How to fix Error: googleapi: Error 400: Dataflow API is not enabled in Terraform

The proper solution is to declare the API enablement in your Terraform configuration:

resource "google_project_service" "dataflow" {
  project = var.gcp_project_id
  service = "dataflow.googleapis.com"
  disable_on_destroy = false
}

Add the depends_on argument to ensure the API is enabled before creating resources:

resource "google_project_service" "dataflow" {
  project = var.gcp_project_id
  service = "dataflow.googleapis.com"
  disable_on_destroy = false
}

resource "google_dataflow_job" "example" {
  depends_on = [google_project_service.dataflow]

  name              = "my-job"
  template_gcs_path = "gs://my-bucket/templates/template_file"
  temp_gcs_location = "gs://my-bucket/tmp_dir"
  # ... other configuration
}

This ensures the API is enabled before Terraform attempts to create any resources that depend on it.

Different GCP services use different API names. If you don't know which API to enable, look at the error message. It usually tells you exactly which API is not enabled.

Common API names:

Compute Services:
- compute.googleapis.com - Compute Engine (VMs, firewalls, networks)
- container.googleapis.com - Google Kubernetes Engine (GKE)
- cloudrun.googleapis.com - Cloud Run

Data Services:
- dataflow.googleapis.com - Cloud Dataflow (Apache Beam)
- dataproc.googleapis.com - Cloud Dataproc (Hadoop/Spark)
- bigquery.googleapis.com - BigQuery
- pubsub.googleapis.com - Cloud Pub/Sub

Storage:
- storage-api.googleapis.com - Cloud Storage API
- storage.googleapis.com - Cloud Storage JSON API

Networking:
- servicenetworking.googleapis.com - Service Networking (VPC peering)
- compute.googleapis.com - Cloud VPN

Database:
- sqladmin.googleapis.com - Cloud SQL Admin
- firestore.googleapis.com - Firestore

Other:
- cloudkms.googleapis.com - Cloud Key Management Service (KMS)
- artifactregistry.googleapis.com - Artifact Registry

Visit the [Google Cloud API Library](https://console.cloud.google.com/apis/library) to find the service name for any API.

If your infrastructure needs multiple APIs, declare them all:

locals {
  required_apis = [
    "compute.googleapis.com",
    "container.googleapis.com",
    "servicenetworking.googleapis.com",
    "cloudkms.googleapis.com",
  ]
}

resource "google_project_service" "required" {
  for_each = toset(local.required_apis)

  project = var.gcp_project_id
  service = each.value

  disable_on_destroy = false
}

resource "google_compute_instance" "example" {
  depends_on = [google_project_service.required]

  name         = "example"
  machine_type = "e2-medium"
  # ... other configuration
}

This declares all APIs as dependencies, ensuring they're all enabled before any resources are created.

If you need to enable the API before running Terraform (e.g., in a CI/CD pipeline), use the gcloud CLI:

gcloud services enable dataflow.googleapis.com --project=MY_PROJECT_ID

To enable multiple APIs:

gcloud services enable \
  compute.googleapis.com \
  container.googleapis.com \
  servicenetworking.googleapis.com \
  --project=MY_PROJECT_ID

In a CI/CD pipeline, add this as a setup step before running terraform apply:

# GitHub Actions example
- name: Enable GCP APIs
  run: |
    gcloud services enable dataflow.googleapis.com
    gcloud services enable compute.googleapis.com
  env:
    GOOGLE_CLOUD_PROJECT: ${{ secrets.GCP_PROJECT_ID }}

However, the Terraform approach (google_project_service) is recommended because it's declarative and tracks API enablement as infrastructure.

The disable_on_destroy attribute controls whether Terraform disables the API when you destroy the resource:

Set to `false` (recommended):

resource "google_project_service" "dataflow" {
  service            = "dataflow.googleapis.com"
  disable_on_destroy = false  # Keep API enabled after terraform destroy
}

This is safer because disabling an API can break other applications or infrastructure in the same project that depend on it.

Set to `true` (advanced use only):

resource "google_project_service" "temporary" {
  service            = "compute.googleapis.com"
  disable_on_destroy = true   # Disable API when terraform destroy is run
}

Only use true if this is temporary test infrastructure and you're certain nothing else uses this API in the project.

To manually check if an API is enabled:

1. Go to the [Google Cloud Console](https://console.cloud.google.com)
2. Select your project from the dropdown at the top
3. Navigate to APIs & Services > Dashboard
4. Click + Enable APIs and Services
5. Search for the API name (e.g., "Dataflow")
6. Click the service and click Enable

Or use gcloud to list enabled APIs:

gcloud services list --enabled --project=MY_PROJECT_ID | grep dataflow

If you see the API listed, it's enabled. If not:

gcloud services enable dataflow.googleapis.com --project=MY_PROJECT_ID

The service account or user running Terraform needs the "Service Usage Admin" IAM role to enable APIs.

Check current permissions:

gcloud projects get-iam-policy MY_PROJECT_ID --flatten="bindings[].members" \
  --format="table(bindings.role)" --filter="bindings.members:serviceAccount:terraform@*"

Grant the role:

# For a service account
gcloud projects add-iam-policy-binding MY_PROJECT_ID \
  --member="serviceAccount:terraform@MY_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/serviceusage.serviceUsageAdmin"

# For a user
gcloud projects add-iam-policy-binding MY_PROJECT_ID \
  --member="user:[email protected]" \
  --role="roles/serviceusage.serviceUsageAdmin"

The error message might say "Permission denied" (403) instead of "not enabled" (400) if this is the issue. Both require checking service account permissions.