[Question] cloudfoundry_service_credential_binding datasource is fetching wrong ID. #206

[yeborisov]

Hi @yeborisov ,
From the provider version 1.2.0, we are supporting fetching the parameters passed during the creation of the service credential binding which was not present in 1.1.0. The output that you are seeing is just a warning and not an error as fetching the parameters for the binding is not supported by that particular service. Hence it can safely ignored since no parameters are passed during the creation of the resource binding.

Originally posted by @Dray56 in #206

@Dray56 Could you please provide me with example how to obtain the data from the admin-key?

[yeborisov]

@Dray56 The ID which is passed to v3/service_credential_bindings/2a00a2b9-00ca-4c34-aa07-8386ef31c641/parameters is the terraform object one not the service instance and the binding is supported as I successfully obtain the data by using the correct ID. This is a bug from my perspective so please share how is possible to obtain the data from this credential binding key in CF?

[yeborisov]

@Dray56 Could you please provide me an example how service_credential_bindings data can be obtained if there is a new approach? Thanks

[Dray56]

Hi @yeborisov,

The data source is working properly as expected and you should find no issues in accessing its attributes even with the warning being shown. For example if you want to output the credential details of the binding you can reference the below snippet assuming you got atleast one binding as output of the data source.

resource "cloudfoundry_service_credential_binding" "admin-key" {
  type             = "key"
  name             = "admin-key"
  service_instance = data.cloudfoundry_service_instance.admin-api.id
}

data "cloudfoundry_service_credential_binding" "admin-key" {
  name             = cloudfoundry_service_credential_binding.admin-key.name
  service_instance = data.cloudfoundry_service_instance.admin-api.id
}

output "binding_details" {
  value = jsondecode(data.cloudfoundry_service_credential_binding.admin-key.credential_bindings[0].credential_binding)
  sensitive = true
}

As for your doubt regarding the ID(2a00a2b9-00ca-4c34-aa07-8386ef31c641) - it is the GUID from the CloudFoundry for the service_credential_binding resource you have created and not the service instance linked to it. Since, we are trying to fetch details of the service_credential_binding parameters used during the creation of the binding, we need to hit that particular endpoint with the binding ID.

[yeborisov]

Thanks @Dray56
So if I understand correctly the data "cloudfoundry_service_credential_binding" "admin-key" will output a warning because is using the GUID which is the ID(2a00a2b9-00ca-4c34-aa07-8386ef31c641) and does not support fetching?
In ClouFoundry I do not have such ID. The ID is 4a3dac77-0f77-4baf-9411-3634a7cd57a0 with which is working correctly. I am not aware this ID from where is coming and my thinking is that this is the terraform object ID:

terraform state show module.custom.cloudfoundry_service_credential_binding.admin-key
# module.custom.cloudfoundry_service_credential_binding.admin-key:
resource "cloudfoundry_service_credential_binding" "admin-key" {
    created_at       = "2025-05-07T14:50:37Z"
    id               = "2a00a2b9-00ca-4c34-aa07-8386ef31c641"
    last_operation   = {
        created_at  = "2025-05-07T14:50:39Z"
        description = ""
        state       = "succeeded"
        type        = "create"
        updated_at  = "2025-05-07T14:50:39Z"
    }
    name             = "admin-key"
    service_instance = "4a3dac77-0f77-4baf-9411-3634a7cd57a0"
    type             = "key"
    updated_at       = "2025-05-07T14:50:39Z"
}

where you can see

id               = "2a00a2b9-00ca-4c34-aa07-8386ef31c641"

vs

    service_instance = "4a3dac77-0f77-4baf-9411-3634a7cd57a0"

and again this ID 2a00a2b9-00ca-4c34-aa07-8386ef31c641 is not related to any CloudFoundry object, entity etc.

So @Dray56 please tell me how to obtain the data source using the correct GUID in CloudFoundry.

Thanks in advance

[Dray56]

Hi @yeborisov,

There is a confusion persisting on how CloudFoundry works.

Every resource in Cloudfoundry has a unique GUID(aka ID). That's how CloudFoundry is designed. Please refer documentation for details.

Here we are dealing with 2 different resources:

• Service instance: A service instance is the actual instance of a service based on the service plan and confuguration that you have made. This is identified with a Service Instance GUID. You can get this instance id in CF CLI by running cf service SERVICE_INSTANCE_NAME --guid

• Service Credential Binding: A service credential binding is used to make the details of the connection to a service instance available to an app or a developer. This service-credential-binding gets its own GUID. You can get this binding id in CF CLI by running cf service-key SERVICE_INSTANCE_NAME SERVICE_KEY_NAME --guid

Please Note: The service-credential-binding GUID is NOT the same as Service Instance GUID

For creating the Service Credential Binding, the service instance GUID is required.

In your setup:-

• Your Service Instance ID is 4a3dac77-0f77-4baf-9411-3634a7cd57a0
• Your Service Credential Binding ID is: 2a00a2b9-00ca-4c34-aa07-8386ef31c641

This is NOT generated by terraform but by CloudFoundry

For creating the Service Credential Binding, you are passing in the service_instance ID - 4a3dac77-0f77-4baf-9411-3634a7cd57a0 and once the service Credential Binding resource is created in Cloudfoundry, it gets its own unique GUID - 2a00a2b9-00ca-4c34-aa07-8386ef31c641 that is different from the existing service instance GUID.

Now to fetch the finer details of the parameters passed during the creation of the service credential binding and the credential details of the Service Credential Binding, the cloudfoundry_service_credential_binding data source is used here as the attributes parameters and credential_binding are not present as part of the cloudfoundry_service_credential_binding resource.

The warning that you are encountering is because of this particular reason - The broker catalog must have enabled the bindings_retrievable feature for the Service Offering. Since the broker does not support fetching the parameters for the credential binding, the API call is failing and we are not able to populate anything in the parameters attribute. It is not because of any invalid GUID.

Hope there is greater clarity now.

[yeborisov]

Thanks @Dray56 for the clarification.
My confusion is coming from how the API works. By passing to it the service instance ID it worked when I use curl and the API.
Here is the documentation which I refer to - https://v3-apidocs.cloudfoundry.org/version/3.154.0/index.html#get-parameters-for-a-service-credential-binding
My goal is when the service credential binding is created to obtain it after regarding fetching details from it.
With version 1.1.0 is working as expected but with later versions of the provider is not and showing a warning message.
I though it could be related to the following PR but of course I may be wrong.