google_compute_network has no way to set flow logs on auto_create_subnetworks

[pmiles01]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

With the google_compute_network, if you use the 'auto_create_subnetworks' flag - there doesn't seem to be any way to turn on flow logs or subnet_private_access.

These would both be useful flags to have available.

New or Affected Resource(s)

• google_compute_network

Potential Terraform Configuration

Two new flags, maybe :

auto_create_subnetworks_flow_logs = true
auto_create_subnetworks_subnet_private_access = true

References

• #0000

[danawillow]

@pmiles01, given that you want to be able to manage the properties of the subnetwork, is there anything stopping you from importing or creating the subnetworks manually?

[pmiles01]

Importing isn't really an option as I'm striving for a one touch Terraform install.

I could manually create them, except the auto create looked like a great time and complexity saver.

[danawillow]

Got it. There are two things here that work together to make this tricky:

1. When new regions are introduced, new subnetworks get added
2. The networks API (https://cloud.google.com/compute/docs/reference/rest/v1/networks) doesn't have the ability to customize the subnetworks that get created in auto mode

So, what would end up happening is:

1. You create a network in auto mode
2. Terraform calls the network API to create the network, and then the subnetwork API to update each of the new subnetworks with the specified flow logs / private access
3. A new GCP region gets added
4. GCP creates a new subnetwork in the new region. Since the information about flow logs / private access only lives in Terraform and not in GCP itself, the new subnetwork is created with the default values for those attributes, and Terraform won't update them until the next time it gets run.

So unless the GCP API ends up letting you specify subnetwork attributes on network create, I think adding this to Terraform would add more complexity than it reduces. Closing this out, but thanks for reporting!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!