search

terraform-google-modules / terraform-example-foundation

Shows how the CFT modules can be composed to build a secure cloud foundation
https://cloud.google.com/architecture/security-foundations
Apache License 2.0
1.21k stars 708 forks source link

1-org step Terraform Plan fails on Cloud Build due to missing API Enablements and Roles #15

Closed garrettwong closed 4 years ago

garrettwong commented 4 years ago

On the 1-org Cloud Build phase, received issues on APIs and Missing Roles.

An example of the API errors:

Step #3: Error: Error reading KMSKeyRing "projects/$PROJECT_ID/locations/australia-southeast1/keyRings/tf-keyring": googleapi: Error 403: Cloud Key Management Service (KMS) API has not been used in project $PROJECT_NUMBER before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/cloudkms.googleapis.com/overview?project=$PROJECT_NUMBER then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.

An example of the Roles/Permission errors:

Step #3: Error: Error reading CloudBuildTrigger "projects/cft-cloudbuild-9091/triggers/4a44918f-10d7-48f4-b613-bb9549c05a77": googleapi: Error 403: Cloud Build API has not been used in project 565375199005 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/cloudbuild.googleapis.com/overview?project=565375199005 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.

I was able to resolve this by, enabling APIs in the Seed Project:

and adding Roles to the org-terraform service account on the Cloud Build Project:

rjerrems commented 4 years ago

Thanks for the report @garrettwong - can you share how you executed the terraform? (locally vs via cloud build)

garrettwong commented 4 years ago

I received the error on both methods. Following the instructions, I believe I hit the error in Cloud Build first.

rjerrems commented 4 years ago

When you get a chance can you confirm what project 565375199005 is, is it the cft-cloudbuild project? If so, those APIs should get enabled automatically and have explicit depends on before trying to create triggers / kms objects https://github.com/terraform-google-modules/terraform-google-bootstrap/blob/master/modules/cloudbuild/main.tf#L50