terraform-ibm-modules / terraform-ibm-landing-zone-vpc

Creates virtual servers across subnets in a single VPC connected by a single security group. Supports floating IP addresses and multiple load balancers.
Apache License 2.0
5 stars 13 forks source link

ibm_is_vpc_dns_resolution_binding between VPCs now requires auth policy #757

Closed toddgiguere closed 6 months ago

toddgiguere commented 7 months ago

The latest test of example hub-spoke-delegated-resolver is failing to set up the DNS resolver in the spoke VPC with the following error:

Error: CreateVPCDnsResolutionBindingWithContext failed the provided token is not authorized to connect the specified dns-resolution-binding (ID:r006-96473c8b-81a7-4738-b588-e91601e70bb4) in this account

In the IBM Cloud Web UI for VPC, when setting up a DNS resolver manually, the following text is displayed:

Important: The DNS hub VPC administrator must create a service-to-service authentication policy that grants this DNS-shared VPC DNSBindingConnector permission on the DNS hub VPC.

This might be a new requirement, as this example (and test case) have been running successfully up until March 19 2024, and only the most recent test run of the example (March 26) is reporting this error with no other changes to the module in that time.