google_firebase_app_check_debug_token: The debug_token.token should be a UUID4

[josh-burton]

Question

When trying to create an google_firebase_app_check_debug_token resource, I'm receiving an error The debug_token.token should be a UUID4.

This is using the random_uuid resource shown as an example here: #17095

hcl```
resource "random_uuid" "debug_token" {}

resource "google_firebase_app_check_debug_token" "android" {
provider = google-beta

project = google_project.gcp_project.project_id
app_id = google_firebase_android_app.firebase_android_app.app_id
display_name = "Debug Token"
token = random_uuid.debug_token.output

depends_on = [time_sleep.firebase_android_app_wait_30s]
}

It seems that the uuid generated by random_uuid is not compatible with firebase/appcheck.

How can I generate a compatible uuid? Could the google provider expose a uuid function with the new provider functions in terraform 1.8?

[rainshen49]

It looks like the random_uuid resource isn't RFC 4122 compliant https://github.com/hashicorp/go-uuid. Digging through the spec a bit, I think the only difference is a few key characters. Aka. you should be able to arrive at a valid UUID4 this way

locals {
  uuid4 = "${
    substr(random_uuid.debug_token.result, 0, 13)}-4${
    substr(random_uuid.debug_token.result, 15, 3)}-9${
  substr(random_uuid.debug_token.result, 20, 16)}"
}

resource "google_firebase_app_check_debug_token" "android" {
  ...
  token        = local.uuid4
}

Obviously, you can see that this is a hack and is probably only fine for debug token since it's for testing purposes. Although it's not hard for Google to provide a uuid4 generator, I see there's an existing discussion on Terraform hashicorp/terraform-provider-random#402. IMO Terraform should implement such a function since it's a widely used standard, not Google specific. I'll bring this feedback to that thread. Meanwhile, I hope the above 'hack" works for your use case.

[josh-burton]

It looks like the random_uuid resource isn't RFC 4122 compliant hashicorp/go-uuid. Digging through the spec a bit, I think the only difference is a few key characters. Aka. you should be able to arrive at a valid UUID4 this way

locals {
  uuid4 = "${
    substr(random_uuid.debug_token.result, 0, 13)}-4${
    substr(random_uuid.debug_token.result, 15, 3)}-9${
  substr(random_uuid.debug_token.result, 20, 16)}"
}

resource "google_firebase_app_check_debug_token" "android" {
  ...
  token        = local.uuid4
}

Obviously, you can see that this is a hack and is probably only fine for debug token since it's for testing purposes. Although it's not hard for Google to provide a uuid4 generator, I see there's an existing discussion on Terraform hashicorp/terraform-provider-random#402. IMO Terraform should implement such a function since it's a widely used standard, not Google specific. I'll bring this feedback to that thread. Meanwhile, I hope the above 'hack" works for your use case.

Thank you for that fix. It works perfectly!