CODEWITHSUNDEEP
google-cloud-platformterraformvirtual-machinegoogle-cloud-kms
PegaChucho
PegaChucho

Reputation: 133

Error creating a VM in Terraform for GCP with KMS key (Error creating instance: googleapi: Error 503)

i can't create a VM on GCP using terraform, i want to attach a kms key in the attribute "kms_key_self_link", but when the machine is being created, time goes and after 2 minutes waiting (in every case) the error 503 appears. I'm going to share my script, is worthly to say that with the attribute "kms_key_self_link" dissabled, the script runs ok.

data "google_compute_image" "tomcat_centos" {
  name = var.vm_img_name
}

data "google_kms_key_ring" "keyring" {
  name     = "keyring-example"
  location = "global"
}

data "google_kms_crypto_key" "cmek-key" {
  name     = "crypto-key-example"
  key_ring = data.google_kms_key_ring.keyring.self_link
}

data "google_project" "project" {}

resource "google_kms_crypto_key_iam_member" "key_user" {
  crypto_key_id = data.google_kms_crypto_key.cmek-key.id
  role          = "roles/owner"
  member        = "serviceAccount:service-${data.google_project.project.number}@compute-system.iam.gserviceaccount.com"
}


resource "google_compute_instance" "vm-hsbc" {
  name         = var.vm_name
  machine_type = var.vm_machine_type
  zone         = var.zone

  allow_stopping_for_update = true
  can_ip_forward            = false
  deletion_protection       = false

  boot_disk {
    kms_key_self_link = data.google_kms_crypto_key.cmek-key.self_link
    initialize_params {
      type = var.disk_type
      #GCP-CE-CTRL-22
      image = data.google_compute_image.tomcat_centos.self_link
    }
  }


  network_interface {
    network = var.network
  }


  #GCP-CE-CTRL-2-...-5, 7, 8 
  service_account {
    email  = var.service_account_email
    scopes = var.scopes
  }

  #GCP-CE-CTRL-31
  shielded_instance_config {
    enable_secure_boot          = true
    enable_vtpm                 = true
    enable_integrity_monitoring = true
  }
}

And this is the complete error:

Error creating instance: googleapi: Error 503: Internal error. Please try again or contact Google Support. (Code: '5C54C97EB5265.AA25590.F4046F68'), backendError

Upvotes: 1

Views: 860

Answers (1)

PegaChucho
PegaChucho

Reputation: 133

I solved this issue granting to my compute service account the role of encrypter/decripter through this resource:

resource "google_kms_crypto_key_iam_binding" "key_iam_binding" {
  crypto_key_id = data.google_kms_crypto_key.cmek-key.id
  role          = "roles/cloudkms.cryptoKeyEncrypter"

  members = [
    "serviceAccount:service-${data.google_project.gcp_project.number}@compute-system.iam.gserviceaccount.com",

  ]
}

Upvotes: 1

Related Questions