google_bigquery_connection aws.access_role.iam_role_id cannot be updated

[chrisst]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Issue

The google_bigquery_connection aws.access_role.iam_role_id should be able to be updated but changing that value will throw an error from the API. However the error helpfully tells you that iamRoleId is the only field you're allowed to update 😅

IIUC it looks like the PATCH request isn't sending the correct update mask and therefore the request gets rejected because the patch body is including a bunch of other fields in addition to the iamRoleId. I think the update mask needs to be updateMask=aws.access_role.iam_role_id instead of just updateMask=aws

Docs: https://cloud.google.com/bigquery/docs/reference/bigqueryconnection/rest/v1beta1/projects.locations.connections/patch

Config

resource "google_bigquery_connection" "connection" {
  connection_id = "chrisst-thing"
  location      = var.google_location
  friendly_name = "chrisst-thing"
  description   = "created by terraform"
  aws {
    access_role {
      # this must be constructed manually instead of referencing the google connection to avoid a resource dependency cycle
      iam_role_id = "arn:aws:iam::${var.aws_account}:role/${var.iam_role_name}"
    }
  }
}

PATCH Request:

---[ REQUEST ]---------------------------------------
PATCH /v1/projects/my-project/locations/agregion/connections/my-connection?alt=json&updateMask=aws HTTP/1.1
Host: bigqueryconnection.googleapis.com
User-Agent: Terraform/1.3.7 (+https://www.terraform.io) Terraform-Plugin-SDK/2.10.1 terraform-provider-google/4.47.0
Content-Length: 225
Content-Type: application/json
Accept-Encoding: gzip

{
 "aws": {
  "accessRole": {
   "iamRoleId": "arn:aws:iam::123456789:role/some-rolez",
   "identity": "100428921676052349515"
  }
 },
 "cloudResource": null,
 "description": "created by terraform",
 "friendlyName": "my-connection"
}

Output:

---[ RESPONSE ]--------------------------------------
HTTP/2.0 400 Bad Request
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Cache-Control: private
Content-Type: application/json; charset=UTF-8
Date: Mon, 09 Jan 2023 21:12:06 GMT
Server: ESF
Vary: Origin
Vary: X-Origin
Vary: Referer
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 0

{
  "error": {
    "code": 400,
    "message": "Only 'aws.access_role.iam_role_id' field can be updated.",
    "status": "INVALID_ARGUMENT"
  }
}


2023-01-09T13:12:06.159-0800 [ERROR] vertex "google_bigquery_connection.connection" error: Error updating Connection "projects/my-project/locations/agregion/connections/my-connection": googleapi: Error 400: Only 'aws.access_role.iam_role_id' field can be updated.
╷
│ Error: Error updating Connection "projects/my-project/locations/agregion/connections/my-connection": googleapi: Error 400: Only 'aws.access_role.iam_role_id' field can be updated.
│
│   with google_bigquery_connection.connection,
│   on main.tf line 42, in resource "google_bigquery_connection" "connection":
│   42: resource "google_bigquery_connection" "connection" {
│
╵

Full Logs
https://paste.googleplex.com/5609719786897408

[chrisst]

Thanks @edwardmedia ❤️ !!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.