Netlify Terraform API Errors

Support
, ,
1

Copying and pasting my attempted support ticket as I’m currently on the free plan

I’m setting my netlify ENV variables via your Terraform provider like so

  site_id = data.netlify_site.site.id
  team_id = data.netlify_team.team.id

  key = "next_public_youtube_playlist"
  secret_values = [
    for context in local.contexts : {
      value   = jsondecode(data.aws_secretsmanager_secret_version.latest.secret_string)["next_public_youtube_playlist"]
      context = context
    }
  ]
  scopes = local.scopes
}

locals {
  source_repo = lower(basename(path.cwd))
  contexts    = ["dev", "branch-deploy", "deploy-preview", "production"]
  # scopes      = ["builds", "functions", "runtime"]
}

Yet I get the following error if I don't include scopes.
Error: Error updating Netlify environment variable
│ 
│   with netlify_environment_variable.next_public_youtube_playlist,
│   on netlify_env.tf line 246, in resource "netlify_environment_variable" "next_public_youtube_playlist":
│  246: resource "netlify_environment_variable" "next_public_youtube_playlist" {
│ 
│ Could not update Netlify environment variable order ID "next_public_youtube_playlist" (team ID: "teamid", site ID:
│ "43fce32b-eca4-44e6-9af7-97d19a143a5d", secret: true): "422 Unprocessable Entity: {\"code\":422,\"message\":\"Secrets are not allowed to run in
│ 'post_processing' scopes.\"}"

Though If I include my scopes local I get this error
│ Error: Error updating Netlify environment variable
│ 
│   with netlify_environment_variable.next_public_youtube_playlist,
│   on netlify_env.tf line 132, in resource "netlify_environment_variable" "next_public_youtube_playlist":
│  132: resource "netlify_environment_variable" "next_public_youtube_playlist" {
│ 
│ Could not update Netlify environment variable order ID "NEXT_PUBLIC_YOUTUBE_PLAYLIST" (team ID: "teamid", site ID:
│ "43fce32b-eca4-44e6-9af7-97d19a143a5d", secret: false): "403 Forbidden: {\"code\":403,\"message\":\"Upgrade your Netlify account to set specific scopes\"}"

This only happens with secret values which I need otherwise my secrets are exposed on my TF plan.

This seems like an impossible API bug to get around.

Terraform Resource: Terraform Registry

I currently do not see a way around this limitation other than setting them manually in the console which eliminates CI/CD.

2

@Wesley_Kirkland The second error makes sense in isolation:

"403 Forbidden": {
  "code": 403,
  "message": "Upgrade your Netlify account to set specific scopes"
}

This is because the scopes feature of environment variables requires at minimum a Pro account.

Pricing Page

image
image1644×930 130 KB

https://www.netlify.com/pricing/

Documentation

image
image938×151 17.6 KB

https://docs.netlify.com/environment-variables/overview/#scopes

The first error makes less sense to me:

 "422 Unprocessable Entity": {
  "code": "422",
  "message": "Secrets are not allowed to run in 'post_processing' scopes."
}

Since it’s not something you can administer with a Free/Starter plan you would hope they would avoid it themselves, but perhaps using what you’re working with is intended to push people onto a Pro plan.

Switching to a Pro plan seems like it’d make it work, and be the fastest way to keep moving, however I’m not sure that it should be necessary. @hrishikesh Do you have any insight?

3

@nathanmartin Thank you, I’m hoping that @hrishikesh can shine some light onto this. I agree that the second error makes perfect sense. Though the first error seems to be impossible to get around, and there isn’t much sense in a paid plan for me on this, as it’s a personal website that sees maybe 300 people a year. This is more of a fun project overall.

4

That’s interesting. Netlify UI is able to handle this well. As soon as you mark a variable as secret, it gets automatically removed from post processing.

UI before marking it as secret:

image
image906×939 54.9 KB

After marking it as secret:

image
image906×1373 83.5 KB

The section is still disabled, but post-processing is also cancelled out. The API request payload is:

[
  {
    "key": "FOO",
    "is_secret": true,
    "scopes": [
      "builds",
      "functions",
      "runtime"
    ],
    "values": [
      {
        "context": "production",
        "value": "BAR"
      },
      {
        "context": "deploy-preview",
        "value": "BAR"
      },
      {
        "context": "branch-deploy",
        "value": "BAR"
      },
      {
        "context": "dev-server",
        "value": "BAR"
      },
      {
        "context": "dev",
        "value": "BAR"
      }
    ]
  }
]

So the API itself is working. Could be a TF specific thing. Will have to investigate it more.

5

For now, I believe adding environment variable would be a one-time thing? Is it not possible to do it from UI?

7

I bypassed this in the end with a lifecycle ignore changes on scope so Terraform is ignoring this specific property on the API response.

The reason I didn’t do it explicitly from the UI is to accomplish full CI/CD for this project. You can see the code here as it’s public . The process flow is I update the secrets in AWS Secrets Manager, then upon a deployment if the value is different (According to the TF state file) it will update the Netlify variable through Terraform.

8

Okay, I’ve let the devs know, but the only one who works on this is off till Thursday and even after they return, I don’t know how quickly this will be picked up given that this is a super under-used feature at the moment.

1 Like