google_storage_hmac_key intermittent error - "Provider produced inconsistent result after apply"

[mancaus]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v0.12.20

• provider.google v3.59.0
• provider.template v2.1.0

Affected Resource(s)

google_storage_hmac_key

Terraform Configuration Files

provider "google" {
  version = "3.59.0"
  project = "<redacted>"
  region  = "europe-west1"
}

resource "google_storage_hmac_key" "datatransfer_key" {

  service_account_email = "<redacted - an existing service account>"
}

Debug Output

https://gist.github.com/mancaus/bf4530d3f830e8885f8c1936935927b9

Expected Behavior

HMAC key created and terraform apply succeeds with hmac in state.

Actual Behavior

HMAC key created, but terraform apply fails with hmac not in state.

Steps to Reproduce

1. terraform apply with above config

Occurs around 50% of the time for me with the above configuration.

Important Factoids

No

References

N/A

• #0000

[edwardmedia]

@mancaus I see below error in your log. Do you have the default project set in your environment variable? Because you redacted all project, I can not tell if there are more than one project involved. What do you see if you remove the provider block in your config?

{
  "error": {
    "code": 404,
    "message": "Access ID not found in project.",
    "errors": [
      {
        "message": "Access ID not found in project.",
        "domain": "global",
        "reason": "notFound"
      }
    ]
  }
}

[mancaus]

The only project involved is the one set in the provider block. My logged in project (core.project in gloud info) is the same project. If I run gsutil hmac get <id>, with ID set to the value in metadata.accessId of the response (from the log), I get the details referencing that same project and the service account with a timestamp that correlates precisely with the attempted creation in the log.

I can provide the non-redacted output privately if you'd like.

[edwardmedia]

@mancaus have you tried by commenting the provider block?

[mancaus]

When I comment out the provider block I just get Error: project: required field is not set. Does that help?

[edwardmedia]

I can't repro this issue. From your attached log, before invoking below command, I see the resource has already been created. If the project is right, I can't see why it is not found.

GET /storage/v1/projects/your-project/hmacKeys/GOOG1EZX5JGXMWS6WHPIGHG4MYADSTWB7T5ZNGWO3R7PEBXUH5UGFIO2FMSUI

This is likely the API was experiencing delayed responses. Add polling to handle this

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!