Error creating SecretVersion: googleapi: Error 400: Field [payload] is required.

[yanc0]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v0.14.9

Affected Resource(s)

• google_secret_manager_secret_version

Terraform Configuration Files

resource "google_secret_manager_secret_version" "fleets-password" {
  secret = google_secret_manager_secret.fleets-password.id
}

Debug Output

google_secret_manager_secret_version.password: Creating...

Error: Error creating SecretVersion: googleapi: Error 400: Field [payload] is required.

  on cloudsql.tf line 48, in resource "google_secret_manager_secret_version" "password":
  48: resource "google_secret_manager_secret_version" "password" {

Expected Behavior

The documentation says that only secret attribute is required. I expect the secret version to be created
https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/secret_manager_secret_version#argument-reference

Actual Behavior

Google api returns a 400 error, saying that a payload is missing. If we add the secret_data attribute, there is no more error.

resource "google_secret_manager_secret_version" "password" {
  secret = google_secret_manager_secret.password.id
  secret_data = "mysecretpassword"
}

Steps to Reproduce

1. terraform apply

[edwardmedia]

@yanc0 can you share the full debug log? It is fine with me by running the example by commenting the line of secret_data. Can you try the same?

[yanc0]

resource "google_secret_manager_secret" "cloudsql-password" {
  secret_id = "cloudsql-password"

  labels = {
    label = "cloudsql"
  }

  replication {
    user_managed {
      replicas {
        location = "europe-west1"
      }
      replicas {
        location = "europe-west2"
      }
    }
  }
}

resource "google_secret_manager_secret_version" "cloudsql-password" {
  secret = google_secret_manager_secret.cloudsql-password.id
}

2021-03-25T16:48:05.977+0100 [INFO]  plugin.terraform-provider-google_v3.61.0_x5: 2021/03/25 16:48:05 [DEBUG] Google API Request Details:
---[ REQUEST ]---------------------------------------
POST /v1/projects/my-project/secrets/cloudsql-password:addVersion?alt=json HTTP/1.1
Host: secretmanager.googleapis.com
User-Agent: Terraform/0.14.9 (+https://www.terraform.io) Terraform-Plugin-SDK/2.4.4 terraform-provider-google/dev
Content-Length: 3
Content-Type: application/json
Accept-Encoding: gzip

{}


-----------------------------------------------------: timestamp=2021-03-25T16:48:06.170+0100
2021-03-25T16:48:06.171+0100 [INFO]  plugin.terraform-provider-google_v3.61.0_x5: 2021/03/25 16:48:06 [DEBUG] Retry Transport: Stopping retries, last request failed with non-retryable error: googleapi: got HTTP response code 400 with body: HTTP/2.0 400 Bad Request
Alt-Svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Cache-Control: private
Content-Type: application/json; charset=UTF-8
Date: Thu, 25 Mar 2021 15:48:06 GMT
Server: ESF
Vary: Origin
Vary: X-Origin
Vary: Referer
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 0

{
  "error": {
    "code": 400,
    "message": "Field [payload] is required.",
    "status": "INVALID_ARGUMENT"
  }
}:

Thank you @edwardmedia !

[yanc0]

Same behaviour with the exact copy/paste of the example

[edwardmedia]

@yanc0 can you share the full debug log for running the example?

[domgolonka]

I am getting the same error with version 0.13.6

[yanc0]

@edwardmedia here is the full debug log (I only targeted google secret resources, avoiding the entier cloudsql execution plan)
https://gist.github.com/yanc0/90db052f8491d711f5519ad67f41ddd3

[edwardmedia]

@yanc0 I noticed you chose userManaged in the google_secret_manager_secret. Shouldn't you provide the data then? If you set automatic for replication, do you still receive this error?

  "replication": {
    "userManaged": {
      "replicas": [
        {
          "location": "europe-west1"
        },
        {
          "location": "europe-west2"
        }
      ]
    }

[yanc0]

Same error when changing replication type

  replication {
    automatic = true
  }

Error: Error creating SecretVersion: googleapi: Error 400: Field [payload] is required.

[edwardmedia]

@yanc0 can you share the full config along with the debug log?

[yanc0]

@edwardmedia https://gist.github.com/yanc0/4c4c530b67f1cd0f0920e51682b18adf
Thanks !

[edwardmedia]

@yanc0 see required in the api doc. Thank you

[yanc0]

Thanks @edwardmedia !

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!