Creating a VPC with IBMCLOUD_VISIBILITY=private seems to require a call to public IAM API

[l2fprod]

Template

terraform {
  required_providers {
    ibm = {
      source  = "IBM-Cloud/ibm"
      version = ">= 1.29"
    }
  }
}

provider "ibm" {
  visibility = "private"
}

resource "random_string" "random" {
  length = 8
  special = false
  lower = true
  upper = false
  number = false
}

resource "ibm_resource_group" "group" {
  name = "${random_string.random.result}-group"
}

resource "ibm_is_vpc" "vpc" {
  name = "${random_string.random.result}-vpc"
  resource_group = ibm_resource_group.group.id
}

Terraform Version

$ terraform version
Terraform v1.0.3
on linux_amd64
+ provider registry.terraform.io/hashicorp/random v3.1.0
+ provider registry.terraform.io/ibm-cloud/ibm v1.29.0

Failure if iam.cloud.ibm.com is overridden to 127.0.0.1

│ Error: Error while creating VPC {
│     "Message": "An error occurred while performing the 'authenticate' step: Post \"https://iam.cloud.ibm.com/identity/token\": dial tcp 127.0.0.1:443: connect: connection refused",
│     "StatusCode": 0,
│     "Result": null
│ }
│
│
│   with module.vpc_d.ibm_is_vpc.vpc,
│   on vpc/main.tf line 1, in resource "ibm_is_vpc" "vpc":
│    1: resource "ibm_is_vpc" "vpc" {
│
╵

Similar issue as #2890

[l2fprod]

^ @hkantare

[l2fprod]

I've not been able to produce this in my test -- closing for now

[l2fprod]

for reference, capturing tcpdump shows these hosts:

bss.us-south.proxy.serviceendpoint.cloud.ibm.com
ghost.us-south.proxy.serviceendpoint.cloud.ibm.com
iaas.us-south.proxy.serviceendpoint.cloud.ibm.com
private.us-south.iam.cloud.ibm.com
private.us-south.resource-controller.cloud.ibm.com
tags.private.us-south.global-search-tagging.cloud.ibm.com
us-south.private.iaas.cloud.ibm.com

using these commands (running terraform in a Docker container so it is easier to track DNS lookups)

tcpdump udp port 53 > tcpdump.apply.txt &
terraform apply
pkill tcpdump
cat tcpdump.apply.txt | sed -n -r "s/^.* (.*ibm\.com). .*$/\1/p" | sort -u