Error creating Brand

[dominique-lambert-OBS]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Terraform Version & Provider Version(s)

Terraform v1.7.2 on Google cloud

• provider "registry.terraform.io/hashicorp/google" 6.10.0

Affected Resource(s)

google_iap_brand

Terraform Configuration

resource "google_iap_brand" "project_brand" {
  support_email     = "my_address@myorg.com"
  application_title = "Cloud IAP protected Application"
  project  = var.project_id
}
provider "google" {
  impersonate_service_account = var.sa-stack
}
sa-stack = "sa-stack@xxxxx.iam.gserviceaccount.com"
project_id      = "prj-xxxx"

Debug Output

Terraform will perform the following actions:

google_iap_brand.project_brand will be created

• resource "google_iap_brand" "project_brand" {
  • application_title = "Cloud IAP protected Application"
  • id = (known after apply)
  • name = (known after apply)
  • org_internal_only = (known after apply)
  • project = "prj-xxxx"
  • support_email = "my_address@myorg.com" }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve.

Enter a value: yes google_iap_brand.project_brand: Creating... ╷ │ Error: Error creating Brand: googleapi: Error 400: Request contains an invalid argument. │ │ with google_iap_brand.project_brand, │ on iap_web_app.tf line 1, in resource "google_iap_brand" "project_brand": │ 1: resource "google_iap_brand" "project_brand" { │ ╵

Expected Behavior

No response

Actual Behavior

the brand is note created

Steps to reproduce

1. terraform apply

Important Factoids

• The project is new and full empty
• iap.googleapis.com service is active
• sa-stack@xxxxx.iam.gserviceaccount.com as roles/oauthconfig.editor role
• use GOOGLE_APPLICATION_CREDENTIALS with a main SA that can impersonate sa-stack
• my_address@myorg.com is a valide internal user of my_myorg.com

References

No response

[ggtisc]

Hi @dominique-lambert-OBS

I tried to replicate this issue with the following code but everything was good without errors. I suggest you check your variables, read the terraform registry and API documentation to confirm each argument has a valid value and try it again. Also you can read how to Setting up IAP brand

• Example A:

resource "google_iap_brand" "iap_20204" {
  support_email     = "support@my-org.domain.net"
  application_title = "iap-20204"
  project           = "my-main-project-name"
}

• Example B:

resource "google_project" "project_20204" {
  name = "sub-project-20204"
  project_id = "sub-project-20204"
  org_id = "1234567890" #GOOGLE_ORG/ORG_ID
  billing_account = "012345A-67890B-098765C"
}

resource "google_iap_brand" "iap_20204" {
  support_email     = "support@my-org.domain.net"
  application_title = "iap-20204"
  project           = google_project.project_20204.name
}