Shielded instance config parameters don't match

[benhoskings]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v0.12.29
Google provider v3.32.0

Affected Resource(s)

google_compute_instance

Terraform Configuration Files

resource "google_compute_instance" "test" {
  # ...
  shielded_instance_config {
    enable_secure_boot = true
    enable_vtpm = true
    enable_integrity_monitoring = true
  }
}

Creating an instance in the web console and displaying the equivalent REST shows these settings are supplied using shieldedInstanceConfig:

{
  # ...
  "shieldedInstanceConfig": {
    "enableSecureBoot": true,
    "enableVtpm": true,
    "enableIntegrityMonitoring": true
  }
}

But the provider is using shieldedVmConfig, which results in enableSecureBoot being ignored and defaulting to false:

2020-08-01T00:53:28.295+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:  "shieldedVmConfig": {
2020-08-01T00:53:28.295+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:   "enableIntegrityMonitoring": true,
2020-08-01T00:53:28.295+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:   "enableSecureBoot": true,
2020-08-01T00:53:28.295+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:   "enableVtpm": true
2020-08-01T00:53:28.295+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:  },

[edwardmedia]

I see the shieldedVmConfig in the request payload as well. Below is the schema section from https://cloud.google.com/compute/docs/reference/rest/v1/instances

  "shieldedInstanceConfig": {
    "enableSecureBoot": boolean,
    "enableVtpm": boolean,
    "enableIntegrityMonitoring": boolean
  },

[rileykarson]

Assigning to next week's bug onduty (@ndmckinley) as it's Friday.

It's worth noting that we use the beta API for this resource, where shieldedVmConfig was the original name of the field. Both appear, though: https://cloud.google.com/compute/docs/reference/rest/beta/instances

[edwardmedia]

I also see it in the v0.beta
https://godoc.org/google.golang.org/api/compute/v0.beta#ShieldedVmConfig
Also note,

1. the API response contain neither in the body
2. below line in the debug log

- .shielded_instance_config: block count changed from 1 to 0

[lucasteligioridis]

Just to add to this, looks like Google have recently created backwards compatibility with this, here is a snippet of the response body in terraform debug mode:

2020-08-05T12:41:34.301+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:  "shieldedVmConfig": {
2020-08-05T12:41:34.301+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:   "enableSecureBoot": true,
2020-08-05T12:41:34.301+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:   "enableVtpm": true,
2020-08-05T12:41:34.301+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:   "enableIntegrityMonitoring": true
2020-08-05T12:41:34.301+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:  },
2020-08-05T12:41:34.301+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:  "shieldedVmIntegrityPolicy": {
2020-08-05T12:41:34.301+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:   "updateAutoLearnPolicy": true
2020-08-05T12:41:34.301+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:  },
2020-08-05T12:41:34.301+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:  "shieldedInstanceConfig": {
2020-08-05T12:41:34.301+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:   "enableSecureBoot": true,
2020-08-05T12:41:34.301+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:   "enableVtpm": true,
2020-08-05T12:41:34.301+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:   "enableIntegrityMonitoring": true
2020-08-05T12:41:34.301+1000 [DEBUG] plugin.terraform-provider-google_v3.32.0_x5:  },

[nat-henderson]

That makes sense - the deprecation policy says that they're supposed to do that - but we should still switch to the un-deprecated name. Thanks for letting us know! :)

[lucasteligioridis]

No problem, happy to help 👍
But to further clarify, looks like in between @benhoskings and my attempts something was changed. Hence our different results.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!