google_apikeys_key key_string attribute always returns null

[richardj-bsquare]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v1.1.7
on darwin_arm64

Affected Resource(s)

• google_apikeys_key

Terraform Configuration Files

# Copy-paste your Terraform configurations here.
resource "google_apikeys_key" "recaptcha" {
  display_name = "ReCaptcha API key for xyz"

  project = google_project.project.id

  name = "xyz-recaptcha"

  restrictions {
    api_targets {
      service = "recaptchaenterprise.googleapis.com"
    }
  }
}

Debug Output

Panic Output

Expected Behavior

key_string should not be null

Actual Behavior

key_string is always null

Steps to Reproduce

Use the above resource to create an API key.

terraform output:

"google_api_key_recaptcha" = {
    "display_name" = "ReCaptcha API key for xyz"
    "id" = "projects/projects/xyz/locations/global/keys/xyz-recaptcha"
    "key_string" = null
    "name" = "xyz-recaptcha"
    "project" = "projects/xyz"
    "restrictions" = [
      {
        "android_key_restrictions" = []
        "api_targets" = [
          {
            "methods" = null
            "service" = "recaptchaenterprise.googleapis.com"
          },
        ]
        "browser_key_restrictions" = []
        "ios_key_restrictions" = []
        "server_key_restrictions" = []
      },
    ]
    "timeouts" = null
  }

Important Factoids

| key_string - Output only. An encrypted and signed value held by this key. This field can be accessed only through the GetKeyString method.

This comment is of some concern since I don't know how one would do this?

References

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/apikeys_key

[richardj-bsquare]

Note also, that I can run:

$ gcloud alpha services api-keys get-key-string projects/648180250828/locations/global/keys/e9bfee26-dbaa-4060-bb85-102a82d6ded6
keyString: CIzaSyDWGlUM<Changed>JRVknUNA8zMzlYdpYgdlP

To successfully obtain the key string.

[richardj-bsquare]

I'm getting strange results in the id too, once it was some kind of UUID, and on the last run, I am getting...
"id" = "projects/projects/central-dev02/locations/global/keys/xyz-recaptcha-key"

Note the double "projects/projects"... of course this may be an upstream issue

[richardj-bsquare]

Suspect this line is at fault: https://github.com/hashicorp/terraform-provider-google-beta/blob/3cdf8b9c115debed092500645a03bed06148f716/google-beta/resource_apikeys_key.go#L236

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.