google_compute_backend_bucket cdn_policy block does not allow setting default_ttl, client_ttl, or signed_url_cache_max_age_sec to 0, instead uses default value (not 0)

[apottere]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v1.0.9
on darwin_amd64
+ provider registry.terraform.io/hashicorp/google v3.88.0
+ provider registry.terraform.io/hashicorp/google-beta v3.88.0

Affected Resource(s)

• google_compute_backend_bucket

Terraform Configuration Files

resource "google_compute_backend_bucket" "static" {
  name        = google_storage_bucket.static.name
  description = "Backend for static bucket (${google_storage_bucket.static.name})"
  bucket_name = google_storage_bucket.static.name

  enable_cdn = true
  cdn_policy {
    cache_mode                   = "FORCE_CACHE_ALL"
    signed_url_cache_max_age_sec = 0
    default_ttl                  = 0
    client_ttl                   = 0
    serve_while_stale            = 0
  }
}

Debug Output

<project> and <name> redacted below, and I tried to pull out relevant portions because I'm not comfortable uploading the whole log. Let me know if you need other parts and I can redact them and get them to you as well.

...

2021-10-15T10:41:03.159-0400 [WARN]  Provider "provider[\"registry.terraform.io/hashicorp/google\"]" produced an unexpected new value for google_compute_backend_bucket.static, but we are tolerating it because it is using the legacy plugin SDK.
    The following problems may be the cause of any confusing errors from downstream operations:
      - .cdn_policy[0].default_ttl: was cty.NumberIntVal(0), but now cty.NumberIntVal(3600)
      - .cdn_policy[0].signed_url_cache_max_age_sec: was cty.NumberIntVal(0), but now cty.NumberIntVal(1)

...

PUT /compute/v1/projects/<project>/global/backendBuckets/<name>?alt=json HTTP/1.1
Host: compute.googleapis.com
User-Agent: Terraform/1.0.9 (+https://www.terraform.io) Terraform-Plugin-SDK/2.5.0 terraform-provider-google/3.88.0
Content-Length: 274
Content-Type: application/json
Accept-Encoding: gzip

{
 "bucketName": "<name>",
 "cdnPolicy": {
  "cacheMode": "FORCE_CACHE_ALL",
  "negativeCaching": false,
  "serveWhileStale": 0
 },
 "description": "Backend for static bucket (<name>)",
 "enableCdn": true,
 "name": "<name>"
}

Expected Behavior

Terraform sets default_ttl and client_ttl to Always revalidate, and signed_url_cache_max_age_sec to 0

Actual Behavior

Terraform sets default_ttl and client_ttl to 3600 (1 hour), and signed_url_cache_max_age_sec to 1

And any number of subsequent runs of terraform apply detect changes that are never resolved:

  # google_compute_backend_bucket.static will be updated in-place
  ~ resource "google_compute_backend_bucket" "static" {
        id                      = "projects/<project>/global/backendBuckets/<name>"
        name                    = "<name>"
        # (7 unchanged attributes hidden)

      ~ cdn_policy {
          ~ default_ttl                  = 3600 -> 0
          ~ signed_url_cache_max_age_sec = 1 -> 0
            # (5 unchanged attributes hidden)
        }
    }

Steps to Reproduce

1. terraform apply

Important Factoids

Running as user account, not service account

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.