skip destroyed key versions (#6669) (#4769)

Co-authored-by: Edward Sun <[email protected]> Signed-off-by: Modular Magician <[email protected]> Signed-off-by: Modular Magician <[email protected]> Co-authored-by: Edward Sun <[email protected]>
hashicorp · Oct 10, 2022 · 0d0fa67 · 0d0fa67
1 parent b6c0c51
commit 0d0fa67
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 9 deletions.
diff --git a/.changelog/6669.txt b/.changelog/6669.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+kms: fixed apply failure when `google_kms_crypto_key` is removed after its versions were destroyed earlier
+```
diff --git a/google-beta/kms_utils.go b/google-beta/kms_utils.go
@@ -188,15 +188,18 @@ func clearCryptoKeyVersions(cryptoKeyId *kmsCryptoKeyId, userAgent string, confi
 	}
 
 	for _, version := range versionsResponse.CryptoKeyVersions {
-		request := &cloudkms.DestroyCryptoKeyVersionRequest{}
-		destroyCall := versionsClient.Destroy(version.Name, request)
-		if config.UserProjectOverride {
-			destroyCall.Header().Set("X-Goog-User-Project", cryptoKeyId.KeyRingId.Project)
-		}
-		_, err = destroyCall.Do()
-
-		if err != nil {
-			return err
+		// skip the versions that have been destroyed earlier
+		if version.State == "ENABLED" {
+			request := &cloudkms.DestroyCryptoKeyVersionRequest{}
+			destroyCall := versionsClient.Destroy(version.Name, request)
+			if config.UserProjectOverride {
+				destroyCall.Header().Set("X-Goog-User-Project", cryptoKeyId.KeyRingId.Project)
+			}
+			_, err = destroyCall.Do()
+
+			if err != nil {
+				return err
+			}
 		}
 	}