Potential bug with new terraform `clickhouse_database` resource

[willbeaufoy]

I am trying to use the new terraform clickhouse_database resource in v2.2.0-alpha1. I can create a clickhouse_service fine, but the databases error with Could not create database, unexpected error: status: 401, body: {"error":"Unauthorized"}. My API token has full admin permissions. I assume I should be able to create the databases if I can create the service. My terraform looks like:

resource "clickhouse_service" "service" {
  name           = "${local.aws_account_id}-${var.service_name_suffix}"
  cloud_provider = "aws"
  region         = "eu-west-2"
  tier           = var.environment == "prod" ? "production" : "development"
  idle_scaling   = true

  ip_access = [
    {
      source      = "0.0.0.0"
      description = "Allow All Connections"
    }
  ]

  idle_timeout_minutes  = 15
  max_replica_memory_gb = var.environment == "prod" ? 72 : null
  min_replica_memory_gb = var.environment == "prod" ? 24 : null

  password = var.clickhouse_cloud_password
}

resource "clickhouse_database" "mapped" {
  service_id = clickhouse_service.service.id
  name       = "mapped"
}

resource "clickhouse_database" "mapped_atlas_dev" {
  service_id = clickhouse_service.service.id
  name       = "mapped_atlas_dev"
}

[willbeaufoy]

Looking at https://clickhouse.com/docs/cloud/manage/api/services-api-reference I'm guessing it's because the API keys which are used for the terraform provider do not yet give access to databases.

[whites11]

Hello @willbeaufoy and thanks a lot for testing out our pre-release feature.
You guessed it right, the API key you are using to create a database is not allowed to create databases. This is because the database resource uses a feature named query API that you didn't enable in your service.
In order to do so, please follow the example here.

In a nutshell you need to add these blocks to your tf files:

data "clickhouse_api_key_id" "self" {
}

resource "clickhouse_service" "service" {
  ...
    query_api_endpoints = {
    api_key_ids = [
      data.clickhouse_api_key_id.self.id,
    ]
    roles = [
      "sql_console_admin"
    ]
    allowed_origins = null
  }
  ...
}

[whites11]

I added a new example to use the database resource here https://github.com/ClickHouse/terraform-provider-clickhouse/blob/main/examples/database/main.tf
I also made it clear in the resource docs that query_api_endpoints is needed to use clickhouse_database.

I'll go on and close this ticket, feel free to reopen or create a new ticket should you have any more trouble.

[willbeaufoy]

I added a new example to use the database resource here https://github.com/ClickHouse/terraform-provider-clickhouse/blob/main/examples/database/main.tf I also made it clear in the resource docs that query_api_endpoints is needed to use clickhouse_database.

I'll go on and close this ticket, feel free to reopen or create a new ticket should you have any more trouble.

Ah brilliant thank you, yes this fixed it, but yes good idea to make it clearer in the docs.