Failing updating resource google_sql_database_instance

[TachoArancibia]

Community Note

Hi!

I have a problem when I tried to update the next resource google_sql_database_instance. These are my HTTP request and response. Maybe could be the attribute enableGoogleMlIntegration on the body request that it doesn't exist in the documentation of the sqladmin.googleapis.com https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/instances#DatabaseInstance

---[ REQUEST ]---------------------------------------
PUT /sql/v1beta4/projects/data-bases-shared-xxxx/instances/mssql-switch-shared-us-central1?alt=json&prettyPrint=false HTTP/1.1
Host: sqladmin.googleapis.com
User-Agent: google-api-go-client/0.5 Terraform/1.9.7 (+https://www.terraform.io) Terraform-Plugin-SDK/2.33.0 terraform-provider-google-beta/5.45.2 blueprints/terraform/terraform-google-sql-db:mssql/v25.0.0
Content-Length: 1123
Content-Type: application/json
X-Goog-Api-Client: gl-go/1.21.13 gdcl/0.191.0
Accept-Encoding: gzip
2025-03-19T09:26:29.273-0300 [DEBUG] provider.terraform-provider-google-beta_v5.45.2_x5
{
"instanceType": "CLOUD_SQL_INSTANCE",
"settings": {
"activationPolicy": "ALWAYS",
"availabilityType": "ZONAL",
"backupConfiguration": {
"backupRetentionSettings": {
"retainedBackups": 3,
"retentionUnit": "COUNT"
},
"binaryLogEnabled": false,
"enabled": true,
"pointInTimeRecoveryEnabled": true,
"startTime": "03:00",
"transactionLogRetentionDays": 3
},
"connectorEnforcement": "NOT_REQUIRED",
"dataDiskSizeGb": "100",
"dataDiskType": "PD_SSD",
"edition": "ENTERPRISE",
"enableDataplexIntegration": false,
"enableGoogleMlIntegration": false,
"ipConfiguration": {
"allocatedIpRange": "google-managed-services-vpc-data-bases-shared",
"authorizedNetworks": [
{
"name": "xxx-xxx", // Deliberately obfuscated
"value": "xxx.xxx.xxx.xxx" // Deliberately obfuscated
}
],
"ipv4Enabled": false,
"privateNetwork": "projects/data-bases-shared-xxxx/global/networks/vpc-data-bases-shared",
"requireSsl": false,
"serverCaMode": "GOOGLE_MANAGED_INTERNAL_CA",
"sslMode": "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
},
"locationPreference": {
"zone": "us-central1-c"
},
"maintenanceWindow": {
"day": 7,
"hour": 5,
"updateTrack": "canary"
},
"pricingPlan": "PER_USE",
"settingsVersion": "90",
"storageAutoResize": true,
"tier": "db-custom-2-7680",
"timeZone": "Pacific SA Standard Time"
}
}

2025/03/19 09:26:30 [DEBUG] Google API Response Details:
---[ RESPONSE ]--------------------------------------
HTTP/2.0 400 Bad Request
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Type: application/json; charset=UTF-8
Date: Wed, 19 Mar 2025 12:26:30 GMT
Server: ESF
Vary: Origin
Vary: X-Origin
Vary: Referer
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 0
2025-03-19T09:26:30.096-0300 [DEBUG] provider.terraform-provider-google-beta_v5.45.2_x5
{
"error": {
"code": 400,
"message": "The incoming request contained invalid data.",
"errors": [
{
"message": "The incoming request contained invalid data.",
"domain": "global",
"reason": "invalidRequest"
}
]
}
}
2025-03-19T09:26:30.096-0300 [DEBUG] provider.terraform-provider-google-beta_v5.45.2_x5
-----------------------------------------------------

Terraform Version & Provider Version(s)

Terraform v1.9.7
on

• provider registry.terraform.io/hashicorp/google v5.45.2
• provider registry.terraform.io/hashicorp/google-beta v5.45.2

Affected Resource(s)

google_sql_database_instance

[ggtisc]

Hi @TachoArancibia since you are not using terraform directly, are you using a 3rd party software to send that request? I suggest you check terraform registry (link here) in addition to the API documentation (link here) to see examples of how terraform works and compare it with the API because they are not the same, it is true that the terraform Google provider is based on the API, but internally works with their own rules. For that reason you need to check which resources are optional and which are required and the composition of the code. If you have a terraform code example of what are you trying to create please share it

[TachoArancibia]

Yes, I'm using Terragrunt (version 0.75.4) and use this source to create that "git::https://github.com/terraform-google-modules/terraform-google-sql-db.git//modules/mssql?ref=v25.0.0".

I do not specify use the enableGoogleMlIntegration in my variables:

terragrunt-debug.tfvars.json
{
"availability_type": "ZONAL",
"backup_configuration": {
"binary_log_enabled": false,
"enabled": true,
"location": "us",
"point_in_time_recovery_enabled": true,
"retained_backups": 3,
"retention_unit": "COUNT",
"start_time": "03:00",
"transaction_log_retention_days": "3"
},
"create_timeout": "30m",
"database_version": "SQLSERVER_2019_WEB",
"db_charset": "UTF8",
"db_collation": "en_US.UTF8",
"delete_timeout": "30m",
"deletion_protection": false,
"disk_size": 100,
"enable_default_db": false,
"ip_configuration": {
"allocated_ip_range": "google-managed-services-vpc-data-bases-shared",
"authorized_networks": [
{
"name": "xxx.xxx.xxx",
"value": "xxx.xxx.xxx"
}
],
"ipv4_enabled": false,
"private_network": "projects/data-bases-shared-xxxx/global/networks/vpc-data-bases-shared",
"ssl_mode": "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
},
"maintenance_window_day": "7",
"maintenance_window_hour": "5",
"name": "mssql-switch-shared-us-central1",
"project_id": "data-bases-shared-xxxx",
"region": "us-central1",
"tier": "db-custom-2-xxxx",
"time_zone": "Pacific SA Standard Time",
"update_timeout": "30m",
"zone": "us-central1-c"
}

[ggtisc]

Hi @TachoArancibia I noticed a couple of errors in your request, have you followed the bug template to see what is happening? and could you share your terraform plan?

Based on your JSON request I created the below terraform code, but there are many inconsistencies on the values you are sharing resulting in a error similar to yours, for that reason I suggested to check the values you are using in comparison to Google Cloud and terraform registry documentation, because I'm noticing a couple of inconcistencies.

resource "google_compute_network" "vpc_21929" {
    name                    = "vpc-21929"
    auto_create_subnetworks = false
}

resource "google_compute_subnetwork" "subnet_21929" {
  name          = "subnet-21929"
  ip_cidr_range = "172.16.0.0/24"
  network       = google_compute_network.vpc_21929.id
  region        = "us-central1"
}

resource "google_compute_global_address" "global_address_21929" {
  name          = "global-address-21929"
  purpose       = "VPC_PEERING"
  address_type  = "INTERNAL"
  prefix_length = 16
  network       = google_compute_network.vpc_21929.id
}

resource "google_service_networking_connection" "networking_connection_21929" {
  network                 = google_compute_network.vpc_21929.id
  service                 = "servicenetworking.googleapis.com"
  reserved_peering_ranges = [google_compute_global_address.global_address_21929.name]
}

resource "google_sql_database_instance" "sql_db_instance_21929" {
  name                = "sql-db-instance-21929"
  database_version    = "SQLSERVER_2019_WEB"
  region              = "us-central1"
  deletion_protection = false
  instance_type       = "CLOUD_SQL_INSTANCE"
  depends_on          = [google_service_networking_connection.networking_connection_21929]
  root_password       = "something"

  settings {
    tier                          = "db-custom-2-7680"
    activation_policy             = "ALWAYS"
    availability_type             = "ZONAL"
    connector_enforcement         = "NOT_REQUIRED"
    disk_size                     = 100
    disk_type                     = "PD_SSD"
    edition                       = "ENTERPRISE"
    enable_dataplex_integration   = false
    enable_google_ml_integration  = false
    pricing_plan                  = "PER_USE"
    disk_autoresize               = true
    time_zone                     = "Pacific SA Standard Time"

    backup_configuration {
      binary_log_enabled              = false
      enabled                         = true
      point_in_time_recovery_enabled  = true
      start_time                      = "03:00"
      transaction_log_retention_days  = 3

      backup_retention_settings {
        retained_backups  = 3
        retention_unit    = "COUNT"
      }
    }

    ip_configuration {
      allocated_ip_range  = "google-managed-services-vpc-data-bases-shared"
      ipv4_enabled        = false
      private_network     = google_compute_network.vpc_21929.id
      server_ca_mode      = "GOOGLE_MANAGED_INTERNAL_CA"
      ssl_mode            = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"

      authorized_networks {
        name  = "authorized_networks_21929"
        value = google_compute_subnetwork.subnet_21929.ip_cidr_range
      }
    }

    location_preference {
      zone = "us-central1-c"
    }

    maintenance_window {
      day           = 7
      hour          = 5
      update_track  = "canary"
    }
  }
}

Errors:

Error: Error, failed to create instance sql-db-instance-21929: googleapi: Error 400: The incoming request contained invalid data.
│ Details:
│ [
│   {
│     "@type": "[type.googleapis.com/google.rpc.DebugInfo](http://type.googleapis.com/google.rpc.DebugInfo)",
│     "detail": "[ORIGINAL ERROR] boss::8: SQL Server doesn't support SSL mode TRUSTED_CLIENT_CERTIFICATE_REQUIRED. [gdata.Errors] { error { domain: \"cloud.sql.BossError\" code: \"INVALID_REQUEST\" debug_info: \"BossException (INVALID_REQUEST): SQL Server doesn\\'t support SSL mode TRUSTED_CLIENT_CERTIFICATE_REQUIRED.. {domain: cloud.sql.BossError, code: INVALID_REQUEST, arguments

The Cloud SQL instance is already configured to accept connections from the private IP ranges within your VPC via the private service connection. Therefore, we should remove the authorized_networks block entirely.