ibm_database rejects S2S authorization policy when source resource group is set

[Aayush-Abhyarthi]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform IBM Provider Version

Affected Resource(s)

• ibm_database

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "ibm_database" "postgresqldb"{
// usual codes
plan = standard-gen2 // error occurs only with gen2 instances
key_protect_key = "some-kp-value"
}

// Policy created between the key and the icd like this -

resource "ibm_iam_authorization_policy" "kms_policy" {
  source_service_name      = "databases-for-postgresql"
  source_resource_group_id = var.resource_group_id // This line causes the error.
  roles                    = ["Reader", "Authorization Delegator"]
  description              = "...."
  resource_attributes {
    name     = "serviceName"
    operator = "stringEquals"
    value    = local.kms_service // kms service name
  }
  resource_attributes {
    name     = "accountId"
    operator = "stringEquals"
    value    = local.kms_account_id // account id
  }
  resource_attributes {
    name     = "serviceInstance"
    operator = "stringEquals"
    value    = local.kms_key_instance_guid // kms key guid
  }
  resource_attributes {
    name     = "resourceType"
    operator = "stringEquals"
    value    = "key"
  }
  resource_attributes {
    name     = "resource"
    operator = "stringEquals"
    value    = local.kms_key_id // kms key id
  }
  lifecycle {
    create_before_destroy = true
  }
}

Debug Output

Missing or mis-configured S2S Authorization Policy. The service could not configure 
access to the encryption key specified as crn:v1:bluemix:public:kms:us-south:...

Panic Output

Expected Behavior

Actual Behavior

Steps to Reproduce

1. terraform apply

Important Factoids

References

• #0000