trustedProfileId(s) is invalid when creating ibm_config_aggregator_settings

[lionelmace]

Every time I run this sample, it fails the first time on the Trusted Profile. If I run it again, it succeeds.. Weird. Is there a propagation time issue?

resource "ibm_config_aggregator_settings" "scc_wp_aggregator" {
  instance_id                 = module.app_config.app_config_guid
  # instance_id                 = ibm_resource_instance.app_config.guid
  region                      = var.region
  resource_collection_enabled = true
  resource_collection_regions = ["all"]
  trusted_profile_id          = module.trusted_profile_app_config_general.profile_id

 2025/05/21 07:45:21 Terraform apply | Error: ---
 2025/05/21 07:45:21 Terraform apply | id: terraform-afb83e56
 2025/05/21 07:45:21 Terraform apply | summary: 'ReplaceSettingsWithContext failed: trustedProfileId(s) is invalid or have
 2025/05/21 07:45:21 Terraform apply |   insufficient access.'
 2025/05/21 07:45:21 Terraform apply | severity: error
 2025/05/21 07:45:21 Terraform apply | resource: ibm_config_aggregator_settings
 2025/05/21 07:45:21 Terraform apply | operation: create
 2025/05/21 07:45:21 Terraform apply | component:
 2025/05/21 07:45:21 Terraform apply |   name: github.com/IBM-Cloud/terraform-provider-ibm
 2025/05/21 07:45:21 Terraform apply |   version: 1.78.3
 2025/05/21 07:45:21 Terraform apply | ---
 2025/05/21 07:45:21 Terraform apply | 
 2025/05/21 07:45:21 Terraform apply | 
 2025/05/21 07:45:21 Terraform apply |   with ibm_config_aggregator_settings.scc_wp_aggregator,
 2025/05/21 07:45:21 Terraform apply |   on observability-monitoring.tf line 195, in resource "ibm_config_aggregator_settings" "scc_wp_aggregator":
 2025/05/21 07:45:21 Terraform apply |  195: resource "ibm_config_aggregator_settings" "scc_wp_aggregator" {
 2025/05/21 07:45:21 Terraform apply | 
 2025/05/21 07:45:21 �[1m�[31mTerraform APPLY error: Terraform APPLY errorexit status 1�[39m�[0m
 2025/05/21 07:45:21 �[1m�[31mCould not execute job: Error : Terraform APPLY errorexit status 1�[39m�[0m

[lionelmace]

Full code available at https://github.com/lionelmace/ibm-cloud-native/blob/main/terraform/observability-monitoring.tf#L195

[lionelmace]

@ocofaigh have you faced this issue?

[ocofaigh]

@lionelmace sounds like maybe a timing issue? Perhaps the permissions are not fully synced with IAM by the time the ibm_config_aggregator_settings resource tries to use it?
We have not seen this, but are you aware that the AppConfig module now has all this support in it? So you should just use it and any issues will be on us to fix in the module. You just need to opt in using the enable_config_aggregator boolean

[lionelmace]

Great! I'll use it moving forward.

I noticed that the name and the id have the same value in the sample. Expected?

app_config_collections = [
    {
      name          = "${var.prefix}-collection",
      collection_id = "${var.prefix}-collection"
      description   = "Collection for ${var.prefix}"
    }

[ocofaigh]

@lionelmace It doesn't matter - its just a reference example. you can use any value (once ID meets criteria mentioned below):

Also collections are used for feature flagging - not needed for workload protection / config aggregator functionality

[lionelmace]

I now use the module and I don't face this issue any more. Thanks for letting me know about the full support in the module.

module "app_config" {
  source = "terraform-ibm-modules/app-configuration/ibm"
  # version           = "1.3.0"
  region                                 = var.region
  resource_group_id                      = ibm_resource_group.group.id
  app_config_name                        = format("%s-%s", local.basename, "app-configuration")
  app_config_tags                        = var.tags
  enable_config_aggregator               = true # See https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-configuration-aggregator
  app_config_plan                        = "standardv2"
  config_aggregator_trusted_profile_name = format("%s-%s", local.basename, "config-aggregator-trusted-profile")
}