unable to remove security_policy of http load balancer

[alexandre-sk5]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• If an issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to "hashibot", a community member has claimed the issue already.

Version

Terraform v0.11.13 (same issue with v0.11.14)
Google Provider v2.9.1
Google Beta Provider v2.9.1

Affected Resource(s)

• google_compute_security_policy
• google_compute_backend_service

Issue

I have a HTTP Load balancer created by lb-http module from google.
A security_policy has been attached to this lb during the creation with terraform.

Now, i want to remove the security_policy of the lb. So here is the steps :

1) Replace security_policy self_link by "" in terraform code

module "gce-lb-http" {
  source               = "git::ssh://internal_source_of_module"
  version              = "v1.0.0"
  name                 = "${var.name}"
  target_tags          = ["http"]
  create_url_map       = true
  ssl                  = true
  use_ssl_certificates = true
  security_policy      = ""

2) Plan of the new configuration

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  ~ module.gce-lb-http.google_compute_backend_service.default
      security_policy: "https://www.googleapis.com/compute/v1/projects/my_project/global/securityPolicies/my_security_policy" => ""

Plan: 0 to add, 1 to change, 0 to destroy.

Here we see that the currently in place security policy will be replaced by "", or nothing ...

3) Apply of the new configuration

module.gce-lb-http.google_compute_backend_service.default: Modifying... (ID: my_lb_backend)
  security_policy: "https://www.googleapis.com/compute/v1/projects/my_project/global/securityPolicies/my_security_policy" => ""
module.gce-lb-http.google_compute_backend_service.default: Modifications complete after 9s (ID: my_lb_backend)

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

Normally, the security_policy has been removed. But it's not working...
If i do a new terraform plan, i have the same status as before

Terraform will perform the following actions:

  ~ module.gce-lb-http.google_compute_backend_service.default
      security_policy: "https://www.googleapis.com/compute/v1/projects/my_project/global/securityPolicies/my_security_policy" => ""

Plan: 0 to add, 1 to change, 0 to destroy.

The security_policy hasn't been removed on GCP, and the tfstate hasn't been updated. By the way, i don't have any errors or specific message...
I can't remove it with terraform, i need to use gcloud or web console.

[Chupaka]

We faced that some time ago, and after I tried to repeat that in lab I failed: TF removed security policy a few times in a row, so I stopped my experiments...

So looks like you need to provide Debug log

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!