diff --git a/.changelog/6053.txt b/.changelog/6053.txt new file mode 100644 index 00000000000..19708aa795a --- /dev/null +++ b/.changelog/6053.txt @@ -0,0 +1,3 @@ +```release-note:bug +service: re-poll for service account after creation, 404s sometimes due to [eventual consistency](https://cloud.google.com/iam/docs/overview#consistency) +``` diff --git a/google/resource_google_service_account.go b/google/resource_google_service_account.go index 3670c890e06..332147efcfe 100644 --- a/google/resource_google_service_account.go +++ b/google/resource_google_service_account.go @@ -115,9 +115,35 @@ func resourceGoogleServiceAccountCreate(d *schema.ResourceData, meta interface{} return fmt.Errorf("Error reading service account after creation: %s", err) } + // We poll until the resource is found due to eventual consistency issue + // on part of the api https://cloud.google.com/iam/docs/overview#consistency + err = PollingWaitTime(resourceServiceAccountPollRead(d, meta), PollCheckForExistence, "Creating Service Account", d.Timeout(schema.TimeoutCreate), 1) + + if err != nil { + return err + } + return resourceGoogleServiceAccountRead(d, meta) } +func resourceServiceAccountPollRead(d *schema.ResourceData, meta interface{}) PollReadFunc { + return func() (map[string]interface{}, error) { + config := meta.(*Config) + userAgent, err := generateUserAgentString(d, config.userAgent) + if err != nil { + return nil, err + } + + // Confirm the service account exists + _, err = config.NewIamClient(userAgent).Projects.ServiceAccounts.Get(d.Id()).Do() + + if err != nil { + return nil, err + } + return nil, nil + } +} + func resourceGoogleServiceAccountRead(d *schema.ResourceData, meta interface{}) error { config := meta.(*Config) userAgent, err := generateUserAgentString(d, config.userAgent)