Increasing retention period on locked policy causes "Bucket 'X' does not have an unlocked retention policy" error.

[choonchernlim]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• If an issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to "hashibot", a community member has claimed the issue already.

Terraform Version

Terraform v0.12.12
+ provider.google v2.17.0
+ provider.google-beta v2.17.0
+ provider.null v2.1.2
+ provider.random v2.2.1

Affected Resource(s)

• google_storage_bucket

Terraform Configuration Files

Based on https://cloud.google.com/storage/docs/bucket-lock : "You can increase the retention period of a locked retention policy.".

So, given this configuration:-

resource "google_storage_bucket" "buckets" {
  for_each      = toset(var.names)
  name          = "${local.prefix}${each.value}"
  project       = var.project_id
  location      = var.location
  storage_class = var.storage_class
  labels        = var.labels
  retention_policy {
    is_locked = lookup(
      lookup(
        var.retention_policy,
        lower(each.value),
        {},
      ), 
      "is_locked", 
      false
    )
    retention_period = lookup(
      lookup(
        var.retention_policy,
        lower(each.value),
        {},
      ), 
      "retention_period", 
      1
    )
  }
  force_destroy = lookup(
    var.force_destroy,
    lower(each.value),
    false,
  )
  bucket_policy_only = lookup(
    var.bucket_policy_only,
    lower(each.value),
    true,
  )
  versioning {
    enabled = lookup(
      var.versioning,
      lower(each.value),
      false,
    )
  }
}

... I'm trying to increase the retention period of the locked policy from 300000 to 400000 of an existing GCS bucket:-

  ~ resource "google_storage_bucket" "buckets" {
        ...
      ~ retention_policy {
            is_locked        = true
          ~ retention_period = 300000 -> 400000
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Expected Behavior

Retention period should be increased on a locked retention policy without errors.

Actual Behavior

An error was thrown:-

Error: googleapi: Error 400: Bucket 'mcctest-2-us-first' does not have an unlocked retention policy., invalid

  on ../modules/storage/main.tf line 21, in resource "google_storage_bucket" "buckets":
  21: resource "google_storage_bucket" "buckets" {

However, the new retention period did get set correctly.

Steps to Reproduce

1. Through Terraform, create a new GCS bucket with locked retention policy and retention period of 300000.
2. Run "terraform plan" and "terraform apply".
3. Verify in GCP console that the GCS bucket has a lock sign and "~3 days".
4. Through Terraform, increase 300000 to 400000.
5. Run "terraform plan" and "terraform apply".
6. Here, you will see the error.
7. Verify in GCP console that the GCS bucket has a lock sign and "~4 days".

[nat-henderson]

Yep - the docs say you can do this, but the API is rejecting the request. The request appears to be correctly formatted.

[nat-henderson]

Aha, I see - the issue is actually that we are trying to re-lock the policy after we update it. That's fixable.

[choonchernlim]

Thank you for the prompt fix, @ndmckinley.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!