App engine API unnecessarily required for project creation

[morgante]

Terraform Version

Terraform v0.11.7
+ provider.google (unversioned)
+ provider.gsuite (unversioned)
+ provider.null v1.0.0
+ provider.random v1.2.0

Affected Resource(s)

Please list the resources as a list, for example:

• google_project

Summary

When I try to create a project using a Service Account, it fails unless the Service Account's project has the App Engine API enabled. After #1503, if I create Project B using Service Account A (which lives in Project A), it requires that I activate the App Engine API in Project A.

Config

resource "google_project" "test_project" {
  name                = "mkt-test-project-93"
  project_id          = "mkt-test-project-93"
  org_id              = "${local.organization_id}"
  billing_account     = "${local.billing_account}"
  auto_create_network = "false"
}

Expected Behavior

It should create a project with no errors, since I'm not even trying to set up App Engine.

Actual Behavior

I got this error:

* google_project.test_project: 1 error(s) occurred:

* google_project.test_project: Error retrieving App Engine application "mkt-test-project-93": googleapi: Error 403: App Engine Admin API has not been used in project 956537668115 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/appengine.googleapis.com/overview?project=956537668115 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry., accessNotConfigured

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform apply -target=google_project.test_project

References

• Add App Engine Application support #1503

[paddycarver]

Argh, it seems this is my week to get bitten by this. Here's what I've got on this issue for the moment:

We're operating under the belief that the target project (the project the app is getting created in) needs the App Engine Admin API turned on, and only the target project. So we turn that API on as part of project creation, because there's no opportunity for a user to turn it on--the project is created, and we need the App Engine Admin API before that creation is completed, so we take care of the service enablement inline.

From what you're describing, it sounds like the source project, the project Terraform is authenticated with, also needs that API turned on. If that's the case, we normally consider that to be the user's responsibility, because they have the opportunity to enable it (either manually, or using google_project_service(s)).

I'm going to take a look at this right now, and figure out if we need the App Engine Admin API turned on for the source, the target, or both. If just for the source, I'll remove the code enabling it for the target, as that's no longer necessary. If just for the target, I'll need some more info to get to the bottom of this, most likely the debug logs. If it's required for both, I think I'd leave the code the way it is, and just document that the source project needs to have App Engine's Admin API enabled, too.

[morgante]

Hi @paddycarver, that makes sense and I believe it's correct that the source project does indeed need it.

However, in my configuration I don't use App Engine at all - I don't have any App Engine block. In that case, I don't think I should have to (or want to) activate the App Engine Admin API on any project.

[paddycarver]

Oh, I'm sorry, I misread and got ahead of myself. I just merged #1523, which should address the issue. If you build off master, this should be resolved. Sorry for the confusion there!

[paddycarver]

#1523 has been released, and I think this is issue is resolved now. I'm going to close this out, but if anyone is experiencing this still, please feel free to comment and we can reopen this and investigate it.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!