Terraform GCP "googleapi: Error 409: already exists" in CI

GCP resource names are unique within their scope. A 409 alreadyExists means Terraform tried to create a resource whose name is taken -- typically the resource exists out-of-band and is not tracked in state.

What this error means

apply fails with "googleapi: Error 409 ... already exists" naming the resource. It appears when a bucket/instance/service account was created manually or by another stack, or when state was lost.

terraform

Error: Error creating Bucket: googleapi: Error 409: Your previous request to
create the named bucket succeeded and you already own it., conflict

  with google_storage_bucket.assets,
  on storage.tf line 1, in resource "google_storage_bucket" "assets":

Common causes

Resource exists but not in state

A resource with the same name was created out-of-band or by another config, so creating it again conflicts.

Lost or mis-targeted state

After lost state or a wrong backend, Terraform no longer knows it owns the resource and tries to recreate it.

How to fix it

Import the existing resource

Bring the pre-existing GCP resource under management with import (or an import block), then plan.

Terminal

terraform import google_storage_bucket.assets my-project/my-assets-bucket
terraform plan   # confirm no recreate

Or make the name unique

If a duplicate is unwanted, give the resource a unique name (project/random suffix).
Confirm no other stack manages the same name.
Verify the backend points at the correct state for the project.

How to prevent it

Import out-of-band GCP resources instead of recreating them.
Derive globally/project-unique names to avoid collisions.
Protect state so Terraform keeps tracking what it owns.