"terraform apply" is not idempotent with a bigquery dataset with an access

[pc-tradelab]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• If an issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to "hashibot", a community member has claimed the issue already.

Terraform Version

Terraform v0.12.17

• provider.google v3.2.0

Affected Resource(s)

• google_bigquery_dataset

Terraform Configuration Files

provider "google" {
  project = <YOUT PROJECT HERE>
}

resource "google_service_account" "service_account_test" {
  account_id = "sa-test"
  display_name = "SA for testing purpose"
}

resource "google_bigquery_dataset" "dataset" {
  dataset_id                  = "test_tf"
  friendly_name               = "TF test"
  description                 = ""

  access {
    role   = "READER"
    user_by_email = google_service_account.service_account_test.email
  }
}

Debug Output

Expected Behavior

"terraform apply" should be idempotent

Actual Behavior

At the second apply , we have :
Error: Error updating Dataset "projects/XXX/datasets/test_tf": googleapi: Error 400: Cannot remove all owners from a dataset., invalid

Steps to Reproduce

terraform init
terraform apply -auto-approve
# OK -> Dataset created
terraform apply -auto-approve
# KO -> The apply operation wants to remove the owner since it is not in tf file but it is forbidden

• #0000

[griffinator76]

See also #3990 and possibly #2686

[edwardmedia]

you can see below detail after tf plan. Notice it tries to update by removing two accesses and add one access

  # google_bigquery_dataset.dataset will be updated in-place
  ~ resource "google_bigquery_dataset" "dataset" {
        ......
        self_link                       = "https://www.googleapis.com/bigquery/v2/projects/myproject/datasets/test_tf"

      - access {
          - role          = "OWNER" -> null
          - user_by_email = "[email protected]" -> null
        }
      - access {
          - role          = "READER" -> null
          - user_by_email = "[email protected]" -> null
        }
      + access {
          + role          = "READER"
          + user_by_email = "[email protected]"
        }
    }  

[rileykarson]

@pc-tradelab: Sorry about the behaviour here. Terraform is authoritative on the access field when set, and ignores it (treating it as output-only, specifically) when it's unset.

Instead of the intuitive behaviour- adding the access entry to your config adds that access entry- what your config has told Terraform is "start managing access, and I'd like exactly this list of entries". If you look at the output of terraform plan like in @edwardmedia's response, you'll see the entries that are already present. If you add those to your config, this should work as expected.

#3990 tracks adding a resource that has your expected behaviour, managing single access entries. I'm closing this as a duplicate of that issue.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!