Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

API Authentication -> oauth2: cannot fetch token: 403 Forbidden #624

Open
carnei-ro opened this issue Oct 6, 2023 · 7 comments
Open

API Authentication -> oauth2: cannot fetch token: 403 Forbidden #624

carnei-ro opened this issue Oct 6, 2023 · 7 comments
Labels
bug Something isn't working

Comments

@carnei-ro
Copy link

Terraform Version and Provider Version

Terraform version: v1.6.0
HCP provider version: v0.72.1

Affected Resource(s)

  • hcp_vault_secrets_secret
  • hcp_vault_secrets_app

any vault_secrets resource to be honest ; I'm not sure if I am reaching some rate-limiting that is returning me 403 instead of 429;

Output

│ Error: unable to fetch project "afaa2972-c2c7-445c-be4d-9f8b75b3e634": Get "https://api.cloud.hashicorp.com:443/resource-manager/2019-12-10/projects/afaa2972-c2c7-445c-be4d-9f8b75b3e634": oauth2: cannot fetch token: 403 Forbidden
│ Response: <!DOCTYPE html>
│ <html>
│ 
│ <head>
│     <meta charset="utf-8">
│     <meta name="viewport" content="width=device-width, initial-scale=1.0">
│     <link rel="stylesheet" href="https://fonts.googleapis.com/icon?family=Material+Icons">
│     <title>Forbidden</title>
│     <style>
│         @font-face {
│             font-family: "Stabil Grotesk";
╵
INFO[0101] Encountered an error eligible for retrying. Sleeping 15s before retrying. 
ERRO[0116] 1 error occurred:
        * Exhausted retries (5) for command terraform plan
 
ERRO[0116] Unable to determine underlying exit code, so Terragrunt will exit with error code 1
@carnei-ro carnei-ro added the bug Something isn't working label Oct 6, 2023
@carnei-ro carnei-ro changed the title API Authentication -> oauth2: API Authentication -> oauth2: cannot fetch token: 403 Forbidden Oct 6, 2023
@AnPucel
Copy link
Contributor

AnPucel commented Oct 6, 2023 •
edited
Loading

Hi there! Sorry you're running into this. I have a couple of follow up questions:

  • How are you authenticating? Organization level service principal, project level service principal, etc?
  • How does the configuration of your top level HCP look? Are you using any environment variables?

@hashicorp hashicorp deleted a comment from carnei-ro Oct 6, 2023
@AnPucel
Copy link
Contributor

AnPucel commented Oct 6, 2023

Hi! For clarification, I'm curious what attributes you're using at your top level configuration

E.g. project_id, client_id, client_secret or if you're passing them as env vars?

@carnei-ro
Copy link
Author

oh, https://github.com/hashicorp deleted a comment from [carnei-ro](https://github.com/carnei-ro) [4 minutes ago](https://github.com/hashicorp/terraform-provider-hcp/issues/624#event-10578762048)

  • How are you authenticating? Organization level service principal
  • I have a provider.tf:
provider "hcp" {
  project_id    = "afaa..."
  client_id     = "<some value>"
  client_secret = "<anoter value>"
}

@carnei-ro
Copy link
Author

Here is my repo (I'm using terragrunt);

If you want to play, all you need to do is change the value of the client_id and client_secret here;

Then go to https://github.com/carnei-ro/hashicorp-cloud-live/tree/main/projects/carneiro/vault-secrets/delete-me and run terragrunt run-all apply --terragrunt-non-interactive

@AnPucel
Copy link
Contributor

AnPucel commented Oct 6, 2023

@carnei-ro It may be a good idea to rotate your service principal credentials at this point in time even though the comment has been deleted.

@carnei-ro
Copy link
Author

@AnPucel I did not post the real ones (only real value is the project_id afaa2972-c2c7-445c-be4d-9f8b75b3e634)

@AnPucel
Copy link
Contributor

AnPucel commented Oct 6, 2023

Perfect! Just being overly cautious in case.

# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@AnPucel @carnei-ro