fix(EGW): avoid tainting endpoint gateway on timeout when the target PPSG has the access policy as review

ibm/service/vpc/resource_ibm_is_virtual_endpoint_gateway.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"log"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/IBM-Cloud/terraform-provider-ibm/ibm/flex"
@@ -382,17 +383,31 @@ func resourceIBMisVirtualEndpointGatewayCreate(d *schema.ResourceData, meta inte
 
 	d.SetId(*endpointGateway.ID)
 
-	if d.Get(targetResourceTypeFmt).(string) == "private_path_service_gateway" {
-		_, err = isWaitForVirtualEndpointGatewayForPPSGAvailable(sess, d.Id(), d.Timeout(schema.TimeoutCreate))
-		if err != nil {
-			return err
-		}
-	} else {
-		_, err = isWaitForVirtualEndpointGatewayAvailable(sess, d.Id(), d.Timeout(schema.TimeoutCreate))
-		if err != nil {
+	_, err = isWaitForVirtualEndpointGatewayAvailable(sess, d.Id(), d.Timeout(schema.TimeoutCreate))
+	if err != nil {
+		if d.Get(targetResourceTypeFmt).(string) == "private_path_service_gateway" {
+			isAccessPending := false
+			if strings.Contains(err.Error(), "timeout while waiting for state to become") {
+				opt := sess.NewGetEndpointGatewayOptions(d.Id())
+				endpointGateway, response, err := sess.GetEndpointGateway(opt)
+				if err != nil {
+					log.Printf("Get Endpoint Gateway failed: %v", response)
+					return fmt.Errorf("[ERROR] Get Endpoint Gateway failed %s\n%s", err, response)
+				}
+				if len(endpointGateway.LifecycleReasons) > 0 {
+					if endpointGateway.LifecycleReasons[0].Code != nil && strings.Compare(*endpointGateway.LifecycleReasons[0].Code, "access_pending") == 0 {
+						isAccessPending = true
+					}
+				}
+			}
+			if !isAccessPending {
+				return err
+			}
+		} else {
 			return err
 		}
 	}
+
 	v := os.Getenv("IC_ENV_TAGS")
 	if _, ok := d.GetOk(isVirtualEndpointGatewayTags); ok || v != "" {
 		oldList, newList := d.GetChange(isVirtualEndpointGatewayTags)

ibm/service/vpc/resource_ibm_is_virtual_endpoint_gateway_test.go

@@ -62,6 +62,34 @@ func TestAccIBMISVirtualEndpointGateway_PPSG(t *testing.T) {
 		},
 	})
 }
+func TestAccIBMISVirtualEndpointGateway_PPSG_With_AccessPolicy_Review_And_Timeout(t *testing.T) {
+	var endpointGateway string
+	accessPolicy := "review"
+	vpcname := fmt.Sprintf("tflb-vpc-%d", acctest.RandIntRange(10, 100))
+	subnetname := fmt.Sprintf("tflb-subnet-name-%d", acctest.RandIntRange(10, 100))
+	lbname := fmt.Sprintf("tf-test-lb%dd", acctest.RandIntRange(10, 100))
+	name1 := fmt.Sprintf("tf-test-ppsg%d", acctest.RandIntRange(10, 100))
+	name := "ibm_is_virtual_endpoint_gateway.endpoint_gateway"
+	// targetName := fmt.Sprintf("tf-egw-target%d", acctest.RandIntRange(10, 100))
+	egwName := fmt.Sprintf("tf-egw%d", acctest.RandIntRange(10, 100))
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { acc.TestAccPreCheck(t) },
+		Providers: acc.TestAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCheckisVirtualEndpointGatewayConfigPPSGWithTimeout(vpcname, subnetname, acc.ISZoneName, acc.ISCIDR, lbname, accessPolicy, name1, egwName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckisVirtualEndpointGatewayExists(name, &endpointGateway),
+					resource.TestCheckResourceAttr(name, "name", egwName),
+					resource.TestCheckResourceAttr(name, "lifecycle_state", "pending"),
+					resource.TestCheckResourceAttr(name, "lifecycle_reasons.0.code", "access_pending"),
+					resource.TestCheckResourceAttr(name, "target.0.name", name1),
+					resource.TestCheckResourceAttr(name, "target.0.resource_type", "private_path_service_gateway"),
+				),
+			},
+		},
+	})
+}
 func TestAccIBMISVirtualEndpointGateway_AllowDnsResolutionBinding(t *testing.T) {
 	var endpointGateway string
 	vpcname1 := fmt.Sprintf("tfvpngw-vpc-%d", acctest.RandIntRange(10, 100))
@@ -357,6 +385,24 @@ func testAccCheckisVirtualEndpointGatewayConfigPPSG(vpcname, subnetname, zone, c
 		resource_group = data.ibm_resource_group.test_acc.id
 	}`, egwName)
 }
+func testAccCheckisVirtualEndpointGatewayConfigPPSGWithTimeout(vpcname, subnetname, zone, cidr, lbname, accessPolicy, name, egwName string) string {
+	return testAccCheckIBMIsPrivatePathServiceGatewayConfigBasic(vpcname, subnetname, acc.ISZoneName, acc.ISCIDR, lbname, accessPolicy, name) + fmt.Sprintf(`
+	data "ibm_resource_group" "test_acc" {
+		is_default=true
+    }
+	resource "ibm_is_virtual_endpoint_gateway" "endpoint_gateway" {
+		name = "%s"
+		target {
+		  crn          = ibm_is_private_path_service_gateway.is_private_path_service_gateway.crn
+		  resource_type = "private_path_service_gateway"
+		}
+		vpc = ibm_is_vpc.testacc_vpc.id
+		resource_group = data.ibm_resource_group.test_acc.id
+		timeouts {
+			create = "3m"
+		}
+	}`, egwName)
+}
 func testAccCheckisVirtualEndpointGatewayConfigAllowDnsResolutionBinding(vpcname1, name1 string, enable_hub, allowDnsResolutionBinding bool) string {
 	return fmt.Sprintf(`
 	resource "ibm_is_vpc" "testacc_vpc" {