All authoritative GCP IAM bindings have atrocious behaviour in that if you create a new tf resource for a GCP resource with existing bindings it won’t check if there are any existing bindings and will totally overwrite it.