Add info that advanced sink options requires unique writer identity in documentation

[loozhengyuan]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

I encountered an error message earlier today when using the google_logging_project_sink resource. Apparently, when the bigquery_options argument is provided, then unique_writer_identity needs to be set to true. If not, like what I did, the following error message will be displayed:

googleapi: Error 400: Advanced sink options require using per sink service accounts. Use uniqueWriterIdentity=true to create a unique service account for this sink, badRequest

At first glance, it does not seem apparent to me which argument is considered to be 'advanced sink options' though bigquery_options is the more unique option in the resource. There seems to be an absence of this information in the Terraform documentation, so I thought we could perhaps be explicit and indicate in the argument description that specifying the bigquery_options argument also requires unique_writer_identity to be set to true.

If this is desirable, I would be happy to follow up with a PR, do let me know.

P.S. Also, I noted that the description for unique_writer_identity included the following line, but I just wanted to highlight that I encountered the above error message even when I am publishing logs within the same project.

If you wish to publish logs across projects, you must set unique_writer_identity to true.

New or Affected Resource(s)

• google_logging_project_sink
• google_logging_folder_sink (potentially)
• google_logging_organisation_sink (potentially)
• google_logging_billing_account_sink (potentially)

[danawillow]

Happy to take a PR for the docs change!

In our triage meeting today, we also discussed that it would be good to have plan-time validation for this field as well. If you want to try to add that, it would be doable via a CustomizeDiff (there are a few good examples in the compute_instance_template resource), otherwise someone on our team will get to it eventually.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!