[BUG] Received response with unexpected status

[cristian-abad]

Is there an existing issue for this?

• I have searched the existing issues

What version of the Terraform provider are you using?

1.9.0

What version of the Terraform CLI are you using?

1.10.5

What type of issue are you facing

bug report

Describe the bug

Greeting!

We used to have a script to automate the creation of role collections as follows:

# Create subaccount role collections
resource "btp_subaccount_role_collection" "BM_C_SP06_C_SUBACCOUNT_ADMIN" {

  subaccount_id = "x"
  name = "BM_C_SP06_C_SUBACCOUNT_ADMIN"
  description = "SE Subaccount Admin"
  
  roles = [
    {
      name = "Cloud Connector Administrator"
      role_template_name = "Cloud_Connector_Administrator"
      role_template_app_id = "connectivity!b17"
    },
    {
      name = "Destination Administrator"
      role_template_name = "Destination_Administrator"
      role_template_app_id = "destination-xsappname!b404"
    },
    {
      name = "Subaccount Admin"
      role_template_name = "Subaccount_Admin"
      role_template_app_id = "cis-local!b14"
    },
    {
      name = "Subaccount Service Administrator"
      role_template_name = "Subaccount_Service_Administrator"
      role_template_app_id = "service-manager!b8989"
    }
  ]
}

resource "btp_subaccount_role_collection" "BM_C_SP07_D_SUBACCOUNT_VIEWER" {

  subaccount_id = "x"
  name = "BM_C_SP07_D_SUBACCOUNT_VIEWER"
  description = "SE Subaccount Viewer"
  
  roles = [
    {
      name = "Cloud Connector Auditor"
      role_template_name = "Cloud_Connector_Auditor"
      role_template_app_id = "connectivity!b17"
    },
    {
      name = "Destination Viewer"
      role_template_name = "Destination_Viewer"
      role_template_app_id = "destination-xsappname!b404"
    },
    {
      name = "Subaccount Service Auditor"
      role_template_name = "Subaccount_Service_Auditor"
      role_template_app_id = "service-manager!b8989"
    },
    {
      name = "Subaccount Viewer"
      role_template_name = "Subaccount_Viewer"
      role_template_app_id = "cis-local!b14"
    }
  ]
}

resource "btp_subaccount_role_collection" "BM_C_SP08_C_SUBACCOUNT_SECURITY_ADMIN" {

  subaccount_id = "x"
  name = "BM_C_SP08_C_SUBACCOUNT_SECURITY_ADMIN"
  description = "SE Subaccount Security Admin"
  
  roles = [
    {
      name = "User and Role Administrator"
      role_template_name = "xsuaa_admin"
      role_template_app_id = "xsuaa!t1"
    }
  ]
}

resource "btp_subaccount_role_collection" "BM_C_SP09_D_SUBACCOUNT_SECURITY_VIEWER" {

  subaccount_id = "x"
  name = "BM_C_SP09_D_SUBACCOUNT_SECURITY_VIEWER"
  description = "SE Subaccount Security Viewer"
  
  roles = [
    {
      name = "User and Role Auditor"
      role_template_name = "xsuaa_auditor"
      role_template_app_id = "xsuaa!t1"
    }
  ]
}

The logs after executing terraform plan are:

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # btp_subaccount_role_collection.BM_C_SP06_C_SUBACCOUNT_ADMIN will be created
  + resource "btp_subaccount_role_collection" "BM_C_SP06_C_SUBACCOUNT_ADMIN" {
      + description   = "SE Subaccount Admin"
      + id            = (known after apply)
      + name          = "BM_C_SP06_C_SUBACCOUNT_ADMIN"
      + roles         = [
          + {
              + name                 = "Cloud Connector Administrator"
              + role_template_app_id = "connectivity!b17"
              + role_template_name   = "Cloud_Connector_Administrator"
            },
          + {
              + name                 = "Destination Administrator"
              + role_template_app_id = "destination-xsappname!b404"
              + role_template_name   = "Destination_Administrator"
            },
          + {
              + name                 = "Subaccount Admin"
              + role_template_app_id = "cis-local!b14"
              + role_template_name   = "Subaccount_Admin"
            },
          + {
              + name                 = "Subaccount Service Administrator"
              + role_template_app_id = "service-manager!b8989"
              + role_template_name   = "Subaccount_Service_Administrator"
            },
        ]
      + subaccount_id = "f1377729-4682-4a41-b95e-32da5c93389b"
    }

  # btp_subaccount_role_collection.BM_C_SP07_D_SUBACCOUNT_VIEWER will be created
  + resource "btp_subaccount_role_collection" "BM_C_SP07_D_SUBACCOUNT_VIEWER" {
      + description   = "SE Subaccount Viewer"
      + id            = (known after apply)
      + name          = "BM_C_SP07_D_SUBACCOUNT_VIEWER"
      + roles         = [
          + {
              + name                 = "Cloud Connector Auditor"
              + role_template_app_id = "connectivity!b17"
              + role_template_name   = "Cloud_Connector_Auditor"
            },
          + {
              + name                 = "Destination Viewer"
              + role_template_app_id = "destination-xsappname!b404"
              + role_template_name   = "Destination_Viewer"
            },
          + {
              + name                 = "Subaccount Service Auditor"
              + role_template_app_id = "service-manager!b8989"
              + role_template_name   = "Subaccount_Service_Auditor"
            },
          + {
              + name                 = "Subaccount Viewer"
              + role_template_app_id = "cis-local!b14"
              + role_template_name   = "Subaccount_Viewer"
            },
        ]
      + subaccount_id = "f1377729-4682-4a41-b95e-32da5c93389b"
    }

  # btp_subaccount_role_collection.BM_C_SP08_C_SUBACCOUNT_SECURITY_ADMIN will be created
  + resource "btp_subaccount_role_collection" "BM_C_SP08_C_SUBACCOUNT_SECURITY_ADMIN" {
      + description   = "SE Subaccount Security Admin"
      + id            = (known after apply)
      + name          = "BM_C_SP08_C_SUBACCOUNT_SECURITY_ADMIN"
      + roles         = [
          + {
              + name                 = "User and Role Administrator"
              + role_template_app_id = "xsuaa!t1"
              + role_template_name   = "xsuaa_admin"
            },
        ]
      + subaccount_id = "f1377729-4682-4a41-b95e-32da5c93389b"
    }

  # btp_subaccount_role_collection.BM_C_SP09_D_SUBACCOUNT_SECURITY_VIEWER will be created
  + resource "btp_subaccount_role_collection" "BM_C_SP09_D_SUBACCOUNT_SECURITY_VIEWER" {
      + description   = "SE Subaccount Security Viewer"
      + id            = (known after apply)
      + name          = "BM_C_SP09_D_SUBACCOUNT_SECURITY_VIEWER"
      + roles         = [
          + {
              + name                 = "User and Role Auditor"
              + role_template_app_id = "xsuaa!t1"
              + role_template_name   = "xsuaa_auditor"
            },
        ]
      + subaccount_id = "f1377729-4682-4a41-b95e-32da5c93389b"
    }

Plan: 4 to add, 0 to change, 0 to destroy.

But unfortunately when executing terraform apply we are getting the error as follows:

Error: API Error Creating Resource Role Collection (Subaccount)
│ 
│   with btp_subaccount_role_collection.BM_C_SP06_C_SUBACCOUNT_ADMIN,
│   on terraform-main.tf line 2, in resource "btp_subaccount_role_collection" "BM_C_SP06_C_SUBACCOUNT_ADMIN":
│    2: resource "btp_subaccount_role_collection" "BM_C_SP06_C_SUBACCOUNT_ADMIN" {
│ 
│ received response with unexpected status [Status: 500; Correlation ID: 13a42e23-e0b8-3777-9eb5-e46993f2b13e]
╵
╷
│ Error: API Error Creating Resource Role Collection (Subaccount)
│ 
│   with btp_subaccount_role_collection.BM_C_SP07_D_SUBACCOUNT_VIEWER,
│   on terraform-main.tf line 32, in resource "btp_subaccount_role_collection" "BM_C_SP07_D_SUBACCOUNT_VIEWER":
│   32: resource "btp_subaccount_role_collection" "BM_C_SP07_D_SUBACCOUNT_VIEWER" {
│ 
│ received response with unexpected status [Status: 500; Correlation ID: 694380c1-9e8c-2eec-038c-5679628f3fbf]
╵
╷
│ Error: API Error Creating Resource Role Collection (Subaccount)
│ 
│   with btp_subaccount_role_collection.BM_C_SP08_C_SUBACCOUNT_SECURITY_ADMIN,
│   on terraform-main.tf line 62, in resource "btp_subaccount_role_collection" "BM_C_SP08_C_SUBACCOUNT_SECURITY_ADMIN":
│   62: resource "btp_subaccount_role_collection" "BM_C_SP08_C_SUBACCOUNT_SECURITY_ADMIN" {
│ 
│ received response with unexpected status [Status: 500; Correlation ID: 647708c1-c769-3aa6-4469-9c3e23ed9235]
╵
╷
│ Error: API Error Creating Resource Role Collection (Subaccount)
│ 
│   with btp_subaccount_role_collection.BM_C_SP09_D_SUBACCOUNT_SECURITY_VIEWER,
│   on terraform-main.tf line 77, in resource "btp_subaccount_role_collection" "BM_C_SP09_D_SUBACCOUNT_SECURITY_VIEWER":
│   77: resource "btp_subaccount_role_collection" "BM_C_SP09_D_SUBACCOUNT_SECURITY_VIEWER" {
│ 
│ received response with unexpected status [Status: 500; Correlation ID: c8f53584-1d2c-8fad-5c46-e7527ec141d2]

We have used lots this script for automating the creation of role collections so not sure what is wrong. We have tried with different versions of the provider and CLI, and same issue.

Could you kindly check?

Thanks,

C.

Expected Behavior

The four role collections created in the script should be created.

Steps To Reproduce

Terrform init
Terraform apply

Scripts:

# Add BTP Provider
terraform {
  required_providers {
    btp = {
      source  = "SAP/btp"
      version = "1.9.0"
    }
  }
}

# Configure the BTP Provider
provider "btp" {
  globalaccount = "xxx-d6609dad"
  idp           = "custom-idp"
  username      = "TS_TERRAFORM_TO_BTP"
  password      = "***" 
}

# Create subaccount role collections
resource "btp_subaccount_role_collection" "BM_C_SP06_C_SUBACCOUNT_ADMIN" {

  subaccount_id = "x"
  name = "BM_C_SP06_C_SUBACCOUNT_ADMIN"
  description = "SE Subaccount Admin"
  
  roles = [
    {
      name = "Cloud Connector Administrator"
      role_template_name = "Cloud_Connector_Administrator"
      role_template_app_id = "connectivity!b17"
    },
    {
      name = "Destination Administrator"
      role_template_name = "Destination_Administrator"
      role_template_app_id = "destination-xsappname!b404"
    },
    {
      name = "Subaccount Admin"
      role_template_name = "Subaccount_Admin"
      role_template_app_id = "cis-local!b14"
    },
    {
      name = "Subaccount Service Administrator"
      role_template_name = "Subaccount_Service_Administrator"
      role_template_app_id = "service-manager!b8989"
    }
  ]
}

resource "btp_subaccount_role_collection" "BM_C_SP07_D_SUBACCOUNT_VIEWER" {

  subaccount_id = "x"
  name = "BM_C_SP07_D_SUBACCOUNT_VIEWER"
  description = "SE Subaccount Viewer"
  
  roles = [
    {
      name = "Cloud Connector Auditor"
      role_template_name = "Cloud_Connector_Auditor"
      role_template_app_id = "connectivity!b17"
    },
    {
      name = "Destination Viewer"
      role_template_name = "Destination_Viewer"
      role_template_app_id = "destination-xsappname!b404"
    },
    {
      name = "Subaccount Service Auditor"
      role_template_name = "Subaccount_Service_Auditor"
      role_template_app_id = "service-manager!b8989"
    },
    {
      name = "Subaccount Viewer"
      role_template_name = "Subaccount_Viewer"
      role_template_app_id = "cis-local!b14"
    }
  ]
}

resource "btp_subaccount_role_collection" "BM_C_SP08_C_SUBACCOUNT_SECURITY_ADMIN" {

  subaccount_id = "x"
  name = "BM_C_SP08_C_SUBACCOUNT_SECURITY_ADMIN"
  description = "SE Subaccount Security Admin"
  
  roles = [
    {
      name = "User and Role Administrator"
      role_template_name = "xsuaa_admin"
      role_template_app_id = "xsuaa!t1"
    }
  ]
}

resource "btp_subaccount_role_collection" "BM_C_SP09_D_SUBACCOUNT_SECURITY_VIEWER" {

  subaccount_id = "x"
  name = "BM_C_SP09_D_SUBACCOUNT_SECURITY_VIEWER"
  description = "SE Subaccount Security Viewer"
  
  roles = [
    {
      name = "User and Role Auditor"
      role_template_name = "xsuaa_auditor"
      role_template_app_id = "xsuaa!t1"
    }
  ]
}

User's Role Collections

• Global Account Administrator
• Subaccount Administrator

Add screenshots to help explain your problem

No response

Additional context

No response

[vipinvkmenon]

@cristian-abad This seems like a server/API issue. Additionally, the issue could not be reproduced on our Global Account..indicating this could be a timely, API/server issue.

Could you please provide the details of the BTP Landscape?

[cristian-abad]

@vipinvkmenon Thanks for your response. What exact details would you required from our BTP landscape? Is there any way we can monitor the logs of the underlaying API consumed by Terraform?

Thanks!

C.

[lechnerc77]

@cristian-abad : the main information would be the region of your subaccount, so we can check if there was an incident.

In general, you can execute the Terraform command setting TF_LOG to TRACE to get more insight, but I doubt that this will help in this scenario, as the issues are happing on the platform.

Did you try to re-execute it in the meantime, to validate if this was a temporal issue, as we could not reproduce it on our accounts, namely the role collections were created.