terraform apply
2018/06/04 20:51:24 [WARN] Invalid log level: "1". Defaulting to level: TRACE. Valid levels are: [TRACE DEBUG INFO WARN ERROR]
google_storage_bucket.sinmetal-terraform-20180327b: Refreshing state... (ID: sinmetal-terraform-20180327b)
google_storage_bucket.sinmetal-terraform-20180327a: Refreshing state... (ID: sinmetal-terraform-20180327a)
google_bigquery_dataset.log-dataset: Refreshing state... (ID: logging-sinmetal-org:organization_audit_log)
google_storage_bucket.sinmetal-terraform-20180327c: Refreshing state... (ID: sinmetal-terraform-20180327c)
google_logging_organization_sink.organization-auditlog-sink: Refreshing state... (ID: organizations/69165754818/sinks/organization-auditlog-sink)
google_logging_organization_sink.organization-gae-sink: Refreshing state... (ID: organizations/69165754818/sinks/organization-gae-sink)
google_project_iam_binding.log-writer: Refreshing state... (ID: logging-sinmetal-org/roles/bigquery.dataEditor)
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
+ google_project_services.project
id: <computed>
disable_on_destroy: "true"
project: "sinmetal-terraform"
services.#: "9"
services.1109577435: "cloudbuild.googleapis.com"
services.1560437671: "iam.googleapis.com"
services.1610229196: "bigquery-json.googleapis.com"
services.1954675454: "serviceusage.googleapis.com"
services.2117420113: "pubsub.googleapis.com"
services.238136042: "cloudapis.googleapis.com"
services.3266434626: "bigquery.googleapis.com"
services.3644083179: "cloudresourcemanager.googleapis.com"
services.3872232641: "storage.googleapis.com"
Plan: 1 to add, 0 to change, 0 to destroy.
Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.
Enter a value: yes
google_project_services.project: Creating...
disable_on_destroy: "" => "true"
project: "" => "sinmetal-terraform"
services.#: "" => "9"
services.1109577435: "" => "cloudbuild.googleapis.com"
services.1560437671: "" => "iam.googleapis.com"
services.1610229196: "" => "bigquery-json.googleapis.com"
services.1954675454: "" => "serviceusage.googleapis.com"
services.2117420113: "" => "pubsub.googleapis.com"
services.238136042: "" => "cloudapis.googleapis.com"
services.3266434626: "" => "bigquery.googleapis.com"
services.3644083179: "" => "cloudresourcemanager.googleapis.com"
services.3872232641: "" => "storage.googleapis.com"
google_project_services.project: Still creating... (10s elapsed)
Error: Error applying plan:
1 error(s) occurred:
* google_project_services.project: 1 error(s) occurred:
* google_project_services.project: Error creating services: Error enabling service ["storage.googleapis.com" "iam.googleapis.com" "bigquery-json.googleapis.com" "cloudapis.googleapis.com" "bigquery.googleapis.com" "cloudbuild.googleapis.com"] for project "sinmetal-terraform": googleapi: Error 403: The caller does not have permission, forbidden
Terraform does not automatically rollback in the face of errors.
Instead, your Terraform state file has been partially updated with
any resources that successfully completed. Please address the error
above and apply again to incrementally change your infrastructure.
google_project_service/google_project_services now use the Service Usage API. Users of those resources will need to enable the API at https://console.cloud.google.com/apis/api/serviceusage.googleapis.com.
https://github.com/terraform-providers/terraform-provider-google/blob/master/CHANGELOG.md#1130-may-24-2018
Problem
Terraform GCP Provider 1.13.0 で google_project_services を利用すると、403で転ける。転けた時にAPIがDisableになるっぽいので、全体的に死ぬ。
Try Log
google_project_services.tf
terraform apply log
terraform debug log
All Log
WHY
GCP Provider 1.13.0からAPIのEnable/Disableを行うAPIを、 Service Management API から Service Usage API に変更している。
https://github.com/terraform-providers/terraform-provider-google/blob/master/CHANGELOG.md#1130-may-24-2018
その後、Service Usage API側で仕様変更か何かがあったのか、動かなくなってしまったようだ。 この問題は https://github.com/terraform-providers/terraform-provider-google/issues/1538 で議論されている。