The configuration for the given import module.organization.google_org_policy_policy.default["essentialcontacts.allowedContactDomains"] does not exist. #2614

bjoerntcex · 2024-10-08T23:27:13Z

bjoerntcex
Oct 8, 2024

Hi there,

I'm trying to run the 0-bootstrap stage and am at the point right after migrating the state to the gcp bucket. Now I'm running into this issue:

$ terraform plan -var 'org_policies_config={"import_defaults": true}'
...
Plan: 12 to add, 5 to change, 1 to destroy.
╷
│ Error: Configuration for import target does not exist
│ 
│ The configuration for the given import
│ module.organization.google_org_policy_policy.default["essentialcontacts.allowedContactDomains"]
│ does not exist. All target instances must have an associated configuration
│ to be imported.

The org was created recently and the essentialcontacts.allowedContactDomains policy exists on the parent org and is being inherited by all projects.

Any idea?

Thanks!

Answered by juliocc

Oct 11, 2024

I'm not sure what's going on. Can you confirm you have the following lines in your codebase?

cloud-foundation-fabric/fast/stages/0-bootstrap/organization.tf

Lines 245 to 266 in 8101a26

     org_policies = var.bootstrap_user != null ? {} : {  
   "essentialcontacts.allowedContactDomains" = {  
   rules = [  
   {  
   allow = { values = local.essential_contacts_domains }  
   condition = {  
   expression = (  
   "!resource.matchTag('${local.org_policies_tag_name}', 'allowed-essential-contacts-domains-all')"  
   )  
   }  
   },  
   {  
   allow = { all = true }  
   condition = {  
   expression = (  
   "resource.matchTag('${local.org_policies_tag_name}', 'allowed-essential-con…

View full answer

juliocc · 2024-10-09T09:09:05Z

juliocc
Oct 9, 2024
Maintainer

This is a weird one. Can you share the whole plan and the version you're using?

0 replies

bjoerntcex · 2024-10-09T16:56:18Z

bjoerntcex
Oct 9, 2024
Author

Hi @juliocc

Absolutely, I'm using cloud-foundation-fabric v34.1.0 with Terraform v1.9.7 on darwin_arm64.

Here's the plan:

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.billing-export-dataset[0].google_bigquery_dataset.default has changed
  ~ resource "google_bigquery_dataset" "default" {
        id                              = "projects/xxxx-prod-billing-exp-0/datasets/billing_export"
      + labels                          = {}
      + resource_tags                   = {}
        # (18 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
  - destroy
 <= read (data resources)

Terraform planned the following actions, but then encountered a problem:

  # module.automation-project.data.google_bigquery_default_service_account.bq_sa[0] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "google_bigquery_default_service_account" "bq_sa" {
      + email   = (known after apply)
      + id      = (known after apply)
      + member  = (known after apply)
      + project = "xxxx-prod-iac-core-0"
    }

  # module.automation-project.data.google_storage_project_service_account.gcs_sa[0] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "google_storage_project_service_account" "gcs_sa" {
      + email_address = (known after apply)
      + id            = (known after apply)
      + member        = (known after apply)
      + project       = "xxxx-prod-iac-core-0"
    }

  # module.automation-project.google_org_policy_policy.default["compute.skipDefaultNetworkCreation"] will be created
  + resource "google_org_policy_policy" "default" {
      + etag   = (known after apply)
      + id     = (known after apply)
      + name   = "projects/xxxx-prod-iac-core-0/policies/compute.skipDefaultNetworkCreation"
      + parent = "projects/xxxx-prod-iac-core-0"

      + spec {
          + etag        = (known after apply)
          + update_time = (known after apply)

          + rules {
              + enforce = "TRUE"
            }
        }
    }

  # module.automation-project.google_org_policy_policy.default["iam.automaticIamGrantsForDefaultServiceAccounts"] will be created
  + resource "google_org_policy_policy" "default" {
      + etag   = (known after apply)
      + id     = (known after apply)
      + name   = "projects/xxxx-prod-iac-core-0/policies/iam.automaticIamGrantsForDefaultServiceAccounts"
      + parent = "projects/xxxx-prod-iac-core-0"

      + spec {
          + etag        = (known after apply)
          + update_time = (known after apply)

          + rules {
              + enforce = "TRUE"
            }
        }
    }

  # module.automation-project.google_org_policy_policy.default["iam.disableServiceAccountKeyCreation"] will be created
  + resource "google_org_policy_policy" "default" {
      + etag   = (known after apply)
      + id     = (known after apply)
      + name   = "projects/xxxx-prod-iac-core-0/policies/iam.disableServiceAccountKeyCreation"
      + parent = "projects/xxxx-prod-iac-core-0"

      + spec {
          + etag        = (known after apply)
          + update_time = (known after apply)

          + rules {
              + enforce = "TRUE"
            }
        }
    }

  # module.automation-project.google_project_iam_member.service_agents["cloudbuild"] will be created
  + resource "google_project_iam_member" "service_agents" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:[email protected]"
      + project = "xxxx-prod-iac-core-0"
      + role    = "roles/cloudbuild.serviceAgent"
    }

  # module.automation-project.google_project_iam_member.service_agents["cloudbuild-sa"] will be created
  + resource "google_project_iam_member" "service_agents" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:[email protected]"
      + project = "xxxx-prod-iac-core-0"
      + role    = "roles/cloudbuild.builds.builder"
    }

  # module.automation-project.google_project_iam_member.service_agents["compute-system"] will be created
  + resource "google_project_iam_member" "service_agents" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:[email protected]"
      + project = "xxxx-prod-iac-core-0"
      + role    = "roles/compute.serviceAgent"
    }

  # module.automation-project.google_project_iam_member.service_agents["container-engine-robot"] will be created
  + resource "google_project_iam_member" "service_agents" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:service-NNNNNNNNNNNN@container-engine-robot.iam.gserviceaccount.com"
      + project = "xxxx-prod-iac-core-0"
      + role    = "roles/container.serviceAgent"
    }

  # module.automation-project.google_project_iam_member.service_agents["gkenode"] will be created
  + resource "google_project_iam_member" "service_agents" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:[email protected]"
      + project = "xxxx-prod-iac-core-0"
      + role    = "roles/container.nodeServiceAgent"
    }

  # module.automation-project.google_project_service.project_services["cloudbuild.googleapis.com"] will be created
  + resource "google_project_service" "project_services" {
      + disable_dependent_services = false
      + disable_on_destroy         = false
      + id                         = (known after apply)
      + project                    = "xxxx-prod-iac-core-0"
      + service                    = "cloudbuild.googleapis.com"
    }

  # module.automation-project.google_project_service.project_services["compute.googleapis.com"] will be created
  + resource "google_project_service" "project_services" {
      + disable_dependent_services = false
      + disable_on_destroy         = false
      + id                         = (known after apply)
      + project                    = "xxxx-prod-iac-core-0"
      + service                    = "compute.googleapis.com"
    }

  # module.automation-project.google_project_service.project_services["container.googleapis.com"] will be created
  + resource "google_project_service" "project_services" {
      + disable_dependent_services = false
      + disable_on_destroy         = false
      + id                         = (known after apply)
      + project                    = "xxxx-prod-iac-core-0"
      + service                    = "container.googleapis.com"
    }

  # module.automation-project.google_project_service_identity.default["container.googleapis.com"] will be created
  + resource "google_project_service_identity" "default" {
      + email   = (known after apply)
      + id      = (known after apply)
      + member  = (known after apply)
      + project = "xxxx-prod-iac-core-0"
      + service = "container.googleapis.com"
    }

  # module.organization.google_organization_iam_binding.authoritative["roles/logging.admin"] will be updated in-place
  ~ resource "google_organization_iam_binding" "authoritative" {
        id      = "MMMMMMMMMMMM/roles/logging.admin"
      ~ members = [
          - "user:[email protected]",
            # (3 unchanged elements hidden)
        ]
        # (3 unchanged attributes hidden)
    }

  # module.organization.google_organization_iam_binding.authoritative["roles/owner"] will be updated in-place
  ~ resource "google_organization_iam_binding" "authoritative" {
        id      = "MMMMMMMMMMMM/roles/owner"
      ~ members = [
          - "user:[email protected]",
            # (1 unchanged element hidden)
        ]
        # (3 unchanged attributes hidden)
    }

  # module.organization.google_organization_iam_binding.authoritative["roles/resourcemanager.organizationAdmin"] will be updated in-place
  ~ resource "google_organization_iam_binding" "authoritative" {
        id      = "MMMMMMMMMMMM/roles/resourcemanager.organizationAdmin"
      ~ members = [
          - "user:[email protected]",
            # (2 unchanged elements hidden)
        ]
        # (3 unchanged attributes hidden)
    }

  # module.organization.google_organization_iam_binding.authoritative["roles/resourcemanager.projectCreator"] will be updated in-place
  ~ resource "google_organization_iam_binding" "authoritative" {
        id      = "MMMMMMMMMMMM/roles/resourcemanager.projectCreator"
      ~ members = [
          - "user:[email protected]",
            # (3 unchanged elements hidden)
        ]
        # (3 unchanged attributes hidden)
    }

  # module.organization.google_organization_iam_binding.authoritative["roles/resourcemanager.tagAdmin"] will be updated in-place
  ~ resource "google_organization_iam_binding" "authoritative" {
        id      = "MMMMMMMMMMMM/roles/resourcemanager.tagAdmin"
      ~ members = [
          - "user:[email protected]",
            # (3 unchanged elements hidden)
        ]
        # (3 unchanged attributes hidden)
    }

  # module.organization.google_organization_iam_member.bindings["roles/billing.admin-user:[email protected]"] will be destroyed
  # (because key ["roles/billing.admin-user:[email protected]"] is not in for_each map)
  - resource "google_organization_iam_member" "bindings" {
      - etag   = "BwYubhuibhui=" -> null
      - id     = "MMMMMMMMMMMM/roles/billing.admin/user:[email protected]" -> null
      - member = "user:[email protected]" -> null
      - org_id = "MMMMMMMMMMMM" -> null
      - role   = "roles/billing.admin" -> null
    }

Plan: 12 to add, 5 to change, 1 to destroy.
╷
│ Error: Configuration for import target does not exist
│
│ The configuration for the given import
│ module.organization.google_org_policy_policy.default["essentialcontacts.allowedContactDomains"]
│ does not exist. All target instances must have an associated configuration
│ to be imported.

5 replies

bjoerntcex Oct 11, 2024
Author

Hi @juliocc,

is there any other information I could provide that could be helpful here?

juliocc Oct 11, 2024
Maintainer

I'm not sure what's going on. Can you confirm you have the following lines in your codebase?

cloud-foundation-fabric/fast/stages/0-bootstrap/organization.tf

Lines 245 to 266 in 8101a26

    
           org_policies = var.bootstrap_user != null ? {} : { 
        
             "essentialcontacts.allowedContactDomains" = { 
        
               rules = [ 
        
                 { 
        
                   allow = { values = local.essential_contacts_domains } 
        
                   condition = { 
        
                     expression = ( 
        
                       "!resource.matchTag('${local.org_policies_tag_name}', 'allowed-essential-contacts-domains-all')" 
        
                     ) 
        
                   } 
        
                 }, 
        
                 { 
        
                   allow = { all = true } 
        
                   condition = { 
        
                     expression = ( 
        
                       "resource.matchTag('${local.org_policies_tag_name}', 'allowed-essential-contacts-domains-all')" 
        
                     ) 
        
                     title = "allow-all" 
        
                   } 
        
                 }, 
        
               ] 
        
             }

Answer selected by bjoerntcex

bjoerntcex Oct 11, 2024
Author

In fact I don't. Seems like that was added 5 days or so after the last release v34.1.0 from Sep 5. Should I use the latest master or cherry pick that one into my v34.1.0 branch?

bjoerntcex Oct 11, 2024
Author

@juliocc Thanks, this worked! I switched to tagdaily-2024.10.10 for now until the next release. Thanks a lot!

juliocc Oct 14, 2024
Maintainer

Glad that fixed it :) Closing this now.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

The configuration for the given import module.organization.google_org_policy_policy.default["essentialcontacts.allowedContactDomains"] does not exist. #2614

{{title}}

Replies: 2 comments 5 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

	org_policies = var.bootstrap_user != null ? {} : {
	"essentialcontacts.allowedContactDomains" = {
	rules = [
	{
	allow = { values = local.essential_contacts_domains }
	condition = {
	expression = (
	"!resource.matchTag('${local.org_policies_tag_name}', 'allowed-essential-contacts-domains-all')"
	)
	}
	},
	{
	allow = { all = true }
	condition = {
	expression = (
	"resource.matchTag('${local.org_policies_tag_name}', 'allowed-essential-con…

The configuration for the given import module.organization.google_org_policy_policy.default["essentialcontacts.allowedContactDomains"] does not exist. #2614

bjoerntcex Oct 8, 2024

Replies: 2 comments · 5 replies

juliocc Oct 9, 2024 Maintainer

bjoerntcex Oct 9, 2024 Author

bjoerntcex Oct 11, 2024 Author

juliocc Oct 11, 2024 Maintainer

bjoerntcex Oct 11, 2024 Author

bjoerntcex Oct 11, 2024 Author

juliocc Oct 14, 2024 Maintainer

bjoerntcex
Oct 8, 2024

Replies: 2 comments 5 replies

juliocc
Oct 9, 2024
Maintainer

bjoerntcex
Oct 9, 2024
Author

bjoerntcex Oct 11, 2024
Author

juliocc Oct 11, 2024
Maintainer

bjoerntcex Oct 11, 2024
Author

bjoerntcex Oct 11, 2024
Author

juliocc Oct 14, 2024
Maintainer