Terraform GCP: Creating Cloud SQL User with Google Secret Manager Password Leads to Authentication Failure

282 Views Asked by At

I am attempting to create an SQL user using a password retrieved from the Google Secret Manager in Terraform, my database is Postgres-15. Below is my Terraform file:

resource "random_string" "db_name_suffix" {
  length  = 4
  special = false
  upper   = false
}

resource "google_sql_database_instance" "cloud_sql" {
  # Instance info
  name                = "cloud-sql-private-${random_string.db_name_suffix.result}"
  region              = var.region
  database_version    = var.cloud_sql_database_version
  deletion_protection = false
  root_password       = "abcABC123!"
  settings {

    # Region and zonal availability
    availability_type = var.cloud_sql_availability_type
    location_preference {
      zone = var.cloud_sql_location_preference
    }

    # Machine Type
    tier = var.cloud_sql_machine_type

    # Storage
    disk_size = var.cloud_sql_default_disk_size

    # Connections
    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.custom.id
    }

    # Backups
    backup_configuration {
      enabled            = true
      start_time         = "06:00"
    }
  }

  depends_on = [
    google_service_networking_connection.private-vpc-connection
  ]
}

data "google_secret_manager_secret_version" "cloud-sql-admin-user-password" {
  secret  = "cloud-sql-admin-user-password"
  version = "latest"
  project = var.project_id
}

resource "google_sql_database" "spring-api-database" {
  name     = "helloworld_db"
  instance = google_sql_database_instance.cloud_sql.name
}

resource "google_sql_user" "new-user" {
  name     = data.google_secret_manager_secret_version.cloud-sql-admin-user-password.secret_data
  instance = google_sql_database_instance.cloud_sql.name
  password = data.google_secret_manager_secret_version.cloud-sql-admin-user-password.secret_data
}

the file is long, so just focus on this code block:


data "google_secret_manager_secret_version" "cloud-sql-admin-user-password" {
  secret  = "cloud-sql-admin-user-password"
  version = "latest"
  project = var.project_id
}
......
resource "google_sql_user" "new-user" {
  name     = data.google_secret_manager_secret_version.cloud-sql-admin-user-password.secret_data
  instance = google_sql_database_instance.cloud_sql.name
  password = data.google_secret_manager_secret_version.cloud-sql-admin-user-password.secret_data
}

To verify that I am using the correct secret value, I set both the username and password to the same value. When I execute terraform apply, the user is created successfully with the username aStrongPassword123, which matches the value of my secret.

database user list:

database user list

However, despite expecting the password to be aStrongPassword123, attempting to log in results in the error "FATAL: password authentication failed."

login message:

login message

If I create user using the Cloud Console UI, I can log in successfully. Can someone please help me identify what might be wrong with my Terraform code block?

0

There are 0 best solutions below