Support force_destroy on Datastream Private Connections

[joshbautista]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Description

When creating a Datastream Private Connection with the google_datastream_private_connection Terraform resource, the Datastream API creates unmanaged resources (resources not known to Terraform) like:

• VPC Peering Connection with a Google owned VPC
• VPC Peering Routes
• Allocated IP Range for Private Services Access

When Terraform attempts to destroy the Private Connection, we are met with the following error:

Error: Error when reading or editing PrivateConnection: googleapi: Error 400: Resource '"projects/<someprojectid>/locations/<someregion>/privateConnections/<somedatastreamid>"' has nested resources. If the API supports cascading delete, set 'force' to true to delete it and its nested resources.

This is especially problematic since a google_datastream_private_connection is considered an immutable resource, so something simple like mutating its labels requires a destroy/create cycle.

In a related issue, it was mentioned that maybe we should be managing these other resources in Terraform first, but I don't believe that's feasible since the Create method for Datastream takes a PrivateConnection object in its body, which contains a VpcPeeringConfig field, made up of an existing VPC ID and potentially available subnet. This leads me to believe that Datastream is intending to be the creator and manager of the Peering connection and all its dependent resources like child routes.

The PrivateConnection Delete method does support the force parameter that will cascade these deletes to the dependent resources.

From a Terraform standpoint, I believe that anything created with Terraform should be able to be destroyed with Terraform without manual intervention like deleting any child resources via the UI or out of band API calls prior to deleting the original resource. To that end, it would be nice if the google_datastream_private_connection resource supported force_destroy, mapping to the force parameter in the Delete method.

New or Affected Resource(s)

• google_datastream_private_connection

Potential Terraform Configuration

resource "google_datastream_private_connection" "this" {
  project               = "someprojectid"
  display_name          = "somedisplayname"
  location              = "us-central1"
  private_connection_id = "someconnectionid"
  force_destroy         = true

  labels = {
    label1 = "somevalue1"
    label2 = "somevalue2"
  }

  vpc_peering_config {
    vpc    = "somevpcid"
    subnet = "10.0.0.0/29"
  }
}

References

Prior discussion: #13054

Label immutability: #16469

b/325595255

[melinath]

This seems like a valid request - we would likely want to implement it with a deletion_policy similar to google_alloydb_cluster.deletion_policy.

[manitgupta]

Is there an update on this feature request?