google_cloudiot_registry: creation fails with transient 403

[drigz]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• If an issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to "hashibot", a community member has claimed the issue already.

Terraform Version

Terraform v0.11.7

• provider.google v1.20.0
• provider.template v2.0.0

Affected Resource(s)

• google_cloudiot_registry

Expected Behavior

Resource created successfully, even if Terraform just created the project.

Actual Behavior

Terraform fails to create the resource:

* google_cloudiot_registry.my-registry: googleapi: Error 403: The caller does not have permission, forbidden

When I run Terraform a second time, it successfully creates the registry.

Steps to Reproduce

I don't have a minimal Terraform config, sorry, but I you can reproduce the 403 with gcloud:

project=$USER-test-project-$RANDOM
gcloud projects create $project --folder 396521612403
gcloud --project $project services enable cloudiot.googleapis.com
gcloud --project $project iot registries create my-registry --region europe-west1

Important Factoids

Cloud Pub/Sub has a different failure mode when a topic is created shortly after project creation:

The topic
projects/my-project/topics/my-topic cannot be created or
updated due to an organization policy specified at the project or
organization level. The organization policy does not allow message storage
in any GCP region where Cloud Pub/Sub is present. The organization policy
may be updated by your project or organization administrator. See
https://console.cloud.google.com/iam-admin/orgpolicies/gcp-resourceLocations?project=my-project.
If the topic's project was recently created, you may need to wait a few
minutes for the project's organization policy to be properly initialized,
and then retry this operation.

This corresponds to a 412 Precondition Failed error, so Terraform retries until the policy is initialized and it works. However, Terraform doesn't retry 403 errors.

Should resourceCloudIoTRegistryCreate convert the 403 to a 412?

[edwardmedia]

@drigz it seems to be fine with me for creating google_cloudiot_registry. I am using provider v3.16.0. Based on what I can see, I am closing this issue. Please feel free if you discover this is still an issue. Thank you

resource "google_pubsub_topic" "default-devicestatus" {
  name = "default-devicestatus"
}
resource "google_pubsub_topic" "default-telemetry" {
  name = "default-telemetry"
}
resource "google_cloudiot_registry" "default-registry" {
  name = "default-registry"
  event_notification_configs {
    pubsub_topic_name = google_pubsub_topic.default-telemetry.id
  }
  state_notification_config = {
    pubsub_topic_name = google_pubsub_topic.default-devicestatus.id
  }
  http_config = {
    http_enabled_state = "HTTP_ENABLED"
  }
  mqtt_config = {
    mqtt_enabled_state = "MQTT_ENABLED"
  }
  credentials {
    public_key_certificate = {
      format      = "X509_CERTIFICATE_PEM"
      certificate = file("rsa_cert.pem")
    }
  }
}

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!