Unable to create resource as non-admin account

[bryand2]

Using terraform v11.14 and ibm provider plugin v17.

When using a non-admin account, terraform script is failing to create a resource. Getting error message:

Error occured while configuring Resource Management service: “Request failed with status code: 400, BXNIM0106E: Validation of property ‘response_type’ with value ‘[uaa, cloud_iam]’ failed. Valid values: ‘cloud_iam’”

Seems like it is unable to get the info on the specified resource group. *** Important piece here is if I use the ibmcloud cli with this same api key (i.e. ibmcloud login --apikey) the problem does NOT occur ... so this tells me from a IAM perspective my settings are correct and this problem is specific to terraform ***

Here's the script to reproduce:

data "ibm_resource_group" "resource_group" {
name = "ClusterEnv"
}

provider "ibm" {
bluemix_api_key = ""
}

resource "ibm_is_vpc" "vpc1" {
name = "bryan-iamtest-vpc1"
resource_group = "${data.ibm_resource_group.resource_group.id}"
}

[bryand2]

Haven't been able to test myself, but it seems the problem originates from the underlying bluemix-go code. Proposed fix seems to be to edit "authentication/iam.go" and change the line:

Field("response_type", "cloud_iam,uaa") ==> Field("response_type", "cloud_iam")

Reference: IBM-Cloud/bluemix-go#87
Reference2: IBM-Cloud/bluemix-go#101
Reference3: IBM-Cloud/bluemix-go#107

[sakshiag]

Thanks bryan for sharing the information.. I have tested with my api key, it seems the current code works fine.. But when I tested with the api key (which has non admin access)provided by bryan it failed with the above error. We will confirm and make the changes accordingly if required.

[bryand2]

Thanks Sakshi. Maybe your api key has elevated access? One thing to keep in mind is I don't experience this problem when using the ibmcloud cli, so that tells me the api key I'm using should also work via terraform.

[hkantare]

@bryand2 The APIKEY which you used is an ServiceID API key?

[bryand2]

@hkantare Thanks for your help. yes it is.

[hkantare]

Fixed in latest release we can use serviceID APikey to provision resources

[hkantare]

closing the issue as its available in latest releases