GCS CreateBucketIAMPolicy task example not working as expected

[shrutimantri]

Expected Behavior

The role should get assigned to the member for the particular bucket present on the task.

Actual Behaviour

Getting the following error on executing the flow with the example task on this page:

PUT https://storage.googleapis.com/storage/v1/b/smantri-gcs-kestra-test-bucket/iam
{
  "code" : 400,
  "errors" : [ {
    "domain" : "global",
    "message" : "The member [email protected] is of an unknown type. Please set a valid type prefix for the member.",
    "reason" : "invalid"
  } ],
  "message" : "The member [email protected] is of an unknown type. Please set a valid type prefix for the member."
}
2024-01-29 14:16:20.781com.google.cloud.storage.StorageException: The member [email protected] is of an unknown type. Please set a valid type prefix for the member.
	at com.google.cloud.storage.StorageException.translate(StorageException.java:165)
	at com.google.cloud.storage.spi.v1.HttpStorageRpc.translate(HttpStorageRpc.java:313)
	at com.google.cloud.storage.spi.v1.HttpStorageRpc.setIamPolicy(HttpStorageRpc.java:1627)
	at com.google.cloud.storage.StorageImpl.lambda$setIamPolicy$48(StorageImpl.java:1469)
	at com.google.api.gax.retrying.DirectRetryingExecutor.submit(DirectRetryingExecutor.java:103)
	at com.google.cloud.RetryHelper.run(RetryHelper.java:76)
	at com.google.cloud.RetryHelper.runWithRetries(RetryHelper.java:50)
	at com.google.cloud.storage.Retrying.run(Retrying.java:65)
	at com.google.cloud.storage.StorageImpl.run(StorageImpl.java:1515)
	at com.google.cloud.storage.StorageImpl.setIamPolicy(StorageImpl.java:1467)
	at io.kestra.plugin.gcp.gcs.CreateBucketIamPolicy.run(CreateBucketIamPolicy.java:112)
	at io.kestra.plugin.gcp.gcs.CreateBucketIamPolicy.run(CreateBucketIamPolicy.java:20)
	at io.kestra.core.runners.Worker$WorkerThread.run(Worker.java:684)
Caused by: com.google.api.client.googleapis.json.GoogleJsonResponseException: 400 Bad Request
PUT https://storage.googleapis.com/storage/v1/b/smantri-gcs-kestra-test-bucket/iam
{
  "code" : 400,
  "errors" : [ {
    "domain" : "global",
    "message" : "The member [email protected] is of an unknown type. Please set a valid type prefix for the member.",
    "reason" : "invalid"
  } ],
  "message" : "The member [email protected] is of an unknown type. Please set a valid type prefix for the member."
}
	at com.google.api.client.googleapis.json.GoogleJsonResponseException.from(GoogleJsonResponseException.java:146)
	at com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:118)
	at com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:37)
	at com.google.api.client.googleapis.services.AbstractGoogleClientRequest$3.interceptResponse(AbstractGoogleClientRequest.java:466)
	at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1111)
	at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:552)
	at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:493)
	at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.execute(AbstractGoogleClientRequest.java:603)
	at com.google.cloud.storage.spi.v1.HttpStorageRpc.setIamPolicy(HttpStorageRpc.java:1624)
	... 10 more

Steps To Reproduce

1. I have provided "Security Admin" and "Storage Admin" roles to the service account used in "serviceAccount" property.
2. Created another service account: "[email protected]", and have not provided it any roles.
3. Used the flow as mentioned in the example task on this page

Environment Information

• Kestra Version:
• Plugin version:
• Operating System (OS / Docker / Kubernetes):
• Java Version (If not docker):

Example flow

id: gcp-gcs-create-bucket-iam-policy
namespace: company.team
tasks:
  - id: "create_bucket_iam_policy"
    type: "io.kestra.plugin.gcp.gcs.CreateBucketIamPolicy"
    serviceAccount: "{{ secret('GCP_SERVICE_ACCOUNT_JSON') }}"
    projectId: "<project_name>"
    name: "<bucket_name>"
    member: "<new_service_account>"
    role: "roles/storage.admin"