New resource: `google_cloud_trace_sink` (beta) by DrFaust92 · Pull Request #18330 · GoogleCloudPlatform/magic-modules

DrFaust92 · 2026-07-19T22:26:55Z

Adds a new CloudTrace product and a beta google_cloud_trace_sink resource for exporting traces to a BigQuery dataset via the Cloud Trace v2beta1 projects.traceSinks API.

Fixes hashicorp/terraform-provider-google#23579 (the trace-sink half — google_observability_trace_scope already covers trace scopes).

Revives and finishes the abandoned work from #14074, whose approach never worked against the live API for the reason described below.

Note for reviewers: the API addresses sinks by project number

The Cloud Trace API identifies a sink by its canonical resource name, which references the project by its project number, not its project ID. Confirmed empirically against the live API, the number is required in three places:

Create — the name in the request body and the BigQuery destination must both use the project number (the create URL accepts the ID).
Read / Update / Delete — the resource URL must use the project number (GET .../projects/{id}/traceSinks/{sink} → 400; .../projects/{number}/... → 200).

Rather than resolve the number via a cross-API Resource Manager lookup, the project field is supplied as the project number, keeping the resource within a single API boundary:

self_link / id_format / import_format all expand to projects/{{project}}/traceSinks/{{sink_id}}, so read/update/delete hit the number-form URL and import uses the stock generated path.
The encoder builds the canonical name the create body requires from project + sink_id (no cross-API call).
The requirement that project and the BigQuery destination reference the project by number is documented, and the example builds both from data.google_project.project.number.

Testing

Acceptance tests pass against a real project (beta provider):

--- PASS: TestAccCloudTraceSink_cloudTraceSinkBasicExample
--- PASS: TestAccCloudTraceSink_update

TestAccCloudTraceSink_update covers create → import → update destination → import.

Release Note

`google_cloud_trace_sink` (beta)

google-cla · 2026-07-19T22:27:18Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

github-actions · 2026-07-19T22:27:18Z

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@slevenick, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

slevenick · 2026-07-21T19:39:05Z

@@ -0,0 +1,21 @@
+# Copyright 2025 Google Inc.


slevenick · 2026-07-21T19:39:16Z

@@ -0,0 +1,92 @@
+# Copyright 2025 Google Inc.


slevenick · 2026-07-21T19:39:50Z

+create_url: projects/{{project}}/traceSinks
+update_verb: PATCH
+update_mask: true
+id_format: '{{name}}'


I think this should match the import_format

slevenick · 2026-07-21T19:40:11Z

+  api: 'https://cloud.google.com/trace/docs/reference/rest/v2beta1/projects.traceSinks'
+min_version: beta
+base_url: projects/{{project}}/traceSinks
+self_link: '{{name}}'


Prefer expanded name

slevenick · 2026-07-21T19:41:03Z

+}
+d.SetId(d.Get("name").(string))
+
+// The import id carries the project number, but the project field is normally


Prefer not doing this conversion

slevenick · 2026-07-21T19:41:39Z

@@ -0,0 +1,34 @@
+// The Cloud Trace API requires the sink's canonical resource name in the request


Prefer not doing this conversion

It messes with quota and cross-API boundaries in a way that's not pleasant to deal with

github-actions · 2026-07-28T10:29:44Z

@slevenick This PR has been waiting for review for 3 weekdays. Please take a look! Use the label disable-review-reminders to disable these notifications.

modular-magician · 2026-07-28T21:08:10Z

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 01f710b:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
`google` provider	View Diff	2 files changed, 186 insertions(+)
`google-beta` provider	View Diff	13 files changed, 1366 insertions(+)
`terraform-google-conversion`	View Diff	1 file changed, 161 insertions(+)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
6866	6149	706	11

Affected Service Packages

All service packages are affected

Learn how VCR tests work

Step 1: Replaying Mode

Action taken

Found 11 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

TestAccCloudTraceSink_cloudTraceSinkBasicExample
TestAccCloudTraceSink_update
TestAccComputeInstanceFromMachineImage_diffProject
TestAccComputeRouterPeer_AddMd5AuthenticationKey
TestAccComputeSecurityPolicy_withPreconfiguredWafConfig
TestAccContainerCluster_regionalWithNodePool
TestAccDataformConfig_update
TestAccDataprocMetastoreService_dataprocMetastoreServicePrivateServiceConnectExample
TestAccDiscoveryEngineDataStore_discoveryengineDatastoreKmsKeyNameExample
TestAccManagedKafkaConnector_managedkafkaConnectorBasicExample
TestAccPubsubSubscription_pubsubSubscriptionTagsExample

View the replaying VCR build log

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
✅ Log	✅	TestAccCloudTraceSink_cloudTraceSinkBasicExample
✅ Log	✅	TestAccCloudTraceSink_update
✅ Log	✅	TestAccComputeRouterPeer_AddMd5AuthenticationKey
❌ Error · Log	-	TestAccComputeInstanceFromMachineImage_diffProject
❌ Error · Log	-	TestAccComputeSecurityPolicy_withPreconfiguredWafConfig
❌ Error · Log	-	TestAccContainerCluster_regionalWithNodePool
❌ Error · Log	-	TestAccDataformConfig_update
❌ Error · Log	-	TestAccDataprocMetastoreService_dataprocMetastoreServicePrivateServiceConnectExample
❌ Error · Log	-	TestAccDiscoveryEngineDataStore_discoveryengineDatastoreKmsKeyNameExample
❌ Error · Log	-	TestAccManagedKafkaConnector_managedkafkaConnectorBasicExample
❌ Error · Log	-	TestAccPubsubSubscription_pubsubSubscriptionTagsExample

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@DrFaust92, @slevenick VCR tests complete for 01f710b!

github-actions · 2026-07-30T10:28:23Z

@GoogleCloudPlatform/terraform-team @slevenick This PR has been waiting for review for 1 week. Please take a look! Use the label disable-review-reminders to disable these notifications.

DrFaust92 · 2026-08-04T22:11:49Z

Rebased on latest main and re-ran CI — the earlier teamcity-services-diff-check/VCR-test failures were from a stale base (12 days behind), the diff-check was flagging unrelated GA services.

Review feedback is addressed:

Dropped the Resource Manager project-number conversion in the encoder and removed the custom import (the cross-API/quota concern). project is now supplied as the project number directly, keeping the resource in a single API boundary.
self_link/id_format use the expanded name and match import_format.
Copyright year fixed.

The remaining encoder just assembles name from project + sink_id for the create body (the Trace API requires the canonical name in-body). Happy to adjust further if you'd prefer a different approach there.

github-actions · 2026-08-06T10:30:47Z

@GoogleCloudPlatform/terraform-team @slevenick This PR has been waiting for review for 2 weeks. Please take a look! Use the label disable-review-reminders to disable these notifications.

modular-magician · 2026-08-06T19:07:40Z

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit abb2a42:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
`google` provider	View Diff	2 files changed, 186 insertions(+)
`google-beta` provider	View Diff	13 files changed, 1366 insertions(+)
`terraform-google-conversion`	View Diff	1 file changed, 161 insertions(+)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
6886	6183	694	9

Affected Service Packages

All service packages are affected

Learn how VCR tests work

Step 1: Replaying Mode

Action taken

Found 9 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

TestAccComputeInstanceFromMachineImage_diffProject
TestAccComputeRouterPeer_UpdateMd5AuthenticationKey
TestAccComputeSecurityPolicy_withPreconfiguredWafConfig
TestAccDataprocMetastoreService_dataprocMetastoreServicePrivateServiceConnectExample
TestAccDiscoveryEngineDataStore_discoveryengineDatastoreKmsKeyNameExample
TestAccManagedKafkaConnector_managedkafkaConnectorBasicExample
TestAccProjectIamMemberRemove_memberInMultipleBindings
TestAccPubsubSubscription_pubsubSubscriptionTagsExample
TestAccVertexAIFeatureOnlineStoreFeatureview_vertexAiFeatureonlinestoreFeatureview_featureRegistry_updated

View the replaying VCR build log

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
✅ Log	✅	TestAccProjectIamMemberRemove_memberInMultipleBindings
✅ Log	❌ Error · Log	TestAccComputeRouterPeer_UpdateMd5AuthenticationKey
❌ Error · Log	-	TestAccComputeInstanceFromMachineImage_diffProject
❌ Error · Log	-	TestAccComputeSecurityPolicy_withPreconfiguredWafConfig
❌ Error · Log	-	TestAccDataprocMetastoreService_dataprocMetastoreServicePrivateServiceConnectExample
❌ Error · Log	-	TestAccDiscoveryEngineDataStore_discoveryengineDatastoreKmsKeyNameExample
❌ Error · Log	-	TestAccManagedKafkaConnector_managedkafkaConnectorBasicExample
❌ Error · Log	-	TestAccPubsubSubscription_pubsubSubscriptionTagsExample
❌ Error · Log	-	TestAccVertexAIFeatureOnlineStoreFeatureview_vertexAiFeatureonlinestoreFeatureview_featureRegistry_updated

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

🔴 Replaying Rerun Failed: Some tests failed due to non-determinism when VCR replayed the response. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@DrFaust92, @slevenick VCR tests complete for abb2a42!

Adds the Cloud Trace product and a `google_cloud_trace_sink` beta resource for exporting traces to BigQuery via the v2beta1 `projects.traceSinks` API. The Cloud Trace API identifies a sink by its canonical resource name, which references the project by its project *number* (not ID) and is required in the create body, the BigQuery `destination`, and the read/update/delete URLs. The resource resolves the project number in an encoder, keys off the server-returned canonical name (`self_link: '{{name}}'`), and normalizes `project` back to the ID on import. Revives the work from GoogleCloudPlatform#14074 and closes the trace-sink half of hashicorp/terraform-provider-google#23579.

Rework google_cloud_trace_sink per review feedback: - self_link/id_format use the expanded name and match import_format - drop the Resource Manager ID->number conversion in the encoder and the custom import; the project field is now supplied as the project number, keeping the resource within a single API boundary - fix copyright year

DrFaust92 · 2026-08-08T22:31:55Z

Rebased onto latest main (5088fbd) — the history is now two clean commits, no merge commits.

All six review comments from the 2026-07-21 pass are addressed:

self_link / id_format use the expanded name and match import_format
custom import removed, and the Resource Manager ID→number conversion is gone from the encoder — project is supplied as the project number directly, so the resource stays within a single API boundary. The remaining encoder just assembles name from project + sink_id for the create body, which the Trace API requires.
copyright year fixed in both files

The two red checks are pre-existing, not from this PR

teamcity-services-diff-check fails on the GA side with:

Provider codebase is missing services present in the TeamCity service file:
[apigateway firebase firebaseailogic firebasedatabase firebaseextensions
 firebasehosting runtimeconfig saasruntime securityscanner tpuv2]

cloudtrace isn't in that list. The identical mismatch appears on #18566 (run 31218344169), which is unrelated to this change — the generated GA provider is missing service packages that services_ga.kt legitimately declares.

Worth flagging: the -version=ga invocation exits 1 before the -version=beta one runs, so the beta check never executes and services_beta.kt is effectively unvalidated by CI on any PR that hits this. I verified the cloudtrace entry by hand — correct format, alphabetical between cloudtasks and colab, path ./google-beta/services/cloudtrace.

VCR-test — the nine failures are compute, dataproc-metastore, discoveryengine, managedkafka, pubsub and vertexai, plus a non-determinism rerun on TestAccComputeRouterPeer_UpdateMd5AuthenticationKey. None are cloudtrace. Both TestAccCloudTraceSink_cloudTraceSinkBasicExample and TestAccCloudTraceSink_update passed recording and replay in the earlier run (c920396f). Adding a new product touches provider.go, so VCR marks all service packages affected and pulls in the ambient flakes.

One open question

Taking project as a project number keeps us in a single API boundary as you asked, but it does cut against the standard project semantics — it's normally optional, inherits from the provider block, and flows through tpgresource.GetProject. A user who omits it gets the provider's project (almost always an ID) and every create/read/delete 400s without much explaining why. It's documented on the resource and the example builds it from data.google_project.project.number.

Would you prefer a validation on the field to reject non-numeric input with a clear message, or is the doc note enough?

modular-magician added the awaiting-approval Pull requests that need reviewer's approval to run presubmit tests label Jul 19, 2026

github-actions Bot requested a review from slevenick July 19, 2026 22:27

DrFaust92 force-pushed the cloudtrace-tracesink branch from 7012d72 to a21b849 Compare July 19, 2026 22:40

slevenick requested changes Jul 21, 2026

View reviewed changes

github-actions Bot requested a review from slevenick July 23, 2026 09:30

modular-magician added service/cloudtrace and removed awaiting-approval Pull requests that need reviewer's approval to run presubmit tests labels Jul 28, 2026

modular-magician added the awaiting-approval Pull requests that need reviewer's approval to run presubmit tests label Aug 4, 2026

modular-magician removed the awaiting-approval Pull requests that need reviewer's approval to run presubmit tests label Aug 6, 2026

DrFaust92 added 2 commits August 8, 2026 18:27

DrFaust92 force-pushed the cloudtrace-tracesink branch from abb2a42 to 5088fbd Compare August 8, 2026 22:27

modular-magician added the awaiting-approval Pull requests that need reviewer's approval to run presubmit tests label Aug 8, 2026

		@@ -0,0 +1,34 @@
		// The Cloud Trace API requires the sink's canonical resource name in the request

Uh oh!

Conversation

DrFaust92 commented Jul 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Note for reviewers: the API addresses sinks by project number

Testing

Release Note

Uh oh!

google-cla Bot commented Jul 19, 2026

Uh oh!

github-actions Bot commented Jul 19, 2026

Uh oh!

slevenick Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

slevenick Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

slevenick Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

slevenick Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

slevenick Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

slevenick Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 28, 2026

Uh oh!

modular-magician commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Diff report

Test report

Analytics

Action taken

Uh oh!

github-actions Bot commented Jul 30, 2026

Uh oh!

DrFaust92 commented Aug 4, 2026

Uh oh!

github-actions Bot commented Aug 6, 2026

Uh oh!

modular-magician commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Diff report

Test report

Analytics

Action taken

Uh oh!

DrFaust92 commented Aug 8, 2026

The two red checks are pre-existing, not from this PR

One open question

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

DrFaust92 commented Jul 19, 2026 •

edited

Loading

modular-magician commented Jul 28, 2026 •

edited

Loading

modular-magician commented Aug 6, 2026 •

edited

Loading