nphilbrook
commented
2 years ago While poking around the API I discovered that while you can do this operation via gcloud as I pasted an example above, the REST API directly does not accept the namespacedName format :rage:
@lydia ~/temp $ cat tagbinding.json
{
"parent": "//cloudresourcemanager.googleapis.com/folders/12345",
"tagValue": "67890/foo/bar"
}
@lydia ~/temp $ curl -H "Authorization: Bearer $(gcloud auth print-access-token)" -H "Content-Type: application/json" -d @tagbinding.json "https://cloudresourcemanager.googleapis.com/v3/tagBindings"
{
"error": {
"code": 400,
"message": "field [binding.tag_value] has issue [Must be a resource name for a tag value]",
"status": "INVALID_ARGUMENT",
"details": [
{
"@type": "type.googleapis.com/google.rpc.BadRequest",
"fieldViolations": [
{
"field": "binding.tag_value",
"description": "Must be a resource name for a tag value"
}
]
}
]
}
}This is frustrating and it follows now why the TF resource doesn't accept this value either, as it's a thin mapping over the REST layer (as I understand it). gcloud must be doing a lookup in the background.
I may pivot to creating a data resource for tag values which would at least get us where we need to go.
rileykarson
ggtisc
roaks3
cherriford
Community Note
Description
The
google_tags_tag_bindingresource only accepts thenamefor thetag_valueargument, which is in the formattagValues/12345- e.g. there is nothing in this value that is readable or contains the tag value's descriptive shortname.Via the GCP API you can use either the
nameOR thenamespacedNamewhen creating a tag binding - the namespaced name is in the format<org_id>/<key short name>/<value short name>and is much more descriptive/readable.In our initial rollout of GCP IAM tags we are struggling with writing readable configuration using
tagValues/XXXXformat. For example, we have a module for which we want to accept a tag value so that we can tag the created resources using this value. But passing intagValues/XXXXdoesn't denote anything descriptive about what the tag value actually is, and even finding the correct value to use is problematic. We considered storing our own copy of namespacedName -> name mappings (which we may still do if this request is rejected). But this seems pretty silly given that you can do this with gcloud:Notably there is also a lack of any data resources so we can't look up the
nameof a tagValue given thenamespacedName.New or Affected Resource(s)
Potential Terraform Configuration
Where 12345 is the ID of a folder, 345678 is the ID of an organization,
tag_key_short_name_foois the shortName of a tag key, andtag_value_short_name_baris the shortName of a tag value.References
I could not find any issues requesting this feature.
GCP docs describing the gcloud call I demonstrated above terraform-provider-google docs describing only the
tagValues/XXXXformat being acceptedN.b. I hope that myself or one of my teammates at Wayfair can contribute this feature in the near future, but as PRs need to reference an issue I am starting with this issue and appreciate any feedback on the feature request.
b/361104631