[Bug] Cannot import Fleet policy

[renzedj]

Describe the bug

I am trying to import an elasticstack_fleet_agent_policy using the instructions in the documentation, which states:

Import is supported using the following syntax:

terraform import elasticstack_kibana_fleet_agent_policy.my_policy <space id>/<policy id>

I get the following error:

Error: Cannot import non-existent remote object
 
While attempting to import an existing object to "module.fleet.elasticstack_fleet_agent_policy.fleet_policy[\"test-policy\"]", the provider detected that no object exists with the
given id. Only pre-existing objects can be imported; check that the id is correct and that it is associated with the provider's configured region or endpoint, or use "terraform apply" to
create a new remote object for this resource.

This is the same behavior reported in Issue #369 for elasticstack_fleet_output.

To reproduce

Attempt to import elasticstack_fleet_agent_policy.

Expected behavior

Object should import.

Version

• OS: macos
• Terraform Version: 1.5.4, 1.5.7
• Provider version: 0.6.2, 0.7.0, 0.8.0
• Elasticsearch Version: 8.9.0, 8.10.0, 8.10.2

[mikkoc]

Same issue here.

[renzedj]

I finally got back to this and ran the TRACE.

Here are the results, where I get a 404 and it fails while getting agent policies:

-----------------------------------------------------: @caller=github.com/elastic/terraform-provider-elasticstack/internal/utils/http_log.go:51 @module=elasticstack tf_provider_addr=registry.terraform.io/elastic/elasticstack tf_req_id=6a9d10d2-0c1b-8a25-d4a0-6fbd0aa3fb64 tf_rpc=ReadResource tf_mux_provider=*schema.GRPCProviderServer tf_resource_type=elasticstack_fleet_agent_policy timestamp=2023-09-27T08:34:18.546-0500
2023-09-27T08:34:18.547-0500 [DEBUG] provider.terraform-provider-elasticstack_v0.8.0: Fleet API Request Details:
---[ REQUEST ]---------------------------------------
GET /api%2Ffleet%2Fagent_policies HTTP/1.1
Host: kibana.example.com
User-Agent: Go-http-client/1.1
Authorization: ***************************************************
Referer: https://kibana.example.com/api/fleet/agent_policies/
Accept-Encoding: gzip


-----------------------------------------------------: @caller=github.com/elastic/terraform-provider-elasticstack/internal/utils/http_log.go:39 tf_mux_provider=*schema.GRPCProviderServer tf_req_id=6a9d10d2-0c1b-8a25-d4a0-6fbd0aa3fb64 tf_rpc=ReadResource @module=elasticstack tf_provider_addr=registry.terraform.io/elastic/elasticstack tf_resource_type=elasticstack_fleet_agent_policy timestamp=2023-09-27T08:34:18.546-0500
2023-09-27T08:34:18.592-0500 [DEBUG] provider.terraform-provider-elasticstack_v0.8.0: Fleet API Response Details:
---[ RESPONSE ]--------------------------------------
HTTP/1.1 404 Not Found
Content-Length: 60
Cache-Control: private, no-cache, no-store, must-revalidate
Content-Security-Policy: script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'
Content-Type: application/json; charset=utf-8
Cross-Origin-Opener-Policy: same-origin
Date: Wed, 27 Sep 2023 13:34:18 GMT
Kbn-License-Sig: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Kbn-Name: instance-XXXXXXXXXX
Permissions-Policy: camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()
Referrer-Policy: no-referrer-when-downgrade
X-Cloud-Request-Id: XXXXXXXXXXXXXXXXXXXXXX
X-Content-Type-Options: nosniff
X-Found-Handling-Cluster: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
X-Found-Handling-Instance: instance-XXXXXXXXXX

{
 "statusCode": 404,
 "error": "Not Found",
 "message": "Not Found"
}

An earlier call to this API which does not fail looks like:

2023-09-27T08:34:18.137-0500 [DEBUG] provider.terraform-provider-elasticstack_v0.8.0: Fleet API Request Details:
---[ REQUEST ]---------------------------------------
GET /api/fleet/agent_policies/ HTTP/1.1
Host: kibana.example.com
User-Agent: Go-http-client/1.1
Authorization: ***************************************************
Accept-Encoding: gzip

The difference appears to be that the call which fails uses URL encoding for the request (the first one, at 2023-09-27T08:34:18.546-0500), while the one which succeeds does not (the second one, at 2023-09-27T08:34:18.137-0500).

[Tim-herbie]

I have the same error

[taylor-swanson]

Sorry for getting to this late (I don't normally work in this repo). I see the issue that is happening here. On a read, the provider is overwriting the ID set by the import and is setting it to the value of the policy_id field (or equivalent field in other resources). In most cases, policy_id won't be set, so it will be an empty string. This is why we see the suspicious API calls such as:

GET /api/fleet/agent_policies/ HTTP/1.1
                              ^ ID should show up here

I've submitted a PR to resolve this issue for agent policies, outputs, and server hosts for fleet: #447

[breml]

Support for elasticstack_fleet_agent_policy has been introduced in v0.6.0 of this provider. I iterated back until this version and importing of elasticstack_fleet_agent_policy did not work with any of them. Looking forward to a fixed version of this provider.