PaloAltoNetworks / terraform-provider-scm

The Terraform provider for Strata Cloud Manager
Apache License 2.0
7 stars 2 forks source link

api.strata.paloaltonetworks.com host provider parameter fails #8

Closed ancoleman closed 7 months ago

ancoleman commented 8 months ago

Describe the bug

When using this as my SCM provider configuration:

provider "scm" {
  client_id     = "sa@<myid>.iam.panserviceaccount.com"
  client_secret = "my_secret"
  scope         = "tsg_id:<myid>"
  host          = "api.strata.paloaltonetworks.com"
}

I receive this as an error when trying to apply configuration:

╷
│ Error: Error creating config
│ 
│   with module.security_policy_with_yaml.scm_external_dynamic_list.this["terraform-edl-gcp-ipv4-use"],
│   on ../../modules/policy/objects.tf line 81, in resource "scm_external_dynamic_list" "this":
│   81: resource "scm_external_dynamic_list" "this" {
│ 
│ no response received
╵

This does not happen when using:

host = "api.sase.paloaltonetworks.com"

Additionally, I have tried different formats for the scope and it does not fix the issue. Lastly, I thought maybe decryption was breaking some certificate exchange but after disabling VPN access, the result is still the same.

Expected behavior

host="api.strata.paloaltonetworks.com"

Using this as the host parameter should successfully build configuration.

Current behavior

Fails to apply configuration when using the host parameter mentioned above.

Possible solution

Sounds like maybe some kind of enforcement/restriction within the provider.

Steps to reproduce

  1. Set the host to api.strata.paloaltonetworks.com
  2. Run terraform apply on valid configuration data

Context

As we gravitate to our new management URLs, we should fully test and support all SCM API management URLs.

Your Environment

shinmog commented 7 months ago

I'm also seeing this error, but this is not something the provider has control over. There is literally no response coming from Strata Cloud Manager. I'm going to close this out because there's nothing the provider can do if the API itself is unresponsive...