google_bigquery_table not setting expiration_time when KMS key is required but omitted, and not correcly handling the default key

[ti8m-sil]

Community Note

We created a table in a dataset with a default expiration time. We then decided that the table should not expire, so we removed the expiration_time from Terraform by setting it to 0. Now on every apply, we see that the plan is to set the expiration_time to 0, but it is not applied - the default expiration time stays. We even tried to delete the table from the console and then let terraform recreate it, but it just sets the expiration_time to the default again. We then found that it worked when we set the kms key on the table - which shouldn't be needed since there is a default on the dataset.

Terraform Version & Provider Version(s)

Terraform v1.14.3
on arm64

• provider registry.terraform.io/hashicorp/google v7.20.0
• provider registry.terraform.io/hashicorp/google-beta v7.20.0

Affected Resource(s)

google_bigquery_table

Terraform Configuration

resource "google_bigquery_dataset" "mydataset" {
  dataset_id = "mydataset"
  project    = var.project_id
  location   = var.region
  default_table_expiration_ms = 3600000 * 24 * 7 # 7 days
  default_encryption_configuration {
    kms_key_name = data.google_kms_crypto_key.mykey.id
  }
  labels = var.labels
}

resource "google_bigquery_table" "mytable" {
  dataset_id = google_bigquery_dataset.mydataset.dataset_id
  expiration_time = 0
  time_partitioning {
    type          = "DAY"
    expiration_ms = 7 * 24 * 60 * 60 * 1000
  }
  table_id = "mytable"
  deletion_protection = false
  schema = file("myschema.bqschema.json")
  clustering = [
    "A",
    "B"
  ]
}```


### Debug Output

Relevant section from terraform apply, with some anonymization:
-/+ resource "google_bigquery_table" "mytable" {
      ~ creation_time                = 1771580771857 -> (known after apply)
      ~ etag                         = "alOjsseOzlXE8KjR00B8Gw==" -> (known after apply)
      + generated_schema_columns     = (known after apply)
      ~ id                           = "projects/myproject/datasets/mydataset/tables/mytable" -> (known after apply)
      - labels                       = {} -> null
      ~ last_modified_time           = 1771580771947 -> (known after apply)
      ~ location                     = "mylocation" -> (known after apply)
      + max_staleness                = (known after apply)
      ~ num_bytes                    = 0 -> (known after apply)
      ~ num_long_term_bytes          = 0 -> (known after apply)
      ~ num_rows                     = 0 -> (known after apply)
      - require_partition_filter     = false -> null
      - resource_tags                = {} -> null
      ~ self_link                    = "https://bigquery.googleapis.com/bigquery/v2/projects/myproject/datasets/mydataset/tables/mytable" -> (known after apply)
      ~ type                         = "TABLE" -> (known after apply)
        # (12 unchanged attributes hidden)

      - encryption_configuration { # forces replacement
          - kms_key_name    = "projects/myproject/locations/mylocation/keyRings/mykeyring/cryptoKeys/mykey" -> null
            # (1 unchanged attribute hidden)
        }

      ~ time_partitioning {
          - require_partition_filter = false -> null
            # (3 unchanged attributes hidden)
        }
    }


### Expected Behavior

The expiration_time should be set to 0, no recreate needed

### Actual Behavior

Table is recreated with the default expiration_time instead of 0

### Steps to reproduce

1. `terraform apply`
2. `terraform apply` again

### Important Factoids

_No response_

### References

_No response_

[ti8m-sil]

I guess the issue is due to the recreate because of the "missing" KMS key.

[ggtisc]

Hi @ti8m-sil

In your earlier code, your dataset has a default expiration set:
default_table_expiration_ms = 3600000 * 24 * 7 # 7 days

Because of this, any table created inside that dataset will automatically inherit that 7-day lifespan. You must configure both in the same range (0 or 3600000 * 24 * 7)