ![mike.james](https://avatars.discourse-cdn.com/v4/letter/m/53a042/32.png) [@mike.james](https://discuss.hashicorp.com/u/mike.james)\
**Post date:** [June 19, 2023, 4:21pm UTC](https://discuss.hashicorp.com/t/can-you-explain-why-terraform-plan-gives-for-iam-gives-deleted-serviceaccount-result/55173/3 "2023-06-19T16:21:15Z")

</div>

Thanks! I think you’re exactly correct. I just checked in the Google console and the deleted service account does indeed still have IAM bindings!