Error reading CryptoKeyVersion - provider defined wrong type vs GCP API response #13924
Comments
|
@boxanhngo can you share your config and the debug log? |
|
@edwardmedia Can you take a look ? We shared tf config and debug log. |
|
In the log it looks like the referenced crypto_key is not found. To which crypto_keys are the versions applying to? |
yes. We have a list of keys basically and then we apply crypto keys version against. |
|
The error above shows that the referenced crypto_key is not found, and before that the I'd probably try to solve these before moving forward to investigate in crypto_key_versions |
|
@hao-nan-li We reproduced the same issue w/o references issue . Log is updated as below. PTAL ? |
|
Sure I will take a look into it. Could you send me the TF config where |
|
Any update? |
|
I've actually recieved a rather similar error to do with imports (on version 4.63.0 of the provider.
Leads to
Seems like these could be related |
|
I am getting the same issue This is my config: resource "google_kms_key_ring" "windows_sign_apps" {
name = "windows-sign-apps"
location = "europe-west2"
}
resource "google_kms_crypto_key" "digicert_ev_signing_key_ecc_256" {
name = "digicert-ev-signing-key-ecc-256"
key_ring = google_kms_key_ring.windows_sign_apps.id
purpose = "ASYMMETRIC_SIGN"
destroy_scheduled_duration = "86400s"
timeouts {}
version_template {
algorithm = "EC_SIGN_P256_SHA256"
protection_level = "HSM"
}
lifecycle {
prevent_destroy = true
}
}
// This version has been used to generate the Digicert EV Key. DO NOT DESTROY!!!!
resource "google_kms_crypto_key_version" "digicert_ev_signing_key_ecc_256_v1" {
crypto_key = google_kms_crypto_key.digicert_ev_signing_key_ecc_256.id
lifecycle {
prevent_destroy = true
}
}
|
github-actions
bot
added
service/cloudkms
forward/review
melinath
added
forward/linked
and removed
forward/review
|
I'm getting this error with HSM keys only. Software ones are OK. |
We can't explicitly create key versions with Google KMS due to hashicorp/terraform-provider-google#13924, so this change lets the `google_kms_crypto_key` resource create an initial key and then we import it.
We can't explicitly create key versions with Google KMS due to hashicorp/terraform-provider-google#13924, so this change lets the `google_kms_crypto_key` resource create an initial key and then we import it.
|
A workaround is to let the crypto key resource create the initial key version, and then import it. See how I've done it here: relaycorp/terraform-google-awala-endpoint#21 |
|
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. |
Community Note
modular-magicianuser, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned tohashibot, a community member has claimed the issue already.Terraform Version
Terraform v1.2.7
on linux_amd64
Affected Resource(s)
Terraform Configuration Files
Debug Output
Panic Output
Expected Behavior
https://github.com/hashicorp/terraform-provider-google/blob/v4.56.0/google/resource_kms_crypto_key_version.go#L79
Actual Behavior
Steps to Reproduce
terraform planImportant Factoids
References
b/299683525
The text was updated successfully, but these errors were encountered: