Local-exec destroy triggers - ignore changes to google access token

user_12142831 0
Viewed 639

I have a null_resource that has a local-exec block making a curl with a google access token. Since that's executed during a destroy, I am forced to define that as a triggers var.

Each time I do a terraform apply that null_resource is having to be replaced because google access token keeps changing.

 resource "null_resource" "env_to_group" {
   for_each = local.map_env_group

   triggers = {
     env_id       = google_apigee_environment.apigee[each.value.env].id
     group_id     = google_apigee_envgroup.apigee[each.value.group].id
     access_token = data.google_client_config.current.access_token
     project      = var.project
     group        = each.value.group
     env          = each.value.env
   }

   provisioner "local-exec" {
     when    = destroy
     command = <<EOF
         curl -o /dev/null -s -w "%%{http_code}" -H "Authorization: Bearer ${self.triggers.access_token}"\
           "https://apigee.googleapis.com/v1/organizations/${self.triggers.project}/envgroups/${self.triggers.group}/attachments/${self.triggers.env}" \
           -X DELETE -H "content-type:application/json"
         EOF
   }
 }

Is there a way to ignore changes to google access token, or is there a way not having to specify access token var within the triggers block?

terraform0.12+ terraform
1 Answers

I think you should still be able to accomplish this using the depends_on meta-argument and a separate resource for making the ephemeral access token available to the command during the destroy lifecycle.

resource "local_file" "access_token" {
    content     = data.google_client_config.current.access_token
    filename    = "/var/share/access-token"
}

resource "null_resource" "env_to_group" {
   for_each = local.map_env_group

   triggers = {
     env_id       = google_apigee_environment.apigee[each.value.env].id
     group_id     = google_apigee_envgroup.apigee[each.value.group].id
     project      = var.project
     group        = each.value.group
     env          = each.value.env
   }

   depends_on = [local_file.access_token]

   provisioner "local-exec" {
     when    = destroy
     command = <<EOF
         curl -o /dev/null -s -w "%%{http_code}" -H "Authorization: Bearer $(cat /var/share/access-token)"\
           "https://apigee.googleapis.com/v1/organizations/${self.triggers.project}/envgroups/${self.triggers.group}/attachments/${self.triggers.env}" \
           -X DELETE -H "content-type:application/json"
         EOF
   }
 }

I guess another solution would be to pass some kind of credentials to the command through which you could obtain the access token for the related service account through API calls, or use Application Default Credentials if configured.

kRON_440410
Related