google_monitoring_notification_channel: Import creates invalid ID

[VincentW-LL]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

1.0.4 (provider version 3.78.0)

Affected Resource(s)

• google_monitoring_notification_channel

Terraform Configuration Files

Note: data blocks omitted for privacy reasons

resource "google_monitoring_notification_channel" "target_project_channel" {
  display_name = "${data.google_project.target_project.project_id}-projectOwner"
  project      = data.google_project.target_project.project_id
  type         = "email"

  labels = {
    email_address = "fake-email-321@gmail.com"
  }
}

resource "google_billing_budget" "target_project_budget" {
  billing_account = data.google_billing_account.billing_account.id
  display_name    = "${data.google_project.target_project.project_id}-testBudget"

  budget_filter {
    projects = ["projects/${data.google_project.target_project.number}"]
  }

  amount {
    specified_amount {
      units = 100
    }
  }

  threshold_rules {
    threshold_percent = 1.0
    spend_basis       = "CURRENT_SPEND"
  }

  all_updates_rule {
    monitoring_notification_channels = [
      google_monitoring_notification_channel.target_project_channel.id,
    ]
  }
}

Debug Output

Panic Output

Expected Behavior

Terraform import for google_monitoring_notification_channel should generate a valid notification channel ID that matches the imported GCP resource. In this example, it should be:

projects/[project-id]/notificationChannels/1074677399646821636

Actual Behavior

Terraform import for google_monitoring_notification_channel generates an invalid notification channel ID based on the import command. In this example:

[project-id] projects/[project-id]/notificationChannels/1074677399646821636

Steps to Reproduce

Note: some text replaced by [text-in-square-brackets] for privacy reasons

1. Import with the following command fails:

terraform import google_monitoring_notification_channel.target_project_channel projects/[project-id]/notificationChannels/1074677399646821636

Output:

google_monitoring_notification_channel.target_project_channel: Importing from ID "projects/[project-id]/notificationChannels/1074677399646821636"...
?
¦ Error: project: required field is not set

2. Re-running the import succeeds with the following command:

terraform import google_monitoring_notification_channel.target_project_channel "[project-id] projects/[project-id]/notificationChannels/1074677399646821636"

Output:

google_monitoring_notification_channel.target_project_channel: Importing from ID "[project-id] projects/[project-id]/notificationChannels/1074677399646821636"...
google_monitoring_notification_channel.target_project_channel: Import prepared!
  Prepared google_monitoring_notification_channel for import
google_monitoring_notification_channel.target_project_channel: Refreshing state... [id=[project-id] projects/[project-id]/notificationChannels/1074677399646821636]

Import successful!

The resources that were imported are shown above. These resources are now in
your Terraform state and will henceforth be managed by Terraform.

3. Running a terraform plan shows that an invalid notification channel ID has been generated for the imported resource ([project-id] projects/[project-id]/notificationChannels/1074677399646821636):

google_monitoring_notification_channel.target_project_channel: Refreshing state... [id=[project-id] projects/[project-id]/notificationChannels/1074677399646821636]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # google_billing_budget.target_project_budget will be created
  + resource "google_billing_budget" "target_project_budget" { 
      + billing_account = "[billing-id]"
      + display_name    = "[project-id]-testBudget"  
      + id              = (known after apply)
      + name            = (known after apply)

      + all_updates_rule {
          + disable_default_iam_recipients   = false
          + monitoring_notification_channels = [
              + "[project-id] projects/[project-id]/notificationChannels/1074677399646821636",
            ]
          + schema_version                   = "1.0"
        }

      + amount {
          + specified_amount {
              + currency_code = (known after apply)
              + units         = "100"
            }
        }

      + budget_filter {
          + credit_types           = (known after apply)
          + credit_types_treatment = "INCLUDE_ALL_CREDITS"
          + labels                 = (known after apply)
          + projects               = [
              + "projects/[project-number]",
            ]
          + services               = (known after apply)
          + subaccounts            = (known after apply)
        }

      + threshold_rules {
          + spend_basis       = "CURRENT_SPEND"
          + threshold_percent = 1
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

4. Running a terraform apply fails as the channel ID is invalid:

google_billing_budget.target_project_budget: Creating...
?
¦ Error: Error creating Budget: googleapi: Error 400: Invalid notification channel name: [project-id] projects/[project-id]/notificationChannels/1074677399646821636
¦
¦   with google_billing_budget.target_project_budget,
¦   on test.tf line 28, in resource "google_billing_budget" "target_project_budget":
¦   28: resource "google_billing_budget" "target_project_budget" {

At this stage if the state is modified with the correct notification channel ID, the apply will be successful. ie. from this:

    {
      "mode": "managed",
      "type": "google_monitoring_notification_channel",
      "name": "target_project_channel",
      "provider": "provider[\"registry.terraform.io/hashicorp/google\"]",
      "instances": [
        {
          "schema_version": 0,
          "attributes": {
            "description": "",
            "display_name": "[project-id]-projectOwner",
            "enabled": true,
            "id": "[project-id] projects/[project-id]/notificationChannels/1074677399646821636",
            "labels": {
              "email_address": "fake-email-321@gmail.com"
            },
            "name": "projects/[project-id]/notificationChannels/1074677399646821636",
            "project": "[project-id]",
...

to this (note change in the 'id' line):

    {
      "mode": "managed",
      "type": "google_monitoring_notification_channel",
      "name": "target_project_channel",
      "provider": "provider[\"registry.terraform.io/hashicorp/google\"]",
      "instances": [
        {
          "schema_version": 0,
          "attributes": {
            "description": "",
            "display_name": "[project-id]-projectOwner",
            "enabled": true,
            "id": "projects/[project-id]/notificationChannels/1074677399646821636",
            "labels": {
              "email_address": "fake-email-321@gmail.com"
            },
            "name": "projects/[project-id]/notificationChannels/1074677399646821636",
            "project": "[project-id]",
...

Important Factoids

Service account set in the GOOGLE_APPLICATION_CREDENTIALS environment variable is a different project to where the alert and notification channels are being created. The service account has sufficient permissions to create these resources in the target project.

References

[VincentW-LL]

Resolved by modifying file from:

  all_updates_rule {
    monitoring_notification_channels = [
      google_monitoring_notification_channel.target_project_channel.id,
    ]

to

  all_updates_rule {
    monitoring_notification_channels = [
      google_monitoring_notification_channel.target_project_channel.name,
    ]

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.