google cloud platform – Terraform google_certificate_manager_certificate_issuance_config fails with “Config validation failed” for cross-project CA pool in GCP

admin

Terraform Setup:

  • Terraform version: 1.13.3

  • Provider: hashicorp/google ~> 7.5.0

  • CA Pool Project: abcd-sandbox

  • Issuance Config Project: abcd-careq

I’ve already:

  • Created the CA pool and root CA in the sandbox project.

  • Enabled privateca.googleapis.com in both projects.

  • Created the Certificate Manager service account in the careq project.

Granted the following IAM roles on the CA pool for the service account:

roles/privateca.certificateRequester

resource "google_privateca_ca_pool_iam_member" "member" {
  provider = google-beta
  project  = “abcd-sandbox"
  location = "europe-north1"
  ca_pool  = google_privateca_ca_pool.root_pool.id
  role     = "roles/privateca.certificateRequester"
  //member   = "serviceAccount:service-${data.google_project.careq.number}@gcp-sa-certmanager.iam.gserviceaccount.com"
  //member   = "serviceAccount:service-${data.google_project.careq.number}@gcp-sa-certificatemanager.iam.gserviceaccount.com"
  //member = google_project_service_identity.cert_manager_sa.email
  member = "serviceAccount:${google_project_service_identity.cert_manager_sa.email}"

Ensure the identity is created before this IAM member is applied

  depends_on = [google_project_service_identity.cert_manager_sa]
}

Issuance Config in careq project

resource "google_certificate_manager_certificate_issuance_config" "default" {
  provider    = google.careq
  name        = "issuance-config-${random_string.ca_abcdsuffix.id}"
  location    = "europe-north1"
  description = "sample description for the certificate issuanceConfigs"
  certificate_authority_config {
    certificate_authority_service_config {
      //ca_pool = google_privateca_ca_pool.root_pool.id
      //ca_pool = "projects/${google_privateca_ca_pool.root_pool.project}/locations/${google_privateca_ca_pool.root_pool.location}/caPools/${google_privateca_ca_pool.root_pool.name}"
      //ca_pool = "projects/${google_privateca_ca_pool.root_pool.project}/locations/${var.location}/caPools/${var.ca-pool-name}"
      ca_pool = "projects/abcd-sandbox/locations/europe-north1/caPools/mainroot-ca-pool-zzzz7"
      //ca_pool = "projects/${google_privateca_ca_pool.root_pool.project}/locations/${google_privateca_ca_pool.root_pool.location}/caPools/${google_privateca_ca_pool.root_pool.name}"
    }
  }
  lifetime                   = "1814400s"
  rotation_window_percentage = 34
  key_algorithm              = "RSA_2048"
  labels                     = { "name" : "wrench", "count" : "3" }

  depends_on = [
    google_privateca_ca_pool_iam_member.member,
    google_privateca_certificate_authority.root_ca
  ]
}

Error is:

Error: Error waiting to create CertificateIssuanceConfig: Error
waiting for Creating CertificateIssuanceConfig: Error code 3, message:
Config validation failed │ │ with
google_certificate_manager_certificate_issuance_config.default, │ on
main.tf line 159, in resource
“google_certificate_manager_certificate_issuance_config” “default”: │
159: resource “google_certificate_manager_certificate_issuance_config”
“default” {

Read more here: Source link