Skip to main content
Type '/' to Search

Debug a Terraform Provider

In this tutorial, you will add custom error messages to a Terraform provider that interacts with the API of a fictional coffee-shop application called Hashicups and view detailed Terraform provider logs.

»Prerequisites

To follow this tutorial, you need:

Navigate to your terraform-provider-hashicups directory. Next, fetch new changes.

$ git fetch

$ git fetch

Then, checkout the implement-complex-read branch. This step is optional but recommended to ensure that your code matches the code from the previous tutorials.

$ git checkout implement-complex-read

$ git checkout implement-complex-read

Your directory should have the following structure.

$ tree -L 2
.
├── Makefile
├── README.md
├── docker_compose
│   ├── conf.json
│   └── docker-compose.yml
├── examples
│   ├── coffee
│   ├── main.tf
├── go.mod
├── go.sum
├── hashicups
│   ├── data_source_coffee.go
│   └── provider.go
├── main.go
└── vendor

$ tree -L 2
.
├── Makefile
├── README.md
├── docker_compose
│   ├── conf.json
│   └── docker-compose.yml
├── examples
│   ├── coffee
│   ├── main.tf
├── go.mod
├── go.sum
├── hashicups
│   ├── data_source_coffee.go
│   └── provider.go
├── main.go
└── vendor

If you're stuck at any point during this tutorial, refer to the debug-tf-providers branch to see the changes implemented in this tutorial.

»Update error messages

In your hashicups/provider.go file, the providerConfigure function returns an interface{} and a diag.Diagnostics type. diag.Diagnostics can return multiple errors and warnings to Terraform, giving users more robust error and warning messages.

func providerConfigure(...) (interface{}, diag.Diagnostics) {
  ...
}
hashicups/provider.go
func providerConfigure(...) (interface{}, diag.Diagnostics) {
  ...
}

The diag.FromError() function casts standard Go errors to diag.Diagnostics type notifying the user whenever the provider errors.

Replace the return nil, diag.FromError(err) line in your providerConfigure function with the following code snippet. There should be two replacements — one where the user's HashiCups credentials provided and the other where its not. Notice how this appends a diag.Diagnostic type to the existing diags variable; this allows your provider to return multiple error message. This will produce an error message containing Summary and Detail contents.

diags = append(diags, diag.Diagnostic{
  Severity: diag.Error,
  Summary:  "Unable to create HashiCups client",
  Detail:   "Unable to auth user for authenticated HashiCups client",
})

return nil, diags
hashicups/provider.go
diags = append(diags, diag.Diagnostic{
  Severity: diag.Error,
  Summary:  "Unable to create HashiCups client",
  Detail:   "Unable to auth user for authenticated HashiCups client",
})

return nil, diags

Your providerConfigure function should look like the following.

func providerConfigure(ctx context.Context, d *schema.ResourceData) (interface{}, diag.Diagnostics) {
  username := d.Get("username").(string)
  password := d.Get("password").(string)

  // Warning or errors can be collected in a slice type
  var diags diag.Diagnostics

  if (username != "") && (password != "") {
    c, err := hashicups.NewClient(nil, &username, &password)
    if err != nil {
      diags = append(diags, diag.Diagnostic{
        Severity: diag.Error,
        Summary:  "Unable to create HashiCups client",
        Detail:   "Unable to auth user for authenticated HashiCups client",
      })
      return nil, diags
    }

    return c, diags
  }

  c, err := hashicups.NewClient(nil, nil, nil)
  if err != nil {
    diags = append(diags, diag.Diagnostic{
      Severity: diag.Error,
      Summary:  "Unable to create HashiCups client",
      Detail:   "Unable to auth user for unauthenticated HashiCups client",
    })
    return nil, diags
  }

  return c, diags
}
hashicups/provider.go
func providerConfigure(ctx context.Context, d *schema.ResourceData) (interface{}, diag.Diagnostics) {
  username := d.Get("username").(string)
  password := d.Get("password").(string)

  // Warning or errors can be collected in a slice type
  var diags diag.Diagnostics

  if (username != "") && (password != "") {
    c, err := hashicups.NewClient(nil, &username, &password)
    if err != nil {
      diags = append(diags, diag.Diagnostic{
        Severity: diag.Error,
        Summary:  "Unable to create HashiCups client",
        Detail:   "Unable to auth user for authenticated HashiCups client",
      })
      return nil, diags
    }

    return c, diags
  }

  c, err := hashicups.NewClient(nil, nil, nil)
  if err != nil {
    diags = append(diags, diag.Diagnostic{
      Severity: diag.Error,
      Summary:  "Unable to create HashiCups client",
      Detail:   "Unable to auth user for unauthenticated HashiCups client",
    })
    return nil, diags
  }

  return c, diags
}

Format your code.

$ go fmt ./...

$ go fmt ./...

Notice how the Diagnostic severity is set to diag.Error. There are two levels of severity — diag.Error and diag.Warning. You will create and view a warning message in the next section.

»Test error message

Now that you've added a custom error message, verify that the provider returns your error message.

First, confirm that you are in the terraform-provider-hashicups root directory.

$ pwd
~/terraform-provider-hashicups

$ pwd
~/terraform-provider-hashicups

Next, build the binary and move it into your user Terraform plugins directory. This allows you to sideload and test the custom provider. Select the tab for your operating system for specific instructions.

$ make install
go build -o terraform-provider-hashicups
mv terraform-provider-hashicups ~/.terraform.d/plugins/hashicorp.com/edu/hashicups/0.2/darwin_amd64

$ make install
go build -o terraform-provider-hashicups
mv terraform-provider-hashicups ~/.terraform.d/plugins/hashicorp.com/edu/hashicups/0.2/darwin_amd64

Tip: The Perform CRUD operations with Providers tutorial explains why and how to sideload custom providers. Refer to it to learn more about where to install custom providers and how to reference them in your configuration.

Navigate to the terraform-provider-hashicups/examples directory. This contains a sample Terraform configuration for the Terraform HashiCups provider.

$ cd examples

$ cd examples

Update your HashiCups provider configuration so it uses the wrong credentials.

provider "hashicups" {
  username = "education"
  password = "test1234"
}
examples/main.tf
provider "hashicups" {
  username = "education"
  password = "test1234"
}

Next, initialize your workspace to refresh your HashiCups provider, then apply. This should return the error message you defined above.

$ terraform init && terraform apply --auto-approve
## ...
module.psl.data.hashicups_coffees.all: Refreshing state...

Error: Unable to create HashiCups client

Unable to auth user for authenticated HashiCups client

$ terraform init && terraform apply --auto-approve
## ...
module.psl.data.hashicups_coffees.all: Refreshing state...

Error: Unable to create HashiCups client

Unable to auth user for authenticated HashiCups client

Because your provider errors, your Terraform state doesn't update when you ran the terraform apply.

»Add warning message

Add the following snippet after diags is declared in providerConfigure function.

diags = append(diags, diag.Diagnostic{
  Severity: diag.Warning,
  Summary:  "Warning Message Summary",
  Detail:   "This is the detailed warning message from providerConfigure",
})
hashicups/provider.go
diags = append(diags, diag.Diagnostic{
  Severity: diag.Warning,
  Summary:  "Warning Message Summary",
  Detail:   "This is the detailed warning message from providerConfigure",
})

Your providerConfigure function should look like the following.

func providerConfigure(ctx context.Context, d *schema.ResourceData) (interface{}, diag.Diagnostics) {
  ...

  // Warning or errors can be collected in a slice type
  var diags diag.Diagnostics

  diags = append(diags, diag.Diagnostic{
    Severity: diag.Warning,
    Summary:  "Warning Message Summary",
    Detail:   "This is the detailed warning message from providerConfigure",
  })

  ...
}
hashicups/provider.go
func providerConfigure(ctx context.Context, d *schema.ResourceData) (interface{}, diag.Diagnostics) {
  ...

  // Warning or errors can be collected in a slice type
  var diags diag.Diagnostics

  diags = append(diags, diag.Diagnostic{
    Severity: diag.Warning,
    Summary:  "Warning Message Summary",
    Detail:   "This is the detailed warning message from providerConfigure",
  })

  ...
}

Format your code.

$ go fmt ./...

$ go fmt ./...

Notice that you have set the Diagnostic's severity to diag.Warning. When you use your provider, both warning and messages appear because diags contains both. A warning message will only appear when the provider also errors.

The Diagnostic's detail contains additional information about the warning message, including which function it was triggered in. This could provide handy while debugging.

»Test warning message

Now that you've added a warning message and updated your Terraform log level, verify that the provider returns both your warning and error message.

First, confirm that you are in the terraform-provider-hashicups root directory.

$ pwd
~/terraform-provider-hashicups

$ pwd
~/terraform-provider-hashicups

Next, build the binary and move it into your user Terraform plugins directory. This allows you to sideload and test the custom provider. Select the tab for your operating system for specific instructions.

$ make install
go build -o terraform-provider-hashicups
mv terraform-provider-hashicups ~/.terraform.d/plugins/hashicorp.com/edu/hashicups/0.2/darwin_amd64

$ make install
go build -o terraform-provider-hashicups
mv terraform-provider-hashicups ~/.terraform.d/plugins/hashicorp.com/edu/hashicups/0.2/darwin_amd64

Tip: The Perform CRUD operations with Providers tutorial explains why and how to sideload custom providers. Refer to it to learn more about where to install custom providers and how to reference them in your configuration.

Navigate to the terraform-provider-hashicups/examples directory. This contains a sample Terraform configuration for the Terraform HashiCups provider.

$ cd examples

$ cd examples

Next, initialize your workspace to refresh your HashiCups provider, then apply. This should return both a warning and error message.

$ terraform init && terraform apply --auto-approve
## ...
module.psl.data.hashicups_coffees.all: Refreshing state...

Warning: Warning Message Summary

This is the detailed warning message from providerConfigure


Error: Unable to create HashiCups client

Unable to authenticate user for authenticated HashiCups client

$ terraform init && terraform apply --auto-approve
## ...
module.psl.data.hashicups_coffees.all: Refreshing state...

Warning: Warning Message Summary

This is the detailed warning message from providerConfigure


Error: Unable to create HashiCups client

Unable to authenticate user for authenticated HashiCups client

Because your provider errors, your Terraform state doesn't update when you ran the terraform apply.

»Fix provider

Comment out or remove the warning message, then recompile your Terraform provider.

func providerConfigure(ctx context.Context, d *schema.ResourceData) (interface{}, diag.Diagnostics) {
  ...

  // Warning or errors can be collected in a slice type
  var diags diag.Diagnostics

  diags = append(diags, diag.Diagnostic{
    Severity: diag.Warning,
    Summary:  "Warning Message Summary",
    Detail:   "This is the detailed warning message from providerConfigure",
  })

  ...
}
hashicups/provider.go
func providerConfigure(ctx context.Context, d *schema.ResourceData) (interface{}, diag.Diagnostics) {
  ...

  // Warning or errors can be collected in a slice type
  var diags diag.Diagnostics

  diags = append(diags, diag.Diagnostic{
    Severity: diag.Warning,
    Summary:  "Warning Message Summary",
    Detail:   "This is the detailed warning message from providerConfigure",
  })

  ...
}

Fix your Terraform configuration to use the correct credentials.

provider "hashicups" {
  username = "education"
  password = "test123"
}
examples/main.tf
provider "hashicups" {
  username = "education"
  password = "test123"
}

Finally, re-initializing your workspace and applying the configuration.

$ terraform init && terraform apply --auto-approve
Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

$ terraform init && terraform apply --auto-approve
Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

There should be no errors or warning messages.

Tip: You can also retrieve detailed Terraform and provider logs by setting the environment variable TF_LOG. Please include a detailed logs with any bug reports so the author can identify and address the bug. To learn more about log levels and how to interpret a crash log, refer to the Debugging Terraform Documentation.

»Next steps

In this tutorial, you added error and warning messages to your HashiCups provider and implemented a nested read function.

If you were stuck during this tutorial, checkout the debug-tf-providers branch to see the changes implemented in this tutorial.

stdin: is not a tty