Error creating a firewall route after VPC creation

Terraform CDK for Terraform
1

Hello,

I’m currently trying to use the CDK to create a simple Google Cloud architecture, while creating a simple VPC with a firewall rule i encounter this error :

network_stack  google_compute_network.main-network: Creating...
network_stack  google_compute_firewall.allow-ssh: Creating...
network_stack  google_compute_network.main-network: Still creating... [10s elapsed]
network_stack  google_compute_network.main-network: Still creating... [20s elapsed]
network_stack  google_compute_network.main-network: Creation complete after 22s [id=projects/dev/global/networks/main-network]
network_stack  ╷
               │ Error: Error creating Firewall: googleapi: Error 404: The resource 'projects/dev/global/networks/main-network' was not found, notFound
               │ 
               │   with google_compute_firewall.allow-ssh (allow-ssh),
               │   on cdk.tf.json line 41, in resource.google_compute_firewall.allow-ssh (allow-ssh):
               │   41:       }
               │ 
               ╵

The thing is that he is supposed to have createed the network just before, that’s why my questions are :

  • Is it a normal behavior ?
  • If no, do you know why i get this error ?
  • If yes, does that mean i’m supposed to create VPCs in a stack and the firewall rules in another ? Is there a better way to do it ?

Thank you for reading and your time !

2

Can you please show the resources configurations?
Perhaps adding depends_on meta-argument to the firewall resource will help:

resource "google_compute_firewall" "allow_ssh" {
  # your configuration here
  depends_on = [google_compute_network.main-network]
}
3

Since i’m using the cdk my code looks like this :

class NetworkStack(TerraformStack):
    def __init__(self, scope: Construct, id: str):
        super().__init__(scope, id)

        GoogleProvider(self, 'google', project=GOOGLE_PROJECT, region='europe-west1')
        GcsBackend(self, bucket=f"tf-state-{PROVIDER}-{ENVIRONMENT}", prefix=f"cdktf/{id}")
    
        for network_config in file_content["projects"][GOOGLE_PROJECT]['networks']:
            self.network = ComputeNetwork(self, network_config['name'], name=network_config['name'], auto_create_subnetworks=False)
            

            for network_config in file_content["projects"][GOOGLE_PROJECT]['networks']:
                for subnets in network_config['subnets']:
                    for firewall_rules in subnets['firewall_rules']:
                        ComputeFirewall(
                            self,
                            firewall_rules['name'],
                            name=firewall_rules['name'],
                            network=network_config['name'],
                            allow=[{"protocol": firewall_rules['protocol'], "ports": firewall_rules['ports']}],
                            source_ranges=firewall_rules['source_ranges'],
                        )

app = App()
file_content = read_yaml_config('config.yaml')
buckets = BucketStack(app, "bucket_stack")
app.synth()
4

But adding the depends_on keyword to the function did the trick !

Thank you !

Here is a sample of the final code for those who might find it useful :

class NetworkStack(TerraformStack):
    def __init__(self, scope: Construct, id: str):
        super().__init__(scope, id)

        GoogleProvider(self, 'google', project=GOOGLE_PROJECT, region='europe-west1')
        GcsBackend(self, bucket=f"tf-state-{PROVIDER}-{ENVIRONMENT}", prefix=f"cdktf/{id}")
    
        for network_config in file_content["projects"][GOOGLE_PROJECT]['networks']:
            network = ComputeNetwork(self, network_config['name'], name=network_config['name'], auto_create_subnetworks=False)
            for subnets in network_config['subnets']:
                for firewall_rules in subnets['firewall_rules']:
                    ComputeFirewall(
                        self,
                        firewall_rules['name'],
                        name=firewall_rules['name'],
                        network=network_config['name'],
                        allow=[{"protocol": firewall_rules['protocol'], "ports": firewall_rules['ports']}],
                        source_ranges=firewall_rules['source_ranges'],
                        depends_on=[network]
                    )
1 Like