can't create google_service_networking_connection according our guide

[zhanzhen-sh]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• If an issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to "hashibot", a community member has claimed the issue already.

Terraform Version

$ terraform version
Terraform v0.12.5

• provider.google v2.5.1
• provider.google-beta v2.5.1
• provider.random v2.1.2

Affected Resource(s)

• google_service_networking_connection
• google_sql_database_instance

Terraform Configuration Files

`resource "google_compute_network" "vpc_network" {
name = "${var.network_name}"
auto_create_subnetworks = "false"
routing_mode = "REGIONAL"
}

resource "google_compute_global_address" "private_ip_address" {
provider = "google-beta"
name = "private-ip-address"
purpose = "VPC_PEERING"
address_type = "INTERNAL"
prefix_length = 16
network = "${google_compute_network.vpc_network.self_link}"
}

resource "google_service_networking_connection" "private_vpc_connection" {
provider = "google-beta"
network = "${google_compute_network.vpc_network.self_link}"
service = "servicenetworking.googleapis.com"
reserved_peering_ranges = ["${google_compute_global_address.private_ip_address.name}"]
}
`

Debug Output

` 2019/07/21 07:35:31 [DEBUG] Google API Request Details:
---[ REQUEST ]---------------------------------------
POST /v1beta/services/servicenetworking.googleapis.com/connections?alt=json&prettyPrint=false HTTP/1.1
Host: servicenetworking.googleapis.com
User-Agent: google-api-go-client/0.5 Terraform/0.12.0 (+https://www.terraform.io) terraform-provider-google-beta/2.5.1
Content-Length: 115
Content-Type: application/json
Accept-Encoding: gzip

{
"network": "projects/87814722026/global/networks/aaa-zhanzhen-net",
"reservedPeeringRanges": [
"private-ip-address"
]
}

---

2019/07/21 07:35:32 [DEBUG] Google API Response Details:
---[ RESPONSE ]--------------------------------------
HTTP/2.0 403 Forbidden
Alt-Svc: quic=":443"; ma=2592000; v="46,43,39"
Cache-Control: private
Content-Type: application/json; charset=UTF-8
Date: Sat, 20 Jul 2019 23:35:32 GMT
Server: ESF
Vary: Origin
Vary: X-Origin
Vary: Referer
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 0

{
"error": {
"code": 403,
"message": "The caller does not have permission",
"errors": [
{
"message": "The caller does not have permission",
"domain": "global",
"reason": "forbidden"
}
],
"status": "PERMISSION_DENIED"
}
}

-----------------------------------------------------`

Expected Behavior

google_service_networking_connection was created normally

Actual Behavior

google_compute_network.vpc_network: Creating...
google_compute_network.vpc_network: Still creating... [10s elapsed]
google_compute_network.vpc_network: Still creating... [20s elapsed]
google_compute_network.vpc_network: Creation complete after 30s [id=aaa-zhanzhen-net]
google_compute_global_address.private_ip_address: Creating...
google_compute_global_address.private_ip_address: Creation complete after 6s [id=private-ip-address]
google_service_networking_connection.private_vpc_connection: Creating...

Error: googleapi: Error 403: The caller does not have permission, forbidden

on main.tf line 45, in resource "google_service_networking_connection" "private_vpc_connection":
45: resource "google_service_networking_connection" "private_vpc_connection" {

Steps to Reproduce

Here is the Terraform script:
`resource "google_compute_network" "vpc_network" {
name = "${var.network_name}"
auto_create_subnetworks = "false"
routing_mode = "REGIONAL"
}

resource "google_compute_global_address" "private_ip_address" {
provider = "google-beta"
name = "private-ip-address"
purpose = "VPC_PEERING"
address_type = "INTERNAL"
prefix_length = 16
network = "${google_compute_network.vpc_network.self_link}"
}

resource "google_service_networking_connection" "private_vpc_connection" {
provider = "google-beta"
network = "${google_compute_network.vpc_network.self_link}"
service = "servicenetworking.googleapis.com"
reserved_peering_ranges = ["${google_compute_global_address.private_ip_address.name}"]
}
`

1. terraform apply

Important Factoids

References

https://www.terraform.io/docs/providers/google/r/service_networking_connection.html
https://www.terraform.io/docs/providers/google/r/sql_database_instance.html

Details Name Service Networking API By Google Service name servicenetworking.googleapis.com Overview Provides automatic management of network configurations necessary for certain services. Activation status Enabled

[chrissng]

Ensure that the GCP account you use to apply this terraform resource has the following roles/servicenetworking.networksAdmin

[emilymye]

This looks like a permission error. Please make sure you follow the instructions at https://cloud.google.com/vpc/docs/configure-private-services-access#permissions to make sure your Terraform account can access the necessary API endpoints. I'll go ahead and close for now, but please re-open if you still are having permissions issues!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!