DEV Community

nomi3
nomi3

Posted on

How to Troubleshoot a Failed Re-creation of Google Cloud Certificate Manager Resources with Terraform

This note describes how to address an error that occurred when trying to recreate a certificate in Google Cloud’s Certificate Manager, which is managed via Terraform.

Note

This operation was performed in a development environment, so downtime during the troubleshooting process was not considered.

Versions

  • Terraform: 1.9.8
  • hashicorp/google: 6.16.0

Goal

We wanted to change the domain in the certificate from before.com to after.com, as shown below:

locals {
-  domain_name = "before.com"
+  domain_name = "after.com"
}

resource "google_certificate_manager_dns_authorization" "example" {
  name   = "example-dns-authorization"
  domain = local.domain_name
}

resource "google_certificate_manager_certificate_map" "example" {
  name = "example-certificate-map"
}

resource "google_certificate_manager_certificate" "example" {
  name = var.prefix
  managed {
    domains = [
      local.domain_name,
      "*.${local.domain_name}"
    ]
    dns_authorizations = [google_certificate_manager_dns_authorization.example.id]
  }
}

resource "google_certificate_manager_certificate_map_entry" "example" {
  name         = "example-certificate-map-entry"
  map          = google_certificate_manager_certificate_map.example.name
  matcher      = "PRIMARY"
  certificates = [google_certificate_manager_certificate.example.id]
}
Enter fullscreen mode Exit fullscreen mode

Error Details

We encountered the following error:

Error: Error when reading or editing Certificate: googleapi: Error 400: can't delete certificate that is referenced by a CertificateMapEntry or other resources
Enter fullscreen mode Exit fullscreen mode

Because the domain name change requires deleting and recreating the certificate, and the certificate is referenced by the certificate map entry, it cannot be deleted as is.

Solution

Below is the procedure used to resolve this issue.

  1. Comment out the google_certificate_manager_certificate and google_certificate_manager_certificate_map_entry resources while changing the domain:
locals {
-  domain_name = "before.com"
+  domain_name = "after.com"
}

resource "google_certificate_manager_dns_authorization" "example" {
  name   = "example-dns-authorization"
  domain = local.domain_name
}

resource "google_certificate_manager_certificate_map" "example" {
  name = "example-certificate-map"
}

-γ€€resource "google_certificate_manager_certificate" "example" {
-   name = var.prefix
-   managed {
-     domains = [
-       local.domain_name,
-       "*.${local.domain_name}"
-     ]
-     dns_authorizations = [google_certificate_manager_dns_authorization.example.id]
-   }
- }

- resource "google_certificate_manager_certificate_map_entry" "example" {
-   name         = "example-certificate-map-entry"
-   map          = google_certificate_manager_certificate_map.example.name
-   matcher      = "PRIMARY"
-   certificates = [google_certificate_manager_certificate.example.id]
- }
+ # resource "google_certificate_manager_certificate" "example" {
+ #   name = var.prefix
+ #   managed {
+ #     domains = [
+ #       local.domain_name,
+ #       "*.${local.domain_name}"
+ #     ]
+ #     dns_authorizations = [google_certificate_manager_dns_authorization.example.id]
+ #   }
+ # }
+
+ # resource "google_certificate_manager_certificate_map_entry" "example" {
+ #   name         = "example-certificate-map-entry"
+ #   map          = google_certificate_manager_certificate_map.example.name
+ #   matcher      = "PRIMARY"
+ #   certificates = [google_certificate_manager_certificate.example.id]
+ # }
Enter fullscreen mode Exit fullscreen mode

After making these changes, run:

terraform apply
Enter fullscreen mode Exit fullscreen mode
  1. Uncomment the two resources:
locals {
  domain_name = "after.com"
}

resource "google_certificate_manager_dns_authorization" "example" {
  name   = "example-dns-authorization"
  domain = local.domain_name
}

resource "google_certificate_manager_certificate_map" "example" {
  name = "example-certificate-map"
}

- # resource "google_certificate_manager_certificate" "example" {
- #   name = var.prefix
- #   managed {
- #     domains = [
- #       local.domain_name,
- #       "*.${local.domain_name}"
- #     ]
- #     dns_authorizations = [google_certificate_manager_dns_authorization.example.id]
- #   }
- # }
-
- # resource "google_certificate_manager_certificate_map_entry" "example" {
- #   name         = "example-certificate-map-entry"
- #   map          = google_certificate_manager_certificate_map.example.name
- #   matcher      = "PRIMARY"
- #   certificates = [google_certificate_manager_certificate.example.id]
- # }
+ resource "google_certificate_manager_certificate" "example" {
+   name = var.prefix
+   managed {
+     domains = [
+       local.domain_name,
+       "*.${local.domain_name}"
+     ]
+     dns_authorizations = [google_certificate_manager_dns_authorization.example.id]
+   }
+ }

+ resource "google_certificate_manager_certificate_map_entry" "example" {
+   name         = "example-certificate-map-entry"
+   map          = google_certificate_manager_certificate_map.example.name
+   matcher      = "PRIMARY"
+   certificates = [google_certificate_manager_certificate.example.id]
+ }
Enter fullscreen mode Exit fullscreen mode

Finally, run:

terraform apply
Enter fullscreen mode Exit fullscreen mode

This procedure updates the certificate domain successfully.

Do your career a big favor. Join DEV. (The website you're on right now)

It takes one minute, it's free, and is worth it for your career.

Get started

Community matters

Top comments (0)

A Workflow Copilot. Tailored to You.

Pieces.app image

Our desktop app, with its intelligent copilot, streamlines coding by generating snippets, extracting code from screenshots, and accelerating problem-solving.

Read the docs

πŸ‘‹ Kindness is contagious

Explore a sea of insights with this enlightening post, highly esteemed within the nurturing DEV Community. Coders of all stripes are invited to participate and contribute to our shared knowledge.

Expressing gratitude with a simple "thank you" can make a big impact. Leave your thanks in the comments!

On DEV, exchanging ideas smooths our way and strengthens our community bonds. Found this useful? A quick note of thanks to the author can mean a lot.

Okay