Firewall one of source_tags, source_ranges, or source_service_accounts must be defined

[nicaura]

What happened?

Setting a firewall rule

new gcp.compute.Firewall("firewall-vm", {
  network: "default",
  allows: [
    {
      ports: ["8181"],
      protocol: "tcp",
    },
  ],
  targetTags: ["mytag"],
}),

used to work perfectly but now throws :

     Type                     Name                  Plan       Info
     pulumi:pulumi:Stack      gcp-us                                1 error
 +   └─ gcp:compute:Firewall  firewall-vm  create     1 error

Diagnostics:
  gcp:compute:Firewall (firewall-vm):
    error: Preview failed: diffing urn:pulumi:prod::gcp-us::gcp:compute/firewall:Firewall::firewall-vm: 1 error occurred:
    	* one of source_tags, source_ranges, or source_service_accounts must be defined

  pulumi:pulumi:Stack (gcp-us):
    error: preview failed

Adding sourceRanges: ["0.0.0.0/0"] fixes the issue.

Steps to reproduce

Create a firewall rule as such :

new gcp.compute.Firewall("firewall-vm", {
  network: "default",
  allows: [
    {
      ports: ["8181"],
      protocol: "tcp",
    },
  ],
  targetTags: ["mytag"],
}),

Expected Behavior

The rule to be created.

Actual Behavior

Firewall rule now seems to require additional attributes :

one of source_tags, source_ranges, or source_service_accounts must be defined

Output of pulumi about

No response

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[mikhailshilkov]

My guess is that this is by design. Here is the upstream check that triggers it: https://github.com/hashicorp/terraform-provider-google/blob/16a2ae286181d3fc43834166d3428fd1d0a53562/google/resource_compute_firewall.go#L93-L95

If you let me know which exact version broke you, I can try to look up the PR that may be the cause. Off the top of my head it could be hashicorp/terraform-provider-google#10668