google_service_account_key project: required field is not set

[jwtracy]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

terraform -v
Terraform v0.14.11

google provider version v3.76.0.

Affected Resource(s)

• google_service_account_key

Terraform Configuration Files

resource "google_service_account_key" "default" {
  service_account_id = local.sa_id
  key_algorithm      = "KEY_ALG_RSA_2048"
  public_key_type    = "TYPE_X509_PEM_FILE"
  private_key_type   = "TYPE_GOOGLE_CREDENTIALS_FILE"
  depends_on         = [module.gke_sql]
}

This config produces an error,

Error: project: required field is not set

In an attempt to fix this,

resource "google_service_account_key" "default" {
  **project                     = "my-project"**
  service_account_id = local.sa_id
  key_algorithm      = "KEY_ALG_RSA_2048"
  public_key_type    = "TYPE_X509_PEM_FILE"
  private_key_type   = "TYPE_GOOGLE_CREDENTIALS_FILE"
  depends_on         = [module.gke_sql]
}

This config also produces an error,

An argument named "project" is not expected here.

The only way I can avoid these errors is by setting the project field in the provider block.

Expected Behavior

google_service_account_key should accept a project input

Actual Behavior

google_service_account_key only accepts provider.google.project

Steps to Reproduce

1. terraform apply

References

Seems like a regression of this Issue,

• google_service_account_key broken in 1.14.0 - regression bug #1655

[edwardmedia]

@jwtracy it is included in the service_account_id

service_account_id - (Required) The Service account id of the Key. This can be a string in the format {ACCOUNT} or projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}, where {ACCOUNT} is the email address or unique id of the service account. If the {ACCOUNT} syntax is used, the project will be inferred from the account.

[jwtracy]

Providing the full email worked and the project was inferred! It would be useful for the error message to mention it's trying to infer this rather than claim a required field isn't set however

[edwardmedia]

We could update the doc to reflect this behavior

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.