1-org: Apply fails for scc resources with API version error. #1189
Comments
|
I have seen a similar SCC API error in a 1st run through the TEF - a fix and a 2nd run were ok try adding directly to the tf service account as a temporary workaround until a check on the roles added during sa creation are tested account sa-terraform-bootstrap@seed... is used for steps 1+ on a 2nd run after enabling roles/securitycenterAdmin on the super admin running the deployment although this sa is only used for 0-bootstrap, as sa-terraform-bootstrap@seed... is used for steps 1+ 
|
|
Hi, Thanks for the reply. I then tested running an scc command whilst impersonating the user: But I am still seeing the API no longer available error in response. To be certain I also attempted to deploy the resources in cloud build but similarly had no luck. |
|
Hi @zexoor, the scc_notification_config entry in the registry has a note regarding enrolling in SCC.
maybe you need to follow that enrollment procedure for your organization. |
|
Hi @daniel-cit @zexoor, I am also running through the fundamentals setup (using terraform cloud) and I am experiencing the same issues. I am enrolled in SCC Premium, but still get the error mentioned above: I also tried what @fmichaelobrien suggested, but did not solve the issue for me. |
|
I was able to run the code for the creation of the notification config in my organization, but it already had Security Command Center enable for a long time. Could you do a test to check if the problem is specific to Terraform or is it a general one? Could you please try to use gcloud to create the SCC notification on the same Organization using the resources created in the deploy of the foundation? if it fails, cloud you add |
|
Hi @daniel-cit Thank you for your help! I tried the manual steps, but run into the same error: In the logs, I see the following: The output of gcloud --version: Based on |
|
hey folks, did you enable SCC api in which level? Organization, folder or project? |
|
Hi @amandakarina, I see the SCC api enabled on the project level (I can confirm it's at least enabled in prj-c-scc & prj-b-seed). I didn't do this manually, but I did just go the the SCC via the UI and I went through the wizard before applying my gcp-org with terraform. I enabled SCC Premium (not the API specifically) on organization level. However, I'm not able to enable API's at the organization or folder level. Should I? |
|
I'm encountering the same issue in a demo org that has not enabled SCC before. When deploying with the helpers/foundation_deployer script, step gcp-org will consistently fail at this point. Running once and re-applying, or manually enabling the SCC subscription (security center.googleapis.com enabled at project level, SCC standard activated at the organization level, the SCC service account given the service agent role at org) does not fix the issue. |
|
I found I can also reliably trigger this issue from the -validate step of the foundation_deploy script, before any resources are created. |
|
I think I've identified the root cause. The helper script has a line that calls It seems that API v2 must specify a location, gcloud has some logic to differentiate versions based on the format of the notification name and/or flags, and v1 of the API has recently been deprecated. You can demonstrate this with some simple commands on gcloud: And, I can reliably recreate this when trying to use the Terraform SCC resources. Running TF apply with the following will reliably produce the same error about api v2. (Make sure you've authenticated with a service account, not user identity, otherwise there's a different WAI error about user credentials). To fix this across the repo, there are a few changes required:
|
eeaton
added
blocked
|
Updates:
Unfortunately there isn't a good workaround until the product team fixes the v2 API and provider. (targeting end of q2). In the meantime, the best I can recommend is to remove the offending resources from your terraform config: #gcp-org/modules/cai-monitoring/main.tf L136
resource "google_scc_source" "cai_monitoring" {
#gcp-org/envs/shared/scc_notification.tf L32
resource "google_scc_notification_config" "scc_notification_config" {
|
|
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days |
|
Hi @eeaton It seems you also need to remove this bit -> I am not sure what is left to be honest. Maybe we can just scrap the whole module, until it is fixed? Cheers, |
|
@eeaton @kkrastev-cloudoffice I'm working on a PR (#1304 ) to disable this through a variable for now (easy to enable then when v2 ready and tested). I have my changes up and during the Did I miss something or mess something up? |
|
The product team initially said they were prioritizing the fix by June but their timeline has slipped, so I'm ok with the short-term fix to disable these resources with a feature flag. @lpezet Exit code 33 in Github Actions is a time-out, there might be flaky issues that are addressed if you run the code again, but I see some other issues in the Lint tests. I'll respond to the details on #1304. |
|
Thanks @lpezet for the contribution! #1304 is now merged, so none of the SCC resources are created in Terraform unless the user specifies a boolean flag to enable them. This will mitigate the case where new customers have enabled SCC v2 features that break Terraform. I'll leave this issue open as a reminder to re-assess the defaults once the SCC team has fixed their API issues. |
|
I've gotten confirmation from the product team that they've released Terraform support for the v2 API. This requires changing the name of Terraform resources like https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/scc_v2_organization_source @daniel-cit can you please update these tf resources to use the new v2 definitions. Also, for the short-term fix in #1304, I'm considering whether to revert that or keep it. I think the easiest way forward would be to leave the variable to toggle |
|
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days |
TL;DR
When running an initial deployment for cloud-build. During the deployment of SCC resources for CAI monitoring terraform fails.
Expected behavior
Expected behaviour is for the resources to be created as intended
Observed behavior
Resource creation failed due to the API not being supported.
Terraform Configuration
Terraform Version
Additional information
I have deployed standard tier SCC in the Organization as per https://github.com/umbrl-limited/umbrl-infra/blob/main/1-org/README.md#prerequisites
The text was updated successfully, but these errors were encountered: