Opaque 400 Error

[maxcbc]

Hi there,

I'm getting an opaque error. Its likely caused by misconfiguration on my part, but the error message could be more helpful (though this may be coming directly from the Fastly API itself).

Terraform Version

1.1.7

Affected Resource(s)

Please list the resources as a list, for example:

• fastly_service_vcl

Terraform Configuration Files

resource "fastly_service_vcl" "assets_cdn" {
  name = var.fastly_service_name

  domain {
    name    = var.domain_name
    comment = "Assets Domain"
  }

  // Origin
  backend {
    name                  = "Origin"
    address               = "${var.s3_bucket_name}.s3-${var.s3_region}.amazonaws.com"
    override_host         = "${var.s3_bucket_name}.s3-${var.s3_region}.amazonaws.com"
    port                  = 443
    ssl_cert_hostname     = "*.s3-${var.s3_region}.amazonaws.com"
    use_ssl               = true
    auto_loadbalance      = false
    connect_timeout       = 5000
    first_byte_timeout    = 15000
    between_bytes_timeout = 100000
    error_threshold       = 0
  }

  gzip {
    name       = "Compression Policy"
    extensions = [
      "css",
      "js",
      "html",
      "eot",
      "ico",
      "otf",
      "ttf",
      "json",
      "svg"
    ]
    content_types = [
      "text/html",
      "application/x-javascript",
      "text/css",
      "application/javascript",
      "text/javascript",
      "application/json",
      "application/vnd.ms-fontobject",
      "application/x-font-opentype",
      "application/x-font-truetype",
      "application/x-font-ttf",
      "application/xml",
      "font/eot",
      "font/opentype",
      "font/otf",
      "image/svg+xml",
      "image/vnd.microsoft.icon",
      "text/plain",
      "text/xml"
    ]
  }

  logging_splunk {
    name   = "Web logs to splunk"
    url    = "https://${local.splunk_domain}.splunkcloud.com:443/services/collector/event"
    format = file("${local.config_dir}/logging/fastly-web-splunk-format.json")
  }

  vcl {
    name    = "main.vcl"
    content = file("${local.config_dir}/vcl/main.vcl")
    main    = true
  }

  vcl {
    name    = "fastly-boilerplate-begin.vcl"
    content = file("${local.config_dir}/vcl/fastly-boilerplate-begin.vcl")
  }

  vcl {
    name    = "fastly-boilerplate-end.vcl"
    content = file("${local.config_dir}/vcl/fastly-boilerplate-end.vcl")
  }

}

Expected Behavior

The service should deploy.

Actual Behavior

When doing terraform deploy, changes are deployed seemingly succesfully, however terraform returns the below error. Though it doesn't say what token/key is missing, for what purpose (is it a fastly key missing, s3, splunk?).

Plan: 0 to add, 1 to change, 0 to destroy.
module.fastly_service.fastly_service_vcl.assets_cdn: Modifying... [id=<my-id>]
╷
│ Error: 400 - Bad Request:
│ 
│     Title:  Bad request
│     Detail: missing required token/key for authentication
│ 
│   with module.fastly_service.fastly_service_vcl.assets_cdn,
│   on ../../modules/fastly_service/service.tf line 5, in resource "fastly_service_vcl" "assets_cdn":
│    5: resource "fastly_service_vcl" "assets_cdn" {
│ 
╵
Releasing state lock. This may take a few moments...

Exited with code exit status 1

Steps to Reproduce

terraform apply

[Integralist]

Hi @maxcbc

Thanks for raising this issue. You are correct, the messaging isn't generated by the Terraform provider but by the Fastly API. Tokens are named differently for different API endpoints, and the particular internal service that this message is produced from supports multiple endpoints and so has had to use a generalised "token/key" wording.

In this particular instance, I believe the messaging is referring to the log endpoint:
https://registry.terraform.io/providers/fastly/fastly/latest/docs/resources/service_vcl#nestedblock--logging_splunk

Which the documentation suggests has an optional token field. I'm going to investigate this with the relevant team. Because if this field is expected to be required, then the Terraform provider should document it as such.

[Integralist]

UPDATE: fastly/go-fastly#355

[Integralist]

Once the go-fastly PR is merged and a new release is cut, then I'll open a PR for the Terraform provider to use the latest version and to mark the token field for the affected logging endpoints to be 'required'.

[Integralist]

UPDATE: Fixing in #579

[Integralist]

New Terraform Provider release 2.2.1:
https://github.com/fastly/terraform-provider-fastly/releases/tag/v2.2.1