google_bigquery_dataset_access can't be imported

[steven-edgar]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

The google_bigquery_dataset_access resource does not support importing an existing configuration. If you try and apply a terraform description containing this resource, and the target dataset already has a matching permission already defined (not created by terraform), then the apply fails.

Error: Unable to create DatasetAccess, existing object already found: map[role:OWNER userByEmail:[email protected]]

  on main.tf line 256, in resource "google_bigquery_dataset_access" "my_service_account":
 256: resource "google_bigquery_dataset_access" "my_service_account" {

Relevant section from the terraform description

resource "google_bigquery_dataset_access" "my_service_account" {
  dataset_id = "my_bg_dataset"
  role = "OWNER"
  user_by_email  = "[email protected]"
}

New or Affected Resource(s)

• google_bigquery_dataset_access

Potential Terraform Configuration

# Propose what you think the configuration to take advantage of this feature should look like.
# We may not use it verbatim, but it's helpful in understanding your intent.

References

• #0000

b/361572871

[upodroid]

This needs to be retriaged. The resource doesn't support import today.

[objectiveryan]

I think this is essentially a dupe of #7486.

[yu-iskw]

I have the same issue.

[melinath]

@rileykarson it looks like you had previously triaged this as documentation - is the issue that we need to document the fact that it can't be imported, as opposed to implementing import?

[rileykarson]

Not sure, sorry! May have just clicked the wrong button. It already states it can't be imported: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/bigquery_dataset_access#import

[ggtisc]

Hi @steven-edgar!

Are you looking to import a complete existing google_bigquery_dataset_access resource to your terraform environment or just the dataset_id and user_by_email arguments?

[roaks3]

We lost a comment from GoogleCloudPlatform/magic-modules#3312, but it looks like this was determined to be non-importable because there is not a unique way to identify it (it is a subfield of the dataset). We should take a second look to determine if this is still accurate, but based on the error message, it seems like we could consider an aggregate of the fields to be a pseudo-identifier, and potential support import using that.

[wj-chen]

it looks like this was determined to be non-importable because there is not a unique way to identify it (it is a subfield of the dataset)

This is still the case. Each google_bigquery_dataset_access corresponds to an item in dataset.access in the API.

it seems like we could consider an aggregate of the fields to be a pseudo-identifier, and potential support import using that.

I think currently if an user imports a Dataset as a whole then the access field just shows up as google_bigquery_dataset.access. Do you mean there is a way to specify an arbitrary import ID that's not a resource name? And we can add logic to know to parse out specific entities in the access array based on the IDs? @roaks3

[roaks3]

@wj-chen I think basically there seems to be a way that the server is identifying an access object as unique:

... existing object already found: map[role:OWNER userByEmail:[email protected]]

So if it is saying the resource can't be created because it already exists, then it sort of implies we could use the same logic to allow import. It might be something like terraform import my_bg_dataset OWNER [email protected].

Note that I could be making some incorrect assumptions, and I don't know how this would interact with the google_bigquery_dataset.access array.

[ervin-pactum]

Please update documentation for google_bigquery_dataset_access to clearly state in imports section that not only import is not possible, overwrite won't work either, while search does yield this and migration issue, best is to have important knowledge directly in documentation.