Terraform on GCP - Error 409: Requested entity already exists

Stefan Falk 0
Viewed 52

I am trying to create a IAM Workload Identity Pool and a Pool Provider along with it.

However, running terraform apply sequentially more than once throws an error stating that the requested entity already exists.

This is in fact true but why exactly is this an issue and how can I avoid such an error?

│ Error: Error creating WorkloadIdentityPool: googleapi: Error 409: Requested entity already exists
│ 
│   with google_iam_workload_identity_pool.github,
│   on main.tf line 36, in resource "google_iam_workload_identity_pool" "github":
│   36: resource "google_iam_workload_identity_pool" "github" {

This is the Terraform description:

resource "google_iam_workload_identity_pool" "github" {
  workload_identity_pool_id = "github-identity-pool"
  display_name              = "GitHub Workload Identity Pool"
}

resource "google_iam_workload_identity_pool_provider" "github_identity_pool_provider" {
  workload_identity_pool_id          = google_iam_workload_identity_pool.github.workload_identity_pool_id
  workload_identity_pool_provider_id = "github-oidc"
  display_name                       = "GitHub OIDC Provider"
  attribute_mapping                  = {
    "google.subject" = "assertion.sub"
  }
  oidc {
    issuer_uri = "https://token.actions.githubusercontent.com"
  }
}
terraform google-cloud-platform
2 Answers

It seems that a DELETED pool might be the issue here.

After creating a new one by changing github-identity-pool to github-workload-identity-pool it started working again.

$ gcloud iam workload-identity-pools list --location global --show-deleted
---
displayName: GitHub Workload Identity Pool
name: projects/{PROJECT_NUMBER}/locations/global/workloadIdentityPools/github-identity-pool
state: DELETED
Stefan Falk0

Terraform creates, modifies or deletes resources base on its state (local file or remote - depending on setup).

And since you didn't create this resource with terraform it says: WorkloadIdentityPool doesnt' exist. Let's' create it and then, since it already exists - terraform fails.

Depending on your needs, you have two options here:

  1. Read only - if you only want to read from this resource than use data source - it will get data from this resource, and you can use it anywhere else. You can't modify this.
  2. Modify resources - in this case you want to write access, and you want to make terraform your source of knowledge, then what you need is terraform import command.

But why don't you have this resource in your terraform state? There can be multiple reasons:

  • state file was removed
  • terraform apply was interrupted
  • terraform got timeout

Two bottom reasons could go like this:

  1. Terraform sents request to API
  2. You are interrupting process or terraform timed out
  3. Terraform didn't get "OK" from api, and this means for him "didn't create resource"...
  4. ... but API didn't got chance to sent "OK" and system is still working. Than it finishes creating resource, but... there is noone to sent "OK" to.
ravenwing0
Related