Error on creating google_compute_region_network_endpoint_group with API Gateway backend

[cgrotz]

When trying to create a serverless neg with an API gateway backend, I get the following error message:

google_compute_region_network_endpoint_group.api_gw_neg: Creating...
╷
│ Error: Error creating RegionNetworkEndpointGroup: googleapi: Error 400: Invalid value for field 'resource.creationTimestamp': ''. Must be a match of regex '(?:[0-9a-z][0-9a-z-]{0,48})'., invalid
│ 
│   with google_compute_region_network_endpoint_group.api_gw_neg,
│   on lb.tf line 1, in resource "google_compute_region_network_endpoint_group" "api_gw_neg":
│    1: resource "google_compute_region_network_endpoint_group" "api_gw_neg" {
│ 

Terraform Version

Terraform v1.0.3 on linux_amd64

• provider registry.terraform.io/hashicorp/google v4.27.0
• provider registry.terraform.io/hashicorp/google-beta v4.27.0
• provider registry.terraform.io/hashicorp/random v3.3.2

Affected Resource(s)

• google_compute_region_network_endpoint_group

Terraform Configuration Files

...
resource "google_api_gateway_gateway" "api_gw" {
  provider   = google-beta
  project    = var.project_id
  region     = var.region
  api_config = google_api_gateway_api_config.api_cfg.id
  gateway_id = "api-gw"
  depends_on = [
    google_api_gateway_api_config.api_cfg,
    google_api_gateway_api.api,
    google_project_service.project
  ]
}

resource "google_compute_region_network_endpoint_group" "api_gw_neg" {
  provider              = google-beta
  name                  = "api-gw-neg"
  network_endpoint_type = "SERVERLESS"
  project               = var.project_id
  region                = var.region
  serverless_deployment {
    platform = "apigateway.googleapis.com"
    resource = google_api_gateway_gateway.api_gw.name
  }
}

Debug Output

Need to clean that up first, since there are a lot of keys in that log.

Expected Behavior

The NEG is created without error.

Actual Behavior

Creation fails.

Steps to Reproduce

1. terraform apply

b/313620147

[rileykarson]

This error is coming from the API, refers to a field not implemented at all in the provider, and one that's output only per https://cloud.google.com/compute/docs/reference/rest/beta/regionNetworkEndpointGroups. Is it possible the issue here is at the API level rather than in the provider?

[cgrotz]

That's strange, when inserting via API Explorer it works without providing a creationTimestamp. (If I provide an empty creationTimestamp it works as well, even with random gibberish. It seems the value is ignored).

{
  "networkEndpointType": "SERVERLESS",
  "serverlessDeployment": {
    "platform": "apigateway.googleapis.com",
    "resource": "api-gw"
  },
  "name": "test-sneg"
}

I also don't get an error when fetching the resource via the API Explorer.

Any idea how we can investigate this further?

[edwardmedia]

@cgrotz can you share the debug log when you applied the config? You may mark up the secrets but I'd like to take a closer look at the api requests & responses.

[cgrotz]

I was using the wrong attribute to reference the gateway:

...
    resource = google_api_gateway_gateway.api_gw.name
...

instead of

...
    resource = google_api_gateway_gateway.api_gw.gateway_id
...

The error message from the API is misleading (creationTime instead of resourceName). I opened a bug with the API Gateway team.

[edwardmedia]

label this as upstream issue

[StephenWithPH]

https://github.com/hashicorp/terraform-provider-google/issues/12051#issuecomment-1180899823 shows GCP support's successful workaround with cloud_function.

[danielvaughan]

I had a similar issue and was able to resolve it.

I had put:

resource "google_compute_region_network_endpoint_group" "neg" {
  provider              = google-beta
  name                  = "citadel-neg"
  network_endpoint_type = "SERVERLESS"
  region                = var.region
  serverless_deployment {
    platform = "apigateway.googleapis.com"
    resource = google_api_gateway_gateway.api_gw.id
  }
}

This resulted in the same confusing error as in the post: Error: Error creating RegionNetworkEndpointGroup: googleapi: Error 400: Invalid value for field 'resource.creationTimestamp': ''. Must be a match of regex '(?:[0-9a-z][0-9a-z-]{0,48})'., invalid

I resolved it with

resource "google_compute_region_network_endpoint_group" "neg" {
  provider              = google-beta
  name                  = "citadel-neg"
  network_endpoint_type = "SERVERLESS"
  region                = var.region
  serverless_deployment {
    platform = "apigateway.googleapis.com"
    resource = google_api_gateway_gateway.api_gw.gateway_id
  }
}

That is using gateway_id to identify the resource instead of id as with @cgrotz

[cgrotz]

Yes, the error message is misleading, we have a bug ticket open upstream. There is a comment further up the thread where it's mentioned that you need to use the gateway_id property when referencing the API gateway.

[acoover]

thank you for keeping this bug report open - helped me identify what was wrong w/ my tf config