terraform-provider-google: Cannot create CloudFunction with terraform app authorization

As @edwardmedia noted, we don’t recommend using gcloud credentials to authenticate to Terraform, because it opens the doors for this exact style of breakages. From https://www.terraform.io/docs/providers/google/guides/provider_reference.html#credentials-1:

On your computer, you can make your Google identity available by running gcloud auth application-default login. This approach isn’t recommended- some APIs are not compatible with credentials obtained through gcloud.

If you can’t use a service account, you should be able to succeed by using an access token, with the important caveat that it will expire. I also can’t guarantee that it won’t at some point end up with a similar error as when using application credentials.

If neither of these are options, then you should obtain end-user credentials using an application that is not gcloud (since its credentials are really meant to be used in gcloud itself). I haven’t tried this myself, but I think it would require setting up an oauth application that you can then get a credentials file from. https://cloud.google.com/docs/authentication/end-user would be the place to look to get started. If you try it, let me know how it goes!

I’ve used the exact same account for the last 5 months (at least). But this issue showed up like a week ago or a bit more.

Error: Error waiting for Deleting CloudFunctions Function: error while retrieving operation: googleapi: Error 403: Your application has authenticated using end user credentials from the Google Cloud SDK or Google Cloud Shell which are not supported by the cloudfunctions.googleapis.com. We recommend configuring the billing/quota_project setting in gcloud or using a service account through the auth/impersonate_service_account setting. For more information about service accounts and how to use them in your application, see https://cloud.google.com/docs/authentication/., accessNotConfigured

while a service account is clearly suggested. I still don’t get why the error shows up now. Is it a change gcp side? I don’t remember updating any provider.

@flaker indeed this was an API-side change rather than a Terraform one. The comment above yours and the one above that mention some workarounds, so hopefully one of those will work for you. I agree that the behavior is counterintuitive.

For anyone on this thread that’s a Googler or has a Google-side contact, you (/they) can follow b/148479480 for updates.

@schaffino Need audit trail is legit. Let’s see what we can do.

What’s strange about this issue is that the function gets created fine. If you run the deploy a second time it will complete successfully. Using a service account works, but i dislike having service account keys kept around on devs machines. You also lose the audit trail of who has done what. Impersonation works fine too, but again, no audit trail in the logs as to who has actually modified or created infrastructure.

@edwardmedia I tried to use GOOGLE_CLOUD_KEYFILE_JSON with service account “Editor” permissions and it worked. But anyway, is it any possibility to look through the original issue, that cloudfunctions.googleapis.com could not be created via Google APIs Service Agent. I manage tens projects in gcloud and it is not convenient to use service account json for every single project. Thanks.

@edwardmedia thanks for response, I use service account called “Google APIs Service Agent” with name PROJECT_NUMBER@cloudservices.gserviceaccount.com and authenticate with gcloud auth application-default login and actually there is no json key configuration for terraform. I have quite big config and all modules work fine except cloud_functions.

My workaround is to actually call gcloud as a local-exec provisioner. Super janky but it works (only for creation).

resource "null_resource" "status_update" {
  triggers = {
    hash = data.archive_file.functions.output_base64sha256
  }

  provisioner "local-exec" {
    interpreter = ["bash", "-c"]
    command = join(" ", [
      "gcloud functions deploy",
      "${local.function_name}",
      "--project=${var.project}",
      "--region=${var.region}",
      "--runtime=go111",
      "--entry-point=EntryPoint",
      "--trigger-topic=${local.status_update_topic}",
      "--source=gs://${local.function_bucket_name}/${google_storage_bucket_object.functions.name}",
      "--set-env-vars=${local.function_env_vars}",
      "--max-instances=1",
      "--timeout=60",
      "--memory=128MB",
      "<<< 'N\n'",
    ])
  }
}