Terraform-provider-newrelic: account_id not inherited correctly from provider config block

[pickgr]

I've been working with Sean Wiley from NewRelic on this issue and he asked me to post it here.

Terraform Version

Terraform v0.11.11

Affected Resource(s)

newrelic_alert_policy (data source)

If this issue appears to affect multiple resources, it may be an issue with Terraform's core, so please mention this.

Terraform Configuration Files

terraform {
  required_version = "= 0.12.13"
}

provider "newrelic" {
  version = "2.1.2"
  api_key = "<redacted>
  admin_api_key = "<redacted>"
  account_id = "<redacted>
  region = "US"
}

data "newrelic_alert_policy" "ops_notify_slack" {
  name = "ops-notify-slack"
}

Debug Output

$ terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

data.newrelic_alert_policy.ops_notify_slack: Refreshing state...

Error: 401 response returned: Bad API Key or no API Key provided, null

  on data.tf line 1, in data "newrelic_alert_policy" "ops_notify_slack":
   1: data "newrelic_alert_policy" "ops_notify_slack" {

Expected Behavior

Provider should authenticate against our account and be able to use API to retrieve data source information.

Actual Behavior

A 401 error is returned as shown above.

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform plan

Important Factoids

I realize this is probably not at all reproducible without access to our account and the keys. Sean Wiley has verified that everything appears to configured correctly per the 2.x migration guide. We've been using the 1.18.0 provider extensively for some time.

References

Could not find any

[jthurman42]

The resource newrelic_alert_policy was migrated to a new GraphQL endpoint (NerdGraph), which requires the use of a Personal API key.

We recently updated the Migration guide, which should hopefully help, but here is a summary for API key related items:

Migrating from 1.x to 2.x, the config options were shuffled around a bit.

1.x api_key => 2.x admin_api_key
2.x api_key is a personal API key (ref docs above)

Also ensure that the environment is either set the same or unset as the following env vars will take priority:
NEW_RELIC_API_KEY
NEW_RELIC_PERSONAL_API_KEY
NEW_RELIC_ACCOUNT_ID
NEW_RELIC_REGION

(Spoiler, we're moving as many resources over to the new endpoint as fast as possible/as they become available)

[pickgr]

@jthurman42 thanks for the response. We have double-checked these values and still have the issue. We're also continuing to work with NewRelic support (Sean Wiley)

[swily]

@jthurman42 we have also verified API keys work through API REST explorer, successfully returning JSON response when requesting this resource

[jthurman42]

The api_key value should _not_ work with the REST explorer, that uses REST and Admin API keys. Try validating using the GraphQL UI available here: https://api.newrelic.com/graphiql You can select a personal key from that UI.

[jthurman42]

Alternatively, you could test the API key with the following cURL command:

# Optionally set the key in the Environment
$ export NEW_RELIC_API_KEY=<the api key>

# Use cURL to make a GraphQL request asking for your user id and name back (account agnostic)
$ curl https://api.newrelic.com/graphql \
  -H 'Content-Type: application/json' \
  -H "API-Key: ${NEW_RELIC_API_KEY}" \
  --data-binary '{"query":"{ actor { user { id name } } } ", "variables":""}'

[jthurman42]

@pickgr thank you for the chat today, definitely helped to reproduce this issue.

Overview:

If account_id is configured at the provider level IN the config, it is not properly passed to through to data newrelic_alert_policy (perhaps others). Adding account_id as an Environment variable OR to the data source resolves the issue.

TODO: Identify why the provider configuration is not passed to the data source when set in config, but is for Env vars.

Since we have a work-around, I'll take a look at this next week and get it into a patch release.

[skyzyx]

This sounds like the same issue I'm also encountering. Since we have 5 different New Relic sub-accounts, we have some custom tooling which wraps the Terraform and passes the appropriate environment variable values when calling Terraform.

NEW_RELIC_REGION=US NEW_RELIC_ACCOUNT_ID=-****** NEW_RELIC_API_KEY=NRAK-****** NEW_RELIC_ADMIN_API_KEY=NRAA-****** terraform plan

We're using Terraform v0.12.28 and NR provider 2.2.1.

2020-07-17T16:51:27.464-0700 [DEBUG] plugin.terraform-provider-newrelic_v2.2.1: time="2020-07-17T16:51:27-07:00" level=debug msg="performing request" method=GET url="https://api.newrelic.com/v2/alerts_channels.json" 2020-07-17T16:51:27.464-0700 [DEBUG] plugin.terraform-provider-newrelic_v2.2.1: time="2020-07-17T16:51:27-07:00" level=trace msg="request details" body="<nil>" headers="{\"Api-Key\":[\"NRAK-*****(my stars)\"],\"Auth-Type\":[\"User-Api-Key\"],\"Content-Type\":[\"application/json\"],\"Newrelic-Requesting-Services\":[\"terraform-provider-newrelic|newrelic-client-go\"],\"User-Agent\":[\"HashiCorp Terraform/0.12.28 (+https://www.terraform.io) Terraform Plugin SDK/1.10.0 terraform-provider-newrelic/dev\"]}"

It appears to be using the Personal API key (passed as an environment variable), but is responding with a 401 when trying to create a new Notification Channel. Happening to multiple users. All have the _Alerts Manager_ permission. All can manually create Notification Channels in the UI.

Error: 401 response returned: User does not have permission

[skyzyx]

One of my users sent me this repro case.

provider "newrelic" {
  # https://github.com/newrelic/terraform-provider-newrelic/releases/latest
  version = "2.2.1"
  region = "US"
  account_id = "1234567"
  api_key = "NRAK-***"
  admin_api_key = "NRAA-***"
}

resource "newrelic_alert_policy" "foo" {
  name = "example"
  incident_preference = "PER_POLICY" # PER_POLICY is default
}

resource "newrelic_alert_channel" "first" {
  name = "bar"
  type = "email"

  config {
    recipients              = "[email protected]"
    include_json_attachment = "1"
  }
}

resource "newrelic_alert_channel" "second" {
  name = "bar"
  type = "email"

  config {
    recipients              = "[email protected]"
    include_json_attachment = "1"
  }
}

resource "newrelic_alert_policy_channel" "testing" {
  policy_id = newrelic_alert_policy.foo.id
  channel_ids = [
    newrelic_alert_channel.first.id,
    newrelic_alert_channel.second.id,
  ]
}