fix(iam_policy_project): set RegionType=Global to use the global IAM endpoint#238
Open
cofyc wants to merge 1 commit intovolcengine:masterfrom
Open
fix(iam_policy_project): set RegionType=Global to use the global IAM endpoint#238cofyc wants to merge 1 commit intovolcengine:masterfrom
cofyc wants to merge 1 commit intovolcengine:masterfrom
Conversation
…endpoint
The ReadResource for volcenginecc_iam_policy_project (added in v0.0.189)
omits RegionType, so it falls through to RegionType=Regional (zero value
of the iota-based enum). The Universal client then routes the call to a
regional IAM endpoint (e.g. iam.cn-shanghai.volcengineapi.com) instead
of the global one (iam.volcengineapi.com).
In practice every read fails with:
RequestError: send request failed
Reproduced via 'terraform import' on multiple existing project-scoped
group policy attachments (PrincipalType=UserGroup) in cn-shanghai.
Every other IAM resource in this provider that calls
ListAttachedUserGroupPolicies (e.g. iam_user_group_policy_attachment)
already sets RegionType: ve.Global; this is the same one-line fix.
Author
|
cc @stackend |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
ReadResourceforvolcengine_iam_policy_project(added in v0.0.189) omitsRegionType, so it falls through toRegionType: Regional(zero value of theiota-based enum). The Universal client then routes the call to a regional IAM endpoint (e.g.iam.cn-shanghai.volcengineapi.com) instead of the global one (iam.volcengineapi.com).In practice every Read fails with the cryptic transport error:
Every read errors → every plan errors → resource is unusable. This blocks importing existing project-scoped attachments and prevents drift detection on managed ones.
Reproduction
terraform planreturns:Fix
One line — add
RegionType: ve.Globalto the inlineUniversalInfo. After the patch the same plan succeeds with0 to add, 0 to change, 0 to destroyand the resource is correctly imported.Every other IAM resource in this provider that calls
ListAttachedUserGroupPolicies(e.g.iam_user_group_policy_attachment'sgetUniversalInfohelper) already setsRegionType: ve.Global— this fix just bringsiam_policy_projectin line with the rest.Test plan
terraform planagainst a real Volcengine account incn-shanghaiwith 15 existing project-scoped UserGroup attachments.RequestError: send request failed.0 to add, 0 to change, 0 to destroy.