Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally
  to expedite investigation and resolution of this issue.

Terraform Version

Terraform v1.5.7
on darwin_arm64

• provider registry.terraform.io/hashicorp/google v5.9.0

Affected Resource(s)

data.google_storage_bucket

Terraform Configuration

provider "google" {
  project = "project-A"
}


resource "google_storage_bucket" "bucket" {
  project                     = "project-B"
  name                        = "my-bucket-20240202"
  location                    = "us-central1"
  force_destroy               = true
  public_access_prevention    = "enforced"
  uniform_bucket_level_access = true

}

data "google_storage_bucket" "bucket" {
  name = google_storage_bucket.bucket.name
}

output "project-via-resource" {
  value = google_storage_bucket.bucket.project
}

output "project-via-datasource" {
  value = data.google_storage_bucket.bucket.project
}

Debug Output

Here's the output in the CLI would be after applying the config:

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

project-via-datasource = "project-A"
project-via-resource = "project-B"

Expected Behavior

The resource and data source are both connected to the same bucket in GCP and should have the same value for project, matching the project the bucket is linked to.

Actual Behavior

The two outputs are different. This is because the data source reflects the provider default project instead of the actual project the bucket is linked to.

Steps to reproduce

1. terraform apply
2. Compare the two outputs

Important Factoids

Internally the google_storage_bucket resource and datasources share some code that takes in the result of a GET request to read a bucket's data, manipulates that data a bit, and saves it in state.

One of the manipulations is that the Storage API returns the project NUMBER linked to the bucket, not the project ID. When no project value is supplied via the config (i.e. when the data source is using that reused code, as the data source doesn't require a project argument) the code receives the project number and uses the Compute API to translate it into the correct project ID.

However if a provider default project is present, then the data source will use this value to set project in state and will ignore the project number returned from the Storage API. This means the project attribute on the data source may be incorrect, depending on the config.

References

No response

b/323650332