terraform apply throws Error 409: alreadyExists when re-creating google_kms_key_ring

[phausman]

Terraform Version

Terraform v0.11.4
+ provider.google v1.7.0

Affected Resource(s)

• google_kms_key_ring

Terraform Configuration Files

variable project_id {
  type = "string"
  default = ""
}

provider "google" {
  project = "${var.project_id}"
  credentials = "account.json"
}

resource "google_kms_key_ring" "my_key_ring" {
  project   = "${var.project_id}"
  name      = "my-key-ring"
  location  = "europe"
}

resource "google_kms_crypto_key" "my_crypto_key" {
  name     = "my-crypto-key"
  key_ring = "${google_kms_key_ring.my_key_ring.id}"
}

Expected Behavior

GCP resources google_kms_key_ring and google_kms_crypto_key can't be deleted. This is by design. But if they already exist, terraform should skip their creation and not break the deployment.

Actual Behavior

When resource google_kms_key_ring already exists, calling terraform apply throws the Error 409: alreadyExists, which breaks the deployment:

google_kms_key_ring.my_key_ring: Error creating KeyRing: googleapi: Error 409: KeyRing projects/my-project/locations/europe/keyRings/my-key-ring already exists., alreadyExists

Steps to Reproduce

1. terraform apply <- google_kms_key_ring does not exist yet, command succeeds
2. terraform destroy
3. terraform apply <- this is where terraform throws Error 409: alreadyExists.

[phausman]

Looks like this has already been raised in #518 (comment) and answered in #518 (comment).

And the answer is to import google_kms_key_ring before calling terraform apply, https://www.terraform.io/docs/providers/google/r/google_kms_key_ring.html#import.

[todd-dsm]

A helper script for those who also diddled with this way too long.

Is this not best solved with data source, like everything we need to discover along the way?

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!