Terraform: google: could not find default credentials when deleting module

[zagr0]

Terraform Version

Terraform v0.12.17

Terraform Configuration Files

Initial configuration

variable "gcp_credentials" {
}
variable "gcp_project_name" {
}

provider "google" {
  credentials = file(var.gcp_credentials)
  project     = var.gcp_project_name
  region      = "us-west2"
  alias       = "us-west2"
}

module "module-gcp" {
  source  = "./modules/gcp-resources"
  providers = {
    google = google.us-west2
  }
  some_var = "some_value"
}

modules/gcp-resources/main.tf

variable "some_var" {
}

resource "google_compute_network" "network" {
  name = var.some_var
  auto_create_subnetworks = "false"
}

updated configuration to remove module resources

variable "gcp_credentials" {
}
variable "gcp_project_name" {
}

provider "google" {
  credentials = file(var.gcp_credentials)
  project     = var.gcp_project_name
  region      = "us-west2"
  alias       = "us-west2"
}

#module "module-gcp" {
#  source  = "./modules/gcp-resources"
#  providers = {
#    google = google.us-west2
#  }
#  some_var = "some_value"
#}

Expected Behavior

Terraform should destroy resources from module and exit with success

Actual Behavior

Terraform apply failed, exit code 1
STDERR:

Error: google: could not find default credentials. See https://developers.google.com/accounts/docs/application-default-credentials for more information.

  on <empty> line 0:
  (source code not available)

Steps to Reproduce

1. Use initial plan to create resources
2. terraform init
3. terraform apply -var 'gcp_project_name=project_name' -var 'gcp_credentials=gcp-credentials.json' - SUCCESS
4. Use plan with removed module to remove resources
5. terraform init
6. terraform apply 'gcp_project_name=project_name' -var 'gcp_credentials=gcp-credentials.json' - FAILURE

Additional Context

there is already opened ticket for the google provider, but they said this is core issue
https://github.com/terraform-providers/terraform-provider-google/issues/4272

[jbardin]

Hi @zagr0,

Is it possible to share the source of the module as well? If not, are you certain that you don't have another google provider defined somewhere within that module?

Thanks!

[zagr0]

sure
modules/gcp-resources/main.tf

variable "some_var" {
}

resource "google_compute_network" "network" {
  name = var.some_var
  auto_create_subnetworks = "false"
}

[jbardin]

Thanks @zagr0,

It appears that the module resources are being removed correctly, and are using the correct provider. The error is coming from terraform trying to also configure a default google provider, which does not have any credentials defined.

[pselle]

@zagr0 Thank you for providing your replication case! I ran through this on the current master branch of Terraform (deploying soon) and was unable to reproduce. I followed both your steps of init/apply/remove module+apply/init/apply again as well as init/apply/remove module/init/apply. In both cases the removed module+resource was removed.

[jbardin]

Thanks for verifying this @pselle!
This was fixed by #23696

[zagr0]

hi @jbardin , @pselle

Looks like there is some regression, just tested on 0.12.19 and got error:

  STDERR:

Error: leftover module module.gcp_module in state that should have been removed; this is a bug in Terraform and should be reported

[jbardin]

Hi @zagr0,

We have that issue recorded at #22579.
The simple example above does not seem to reproduce the issue. If you have a good reproduction, or even the resulting state if there is no sensitive data, please add it to that issue.

Thanks!

[jbardin]

Sorry, this does look like a regression, but I cannot reproduce it with the config above. It's hard to reproduce in some cases, because the problem is with non-deterministic ordering of operations. I'm going to take care of it with #23821.

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.