Terraform-provider-google: Terraform import failing for google_compute_network_peering

[jharshman]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• If an issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to "hashibot", a community member has claimed the issue already.

Terraform Version

Terraform v0.12.6
+ provider.google v3.1.0
+ provider.google-beta v3.1.0

Affected Resource(s)

• google_google_compute_network_peering

Terraform Configuration Files

resource "google_compute_network_peering" "peer_prod_qa" {
   name         = "prod-qa"
   network      = "${google_compute_network.prod.self_link}"
   peer_network = "${google_compute_network.qa.self_link}"
}

Expected Behavior

terraform import google_compute_network_peering.peer_prod_qa {project}/{network}/{name}

Should have imported the resource into the state.

Actual Behavior

Fails to import into state and complains about other resources.

google_compute_network_peering.peer_prod_qa: Importing from ID "REDACTED/prod/prod-qa"...
google_compute_network_peering.peer_prod_qa: Import prepared!
  Prepared google_compute_network_peering for import
google_compute_network_peering.peer_prod_qa: Refreshing state... [id=prod/prod-qa]
Error: Invalid resource instance data in state
  on /REDACTED/src/github.com/REDACTED/REDACTED/infrastructure/terraform/environments/gc4/gcp.tf line 21:
  21: resource "google_project" "REDACTED_gcp_prod" {
Instance google_project.REDACTED_gcp_prod data could not be decoded from the
state: unsupported attribute "app_engine".

Steps to Reproduce

1. remove from stateterraform state rm google_compute_network_peering.peer_prod_qa
2. attempt to import terraform import google_compute_network_peering.peer_prod_qa {project}/{network}/{name}
   

   Important Factoids

This is occurring during a provider update from 2.20.0 to 3.1.0. The terraform state rm and import are an attempt to sidestep some resource re-creation that was being forced due to API changes.

References

Might be related to

• #5068

[megan07]

Hi @jharshman! Thank you for reporting this issue. I've been trying to reproduce it, but have not been able to. I see in the error there seems to be an issue with the google_project resource. Is it possible to share the rest of your configuration? Thanks!

[jharshman]

@megan07 thanks for looking into this! Below I included the project resource config. I'm not sure where the errors about state: unsupported attribute "app_engine". are coming from. Can't find app_engine referenced anywhere in my Terraform configs.

resource "google_project" "REDACTED_gcp_prod" {
  name            = "REDACTED GCP Prod"
  project_id      = "REDACTED-gcp-prod"
  folder_id       = ""
  billing_account = ""
}

[megan07]

Thank you @jharshman! Sorry, I still was not able to reproduce this - do you have any debug logs by any chance? And the app_engine thing is very odd. Are you able to see if app_engine appears in your state file at all? Thanks!

[jharshman]

@megan07 I ran a terraform state list | grep app_engine and got no results.

[jwcmd]

Any chance you see app_engine in the output of terraform show?

terraform state list looks like it just lists the resource names, but if this is an attribute of a resource it may only show up in terraform show.

Hope that helps!

[yannlambret]

I it helps, I think it's related to this commit: https://github.com/terraform-providers/terraform-provider-google/commit/1b413bcb4e704933b16f61207b4f70c0cb6a4dbb#diff-c9e10abda825286093bfa6bbad9fb4c2

The datasource google_project does not support app_engine attribute anymore because the latter has been removed from the primary resource google_project (in 3.3.0 provider version). I also had trouble trying to import a google_compute_router_peer resource, and I had to clean up the following attributes for every occurrence of a google_project datasource in my .tfstate file:

• app_engine
• policy_data
• policy_etag

Of course, I just did it as a test because I wouldn't call that a clean migration path.

[megan07]

Hi @jharshman and @yannlambret, thank you for your updates and further research into this. I think I understand the problem and have a couple of directions of where I might go from here. Unfortunately, I’m still unable to recreate it to test these ideas out.

I have a configuration with 2 google_compute_network resources, a google_compute_network_peering resource and a google_project datasource.
I create it with version 1.15.0 of the provider and I can see the app_engine attribute value populated in state.
I remove google_compute_network_peering from state.
I upgrade to 3.0.0 and import google_compute_network_peering back into state.

Am I missing a step? I’ve tried upgrading to 2.20.0 first and removing the google_compute_network_peering resource there before upgrading to 3.0.0, and I’ve tried runningterraform apply with both the 2.20.0 and 3.0.0 versions to see the datasource get upgraded, but still have not been able to reproduce the error. Any more feedback would be appreciated!

Thanks!

[yannlambret]

Hi @megan07, as far as I'm concerned, it's difficult to assess with any certainty which provider version could have lead to this issue, because we have been using multiple versions of the provider, including beta ones. So it may well be an edge case. I've just noticed that the issue only occurs when using the terraform import command. When testing, I've switched the provider from v2.20.1 to v3.3.0.

I have to say I'm not familiar with the theoretical behavior of terraform regarding obsolete resource attributes. Is there some kind of logic to remove the old references from the state when upgrading the provider?

[megan07]

Hi @yannlambret! Thanks again for the response! So it seems like app_engine was used in 1.x.x versions. In 2.0.0 we marked it as Removed, which should update the state to empty out that value once terraform apply is run. I’m seeing it do this when I follow the path above. Upgrading to 3.0.0, we took out the Removed field and this should remove it from the state file at all. I will note that this only happens on terraform apply and not on terraform import (so maybe that has something to do with this?)

Terraform, itself, should be responsible for the state upgrade with these Schema changes, so I’m leaning toward marking this as an upstream issue in Terraform. However, I’d really like to reproduce it to see if I can provide more details when I forward the bug onto them.

Can you tell me if these fields were populated in your state file prior to upgrading to 3.0.0? Or were they empty values?
Can I see your list of providers that you’re using, and their current versions?
Can you show me any debug logs?

Was your order of operations similar to mine above? Basically:

1. terraform apply (at some point) with 1.X.X,
2. Upgraded to 2.X.X
3. terraform apply (at some point) with 2.X.X,
4. terraform state rm with 2.X.X,
5. Upgraded to 3.X.X
6. terraform import in 3.X.X

Did you terraform apply anything before trying to import back in?

Thanks for your patience as I dive into this further!

[tchiotludo]

Same here, but I've this error during a simple plan after the upgrade from 2.8 to 3.17.

Error: unsupported attribute "app_engine".

Error: unsupported attribute "policy_data"

Error: unsupported attribute "policy_etag"

After looking my state file, I notice that :

    {
      "module": "module.gcp.module.common",
      "mode": "data",
      "type": "google_project",
      "name": "my_data_project",
      "provider": "provider.google.prd",
      "instances": [
        {
          "schema_version": 0,
          "attributes": {
            "app_engine": [],
            "auto_create_network": null,
            "...": "...",
            "policy_data": null,
            "policy_etag": null,
            "...": "..."
          }
        }
      ]
    }

I remove app_engine, policy_data & policy_etag attribute from my state file and the plan works well.

[preston-hf]

I'm seeing this as well when trying to import state during a provider upgrade. terraform plan works just fine other than trying to create resources that already exist. for me it's app_engine on project and predefined_acl on bucket resources. Can I add any info to help?

[megan07]

Hi @preston-hf! If you could share your configuration and let me know your order of operations that'd be great. I'm trying to reproduce the error at all, so anything can help.
I've tried creating the above resources at a 2.X.0 version and then removing the google_compute_network_peering resource. Afterward I upgrade to 3.X.0 and import it again and it seems fine. If I can step through exactly what you're doing (please include versions as well), I can see if I can reproduce it with your configuration.
I'm also curious to know at what version the initial resources were created. Were the originally created in a 1.X.0 version, they upgraded to 2.X.0 ok, but then had the problems at 3.X.0? These are just a few of my questions that if you could help with, that'd be great!
Thanks for reaching out!

[preston-hf]

So I actually ran into this when trying to import iap_brand and iap_client resources. We were running the latest 2.x version (2.20.3) and had created an IAP brand and client manually using the web UI. We upgrade to 3.17 which supports the iap_brand and iap_client resources so we defined them and planned on importing them. When we went to import we got one of these error messages talking about not being able to decode for each project in GCP, and a couple of other related messages about failing to decode the state as well. I found a workaround by using the beta provider on the resources we wanted to import, and they imported just fine.

[megan07]

Hi @preston-hf! Thank you for the extra information. I am so sorry for the delay on this. I tried it again, just importing iap_brand. Are you able to show me your configuration prior to importing iap_brand and iap_client? I was able to import them successfullly with 3.17.0 and a previous state of 2.20.3. I only had the project datasource in my previous state, but I'm wondering if maybe another resource/datasource is interfering.
Also, could you tell me what version of Terraform you are running?

[jwieringa]

I understand I have run into the same issue on google_project. Here are the versions and the steps I took place prior to the error. Please let me know if there is anything more I can provide, thanks!

Resource:

resource "google_project" "app" {
  name            = "App ${local.env} resources"
  billing_account = data.google_billing_account.app.id
  project_id      = local.name_prefix
  folder_id       = data.google_folder.app_team.name
}

Error message:

Error: Invalid resource instance data in state

  on gce.tf line 11:
  11: resource "google_project" "app" {

Instance google_project.app data could not be decoded from the state:
unsupported attribute "app_engine".

Versions:

During import:

• Terraform 0.11
• Google Provider 2.20

Versions with observed error:

• Terraform 0.13
• Google Provider 3.36.0

Steps:

1. Import google project
2. Upgrade Terraform
3. Terraform apply
4. Observe error

Work around:

$ terraform state rm google_project.app
$ terraform import google_project.app app

[ael-computas]

Same here, but I've this error during a simple plan after the upgrade from 2.8 to 3.17.

Error: unsupported attribute "app_engine".

Error: unsupported attribute "policy_data"

Error: unsupported attribute "policy_etag"

After looking my state file, I notice that :

    {
      "module": "module.gcp.module.common",
      "mode": "data",
      "type": "google_project",
      "name": "my_data_project",
      "provider": "provider.google.prd",
      "instances": [
        {
          "schema_version": 0,
          "attributes": {
            "app_engine": [],
            "auto_create_network": null,
            "...": "...",
            "policy_data": null,
            "policy_etag": null,
            "...": "..."
          }
        }
      ]
    }

I remove app_engine, policy_data & policy_etag attribute from my state file and the plan works well.

this worked for me as well in a production setup. also removed "predefined_acl"
My state was in a remote gcs bucket.
I of course took a backup of the state file before attempting this black wizardry ;)