google_privileged_access_manager_entitlement resource creation fails

villekr commented 2 weeks ago

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
If you are interested in working on this issue or have submitted a pull request, please leave a comment.
If an issue is assigned to a user, that user is claiming responsibility for the issue.
Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Terraform Version & Provider Version(s)

Terraform v1.9.6 on darwin_arm64

provider registry.terraform.io/hashicorp/google v6.4.0

Affected Resource(s)

google_privileged_access_manager_entitlement

Terraform Configuration

resource "google_privileged_access_manager_entitlement" "my_entitlement" {
  entitlement_id       = "entitlement-test"
  location             = "global"
  max_request_duration = "7200s"
  parent               = var.parent
  requester_justification_config {
    unstructured {}
  }
  eligible_users {
    principals = var.principals
  }
  privileged_access {
    gcp_iam_access {
      role_bindings {
        role = "roles/storage.admin"
      }
      resource      = "//cloudresourcemanager.googleapis.com/projects/${var.project_id}"
      resource_type = "cloudresourcemanager.googleapis.com/Project"
    }
  }
  approval_workflow {
    manual_approvals {
      require_approver_justification = true
      steps {
        approvals_needed = 1
        approvers {
          principals = var.approver_principals
        }
      }
    }
  }
}

Debug Output

https://gist.github.com/villekr/aaacbb8d38d67e58d6ea258c31c3cae4

Expected Behavior

GCP Priviledged Access Manager Entitlement should be created

Actual Behavior

Terraform apply gives an error:

│ Error: Error creating Entitlement: googleapi: got HTTP response code 404 with body: <!DOCTYPE html>
│ <html lang=en>
│   <meta charset=utf-8>
│   <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
│   <title>Error 404 (Not Found)!!1</title>
│   <style>
│     *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}
│   </style>
│   <a href=//www.google.com/><span id=logo aria-label=Google></span></a>
│   <p><b>404.</b> <ins>That’s an error.</ins>
│   <p>The requested URL <code>/v1/folder/**************/locations/global/entitlements?alt=json&amp;entitlementId=entitlement-test</code> was not found on this server.  <ins>That’s all we know.</ins>
│
│
│   with google_privileged_access_manager_entitlement.my_entitlement,
│   on main.tf line 6, in resource "google_privileged_access_manager_entitlement" "my_entitlement":
│    6: resource "google_privileged_access_manager_entitlement" "my_entitlement" {

Steps to reproduce

terraform apply

Important Factoids

I'm able to create entitlement from to exact same project:

Using gcp console
Using gcloud cli

But not with terraform.

References

No response

slevenick commented 2 weeks ago

Looks like an issue with the parent variable. The request seems to be going to /v1/folder/... but it should be going to /v1/folder**s**/. I think you can just change the parent to include this s and I would guess it would work.

slevenick commented 2 weeks ago

@villekr can you try adding the s to folder and see if it works?

villekr commented 1 week ago

Yep, that was it. Silly mistake, thanks for pointing that out.

hashicorp / terraform-provider-google