Closed nikki-kapil closed 3 years ago
A 400 error typically means it's a duplicate - was this project already added to Prisma Cloud?
If I go to PrismaCloud > Inventory > Cloud Account - I don't see the project to which my GCP Service account belongs.
Could there be another cause to this error, like:
I would suggest enabling logging so we can see what API is actually returning the error. Please post the results here.
DEBUG logs:
[WARN] Provider "registry.terraform.io/paloaltonetworks/prismacloud" produced an invalid plan for module.organisation_bootstrap.prismacloud_cloud_account.prismacloud_account, but we are tolerating it because it is using the legacy plugin SDK.
The following problems may be the cause of any confusing errors from downstream operations:
- .gcp[0].enabled: planned value cty.True does not match config value cty.NullVal(cty.Bool)
[DEBUG] EvalApply: ProviderMeta config value set
[DEBUG] module.organisation_bootstrap.prismacloud_cloud_account.prismacloud_account: applying the planned Create change
[0m[1mmodule.organisation_bootstrap.prismacloud_cloud_account.prismacloud_account: Creating...[0m[0m
2020-11-03T14:42:03.664Z [DEBUG] plugin.terraform-provider-prismacloud_v1.0.4: (create) gcp cloud account
[DEBUG] module.organisation_bootstrap.prismacloud_cloud_account.prismacloud_account: apply errored, but we're indicating that via the Error pointer rather than returning it: 400/https://api2.eu.prismacloud.io/cloud/gcp Error(msg:invalid_gcp_project_id severity:error subject:invalid_parameter_value)
[ERROR] eval: *terraform.EvalApplyPost, err: 400/https://api2.eu.prismacloud.io/cloud/gcp Error(msg:invalid_gcp_project_id severity:error subject:invalid_parameter_value)
[ERROR] eval: *terraform.EvalSequence, err: 400/https://api2.eu.prismacloud.io/cloud/gcp Error(msg:invalid_gcp_project_id severity:error subject:invalid_parameter_value)
[DEBUG] plugin.terraform-provider-google_v3.44.0_x5: 2020/11/03 14:42:04 [DEBUG] Google API Response Details:
[DEBUG] plugin.terraform-provider-google_v3.44.0_x5: ---[ RESPONSE ]--------------------------------------
[DEBUG] plugin.terraform-provider-google_v3.44.0_x5: HTTP/1.1 200 OK
[DEBUG] plugin.terraform-provider-google_v3.44.0_x5: Connection: close
Oh I see the issue - you need to pass the project id in the account_id field and you are passing the service account instead. Give that a try!
Still no joy:
2020-11-05T09:22:44.935Z [DEBUG] plugin: plugin process exited: path=.terraform/plugins/registry.terraform.io/hashicorp/tfe/0.22.0/linux_amd64/terraform-provider-tfe_v0.22.0_x4 pid=1866
2020-11-05T09:22:44.935Z [DEBUG] plugin: plugin exited
2020/11/05 09:22:45 [WARN] Provider "registry.terraform.io/paloaltonetworks/prismacloud" produced an invalid plan for module.organisation_bootstrap.prismacloud_cloud_account.prismacloud_account, but we are tolerating it because it is using the legacy plugin SDK.
The following problems may be the cause of any confusing errors from downstream operations:
- .gcp[0].enabled: planned value cty.True does not match config value cty.NullVal(cty.Bool)
[0m[1mmodule.organisation_bootstrap.prismacloud_cloud_account.prismacloud_account: Creating...[0m[0m
2020/11/05 09:22:45 [DEBUG] EvalApply: ProviderMeta config value set
2020/11/05 09:22:45 [DEBUG] module.organisation_bootstrap.prismacloud_cloud_account.prismacloud_account: applying the planned Create change
2020-11-05T09:22:45.198Z [DEBUG] plugin.terraform-provider-prismacloud_v1.0.4: 2020/11/05 09:22:45 (create) gcp cloud account
2020/11/05 09:22:45 [DEBUG] module.organisation_bootstrap.prismacloud_cloud_account.prismacloud_account: apply errored, but we're indicating that via the Error pointer rather than returning it: 400/https://api2.eu.prismacloud.io/cloud/gcp Error(msg:invalid_gcp_project_id severity:error subject:invalid_parameter_value)
2020/11/05 09:22:45 [ERROR] eval: *terraform.EvalApplyPost, err: 400/https://api2.eu.prismacloud.io/cloud/gcp Error(msg:invalid_gcp_project_id severity:error subject:invalid_parameter_value)
2020/11/05 09:22:45 [ERROR] eval: *terraform.EvalSequence, err: 400/https://api2.eu.prismacloud.io/cloud/gcp Error(msg:invalid_gcp_project_id severity:error subject:invalid_parameter_value)
[31m
[1m[31mError: [0m[0m[1mError running command 'PATH=/home/thomas_s_chalmers/organisation-setup/.terraform/modules/organisation_bootstrap.seed_project.project-factory.gcloud_delete/cache/1444d067/google-cloud-sdk/bin:$PATH
gcloud info
': exit status 127. Output: /bin/sh: 2: gcloud: not found
[0m
[0m[0m[0m
[31m
[1m[31mError: [0m[0m[1m400/https://api2.eu.prismacloud.io/cloud/gcp Error(msg:invalid_gcp_project_id severity:error subject:invalid_parameter_value)[0m
[0m on library/organisation-bootstrap/main.tf line 191, in resource "prismacloud_cloud_account" "prismacloud_account":
191: resource "prismacloud_cloud_account" "prismacloud_account" [4m{[0m
[0m
[0m[0m
2020-11-05T09:22:45.628Z [WARN] plugin.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = transport is closing"
2020-11-05T09:22:45.630Z [DEBUG] plugin: plugin process exited: path=.terraform/plugins/registry.terraform.io/hashicorp/null/2.1.2/linux_amd64/terraform-provider-null_v2.1.2_x4 pid=1834
Are you setting logging for send and receive to true? I should see more output on the actual API calls being made...
I am running this on TerraformCloud and have set TF_LOG to DEBUG. Is that what you are talking about?
Is this the way to set logging you've asked for:
provider "prismacloud" {
url = var.prismaurl
username = var.prismauser
password = var.prismatoken
customer_name = var.prismacustomername
protocol = "https"
skip_ssl_cert_verification = true
logging = {
send = "true"
receive = "true"
}
}
Yes that looks correct.
That didn't affect the logging though. Could you provide an example of the resource prismacloud_cloud_account that is GCP specific?
Looks like the GCP cloud API changed so the TF provider is currently broken for GCP. I will work to get that fixed.
I fixed this so GCP should work correctly now. Syntax:
resource "prismacloud_cloud_account" "prismacloud_account" { gcp { account_id = "carbide-buckeye-239422" enabled = true group_ids = [ "e6e0e0a9-9749-4c72-9819-86a92ec83489" ] name = "Eddie test" credentials_json = file("cred.json") } }
Thanks Eddie. So the good news is that using v1.0.5 of the provider did create an account for me in Prisma (at project level). But I wanted to create the account at 'organisation level' rather than 'project level'. Can you provide the syntax to create an org level account too please?
Unfortunately, the TF provider doesn't support Orgs for AWS or GCP as of yet. It's on the list to get done in the near future.
BTW I did figure out why logging wasn't working - needs to be added via json_config_file = "config.json". If you add the logging section to that config.json, and then call using TF_LOG, then it should output correctly.
Unfortunately, the TF provider doesn't support Orgs for AWS or GCP as of yet. It's on the list to get done in the near future.
Can I vote for this feature somewhere? Also, any idea on it's ETA?
Also, if not already done could you update the docs here https://registry.terraform.io/providers/PaloAltoNetworks/prismacloud/latest/docs/resources/cloud_account to say that the TF provider doesn't support Orgs for AWS or GCP as of yet.
Yes, if you have access to the Prisma Cloud UI, you can click on the question mark icon in bottom right, then click on Product and Submit a request for filing a feature request. Hopefully, it can be added by EOY. I am planning to update the docs today for the new options I added yesterday and I will put in a note regarding AWS/GCP orgs.
Closing out since issue is now fixed.
Documentation link
Please provide an example inserting GCP Service account keys into resource prismacloud__cloud_account
Describe the problem
I am trying to create a Service Account on GCP and then inserting its key into Prisma using this provider. Here is my code:
This is the error I get on running 'terraform apply':
Suggested fix
What does the above error mean?
'terraform plan' seems to work fine but the 'apply' fails, please could you elaborate what parameter value is invalid, what should it be, what project id is invalid?