Terraform-provider-digitalocean: terraform apply returns 401 Unable to autenticate you

[alekgr]

Hi there,

Terraform Version

2020/01/04 10:25:02 [INFO] Terraform version: 0.12.18
2020/01/04 10:25:02 [INFO] Go runtime version: go1.12.13

Affected Resource(s)

• digitalocean_droplet

Terraform Configuration Files

variable "do_token" {}

# Digital ocean provider
provider "digitalocean" {
  token = "var.do_token"
}

resource "digitalocean_droplet" "web" {
    image = "debian-10-x64"
    name  = "web"
    region = "nyc3"
    size   = "s-1vcpu-1gb"
    monitoring = true
    private_networking = true
    }

Basically I can run the same api token from ansible and provision but not terrafrom

Thank you,
Alek G

[alekgr]

``
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4:
HTTP/2.0 401 Unauthorized
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4: Content-Length: 65
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4: Cf-Cache-Status: DYNAMIC
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4: Cf-Ray: 54fea08c8d01ec9a-DFW
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4: Content-Type: application/json
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4: Date: Sat, 04 Jan 2020 16:35:42 GMT
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4: Expect-Ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4: Server: cloudflare
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4: Set-Cookie: __cfduid=d24b8d3a0bd7d98be8bf9fc0551af35ca1578155742; expires=Mon, 03-Feb-20 16:35:42 GMT; path=/; domain=.digitalocean.com; HttpOnly; SameSite=Lax
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4: X-Gateway: Edge-Gateway
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4: X-Request-Id: e5bd024c-64cd-43c4-8a72-35cc3d2e5d4a
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4:
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4: {
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4: "id": "unauthorized",
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4: "message": "Unable to authenticate you."
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4: }
2020-01-04T10:35:42.438-0600 [DEBUG] plugin.terraform-provider-digitalocean_v1.12.0_x4: -----------------------------------------------------
2020/01/04 10:35:42 [DEBUG] digitalocean_droplet.web: apply errored, but we're indicating that via the Error pointer rather than returning it: Error creating droplet: POST https://api.digitalocean.com/v2/droplets: 401 Unable to authenticate you.
2020/01/04 10:35:42 [TRACE] : eval: *terraform.EvalMaybeTainted
2020/01/04 10:35:42 [TRACE] EvalMaybeTainted: digitalocean_droplet.web encountered an error during creation, so it is now marked as tainted
2020/01/04 10:35:42 [TRACE] : eval: *terraform.EvalWriteState
2020/01/04 10:35:42 [TRACE] EvalWriteState: removing state object for digitalocean_droplet.web
2020/01/04 10:35:42 [TRACE] : eval: *terraform.EvalApplyProvisioners
2020/01/04 10:35:42 [TRACE] EvalApplyProvisioners: digitalocean_droplet.web has no state, so skipping provisioners
2020/01/04 10:35:42 [TRACE] : eval: *terraform.EvalMaybeTainted
2020/01/04 10:35:42 [TRACE] EvalMaybeTainted: digitalocean_droplet.web encountered an error during creation, so it is now marked as tainted
2020/01/04 10:35:42 [TRACE] : eval: *terraform.EvalWriteState
2020/01/04 10:35:42 [TRACE] EvalWriteState: removing state object for digitalocean_droplet.web
2020/01/04 10:35:42 [TRACE] : eval: *terraform.EvalIf
2020/01/04 10:35:42 [TRACE] : eval: *terraform.EvalIf
2020/01/04 10:35:42 [TRACE] : eval: *terraform.EvalWriteDiff
2020/01/04 10:35:42 [TRACE] : eval: *terraform.EvalApplyPost
2020/01/04 10:35:42 [ERROR] : eval: *terraform.EvalApplyPost, err: Error creating droplet: POST https://api.digitalocean.com/v2/droplets: 401 Unable to authenticate you.
2020/01/04 10:35:42 [ERROR] : eval: *terraform.EvalSequence, err: Error creating droplet: POST https://api.digitalocean.com/v2/droplets: 401 Unable to authenticate you.
2020/01/04 10:35:42 [TRACE] [walkApply] Exiting eval tree: digitalocean_droplet.web
2020/01/04 10:35:42 [TRACE] vertex "digitalocean_droplet.web": visit complete
2020/01/04 10:35:42 [TRACE] dag/walk: upstream of "provider.digitalocean (close)" errored, so skipping
2020/01/04 10:35:42 [TRACE] dag/walk: upstream of "meta.count-boundary (EachMode fixup)" errored, so skipping
2020/01/04 10:35:42 [TRACE] dag/walk: upstream of "root" errored, so skipping
2020/01/04 10:35:42 [TRACE] statemgr.Filesystem: not making a backup, because the new snapshot is identical to the old
2020/01/04 10:35:42 [TRACE] statemgr.Filesystem: no state changes since last snapshot
2020/01/04 10:35:42 [TRACE] statemgr.Filesystem: writing snapshot at terraform.tfstate

2020/01/04 10:35:42 [TRACE] statemgr.Filesystem: removing lock metadata file .terraform.tfstate.lock.info
2020/01/04 10:35:42 [TRACE] statemgr.Filesystem: unlocking terraform.tfstate using fcntl flock
Error: Error creating droplet: POST https://api.digitalocean.com/v2/droplets: 401 Unable to authenticate you.

on terraform.tf line 9, in resource "digitalocean_droplet" "web":
9: resource "digitalocean_droplet" "web" {

2020-01-04T10:35:42.461-0600 [DEBUG] plugin: plugin process exited: path=/home/alek/projects/terraform/.terraform/plugins/linux_amd64/terraform-provider-digitalocean_v1.12.0_x4 pid=26887
2020-01-04T10:35:42.461-0600 [DEBUG] plugin: plugin exited
``

[tbernacchi]

Same issue here:

Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.

Enter a value: yes

digitalocean_droplet.www-1: Creating...

Error: Error creating droplet: POST https://api.digitalocean.com/v2/droplets: 401 Unable to authenticate you.

on www-1.tf line 1, in resource "digitalocean_droplet" "www-1":
1: resource "digitalocean_droplet" "www-1" {

[carboniluca]

Same issue even with older versions of terraform.
However if you export the token it works fine.:
export DIGITALOCEAN_TOKEN="your_token_here"

[eddiezane]

Sorry y'all hit this. Is this a consistent issue or intermittent?

Anything you can provide to reproduce it?

Does the environment variable work for everyone when providing it through a var does not?

[eddiezane]

@alekgr also the correct syntax to use a variable in Terraform is without the quotes.

provider "digitalocean" {
  token = var.do_token
}

Does that fix your issue?

[bryanasdev000]

I am using it this way:

# Value set on terraform.tfvars
variable "do_token" {}

provider "digitalocean" {                                                                                                                           
  token = var.do_token
}

then on terraform.tfvars
do_token = "TOKEN"
and it's running fine.

You can also pass this as variable using -var="do_token=TOKEN".

Running Terraform v0.12.20 and go version go1.12.15 linux/amd64.

Also double check that your token have write access on it.

[tdyas]

I am getting this error semi-reliably during terraform import. Terraform appears to not be resolving the indirect attribute reference in the provider "digitalocean" block. (This is with terraform v0.12.20 and a recent master branch of the DigitalOcean provider.)

I have a preexisting Terraform configuration for which terraform apply finds nothing to do. My provider block is:

provider "digitalocean" {
  token = yamldecode(data.local_file.doctl_config.content).access-token
}

data "local_file" "doctl_config" {
  filename = pathexpand("~/.config/doctl/config.yaml")
}

I then try to import a digitalocean_domain resource by adding the digitalocean_domain resource block and by running (ID and domain redacted):

$ terraform import digitalocean_domain.XXX XXX.YYY.ZZZ 
digitalocean_domain.docean: Importing from ID "XXX"...
digitalocean_domain.docean: Import prepared!
  Prepared digitalocean_domain for import
digitalocean_domain.docean: Refreshing state... [id=XXX]

Error: Error retrieving domain: GET https://api.digitalocean.com/v2/domains/XXX.YYY.ZZZ: 401 Unable to authenticate you.

The interesting thing is I then commetned out the resource, ran terraform apply (to see it print out no changes needed), uncommented the resource, and then re-ran that terraform import command, and it worked:

$ terraform import digitalocean_domain.XXX XXX.YYY.ZZZ
digitalocean_domain.docean: Importing from ID "XXX"...
digitalocean_domain.docean: Import prepared!
  Prepared digitalocean_domain for import
digitalocean_domain.docean: Refreshing state... [id=XXX]

Import successful!

The resources that were imported are shown above. These resources are now in
your Terraform state and will henceforth be managed by Terraform.

It also happened in a slightly different way when I was trying to import another resource. [0] I added code to https://github.com/terraform-providers/terraform-provider-digitalocean/blob/c0d391a88bd2d6bced3bd159088b4b08f644d692/digitalocean/provider.go#L103 to print out the config as a debug log line (and configured my installation to use my locally-built plugin binary). When the provider block was as it was above (replying on an indirect attribute), then the access token ended up blank even with DIGITALOCEAN_TOKEN set in the environment. If I commented out the token = attribute, only then did Terraform look to the environment variables configured at https://github.com/terraform-providers/terraform-provider-digitalocean/blob/c0d391a88bd2d6bced3bd159088b4b08f644d692/digitalocean/provider.go#L15.

You will note that my access token actually does work because I did see success in one of the cases. I only saw this issue during terraform import and not plan or apply.

[0] That resource is a digitalocean_kubernetes_cluster, which hopefully I'll submit the import support as a PR soon.

[alekgr]

all I was able to resolved it. this can be closed