fix(UP-0): dspm instance template name collision

[steveh2707]

Problem

GCP Argo workflows transiently fail with:

Error: Error creating RegionInstanceTemplate: googleapi: Error 409: The resource
'projects/upwindsecurity-xa-w2/regions/us-east1/instanceTemplates/upwind-tpl-dspm-ucsc-c271fe38ddb2dcf3-260827002'
already exists, alreadyExists

  with module.google_cloudscanner_ucsc-c271fe38ddb2dcf3.google_compute_region_instance_template.cloudscanner_dspm_inst_templates[0],
  on .terraform/modules/.../modules/main/main.tf line 289

Root cause

The google provider picks one of two name generators based on name_prefix length:

if len(prefix) > 37 {
    itName = tpgresource.ReducedPrefixedUniqueId(prefix)  // prefix + YYmmdd + 3 digits
} else {
    itName = id.PrefixedUniqueId(prefix)                  // prefix + YYYYmmddHHMMSSssss + 8 hex
}

func ReducedPrefixedUniqueId(prefix string) string {
	uniqueId := id.PrefixedUniqueId("")
	counter := uniqueId[len(uniqueId)-3:]  // last 3 digits of an in-process counter
	date := uniqueId[2:8]                  // YYmmdd - no time of day
	return prefix + date + counter
}

"upwind-tpl-dspm-" (16) + scanner_id (always 21: ucsc- + 2x8 hex) + - (1) = 38 — one character over the threshold. So DSPM template names carried no time component and no randomness, only the UTC date and a counter that resets to 0 in every terraform process. …-260827002 decomposes as 260827 (2026-08-27) + 002.

Both DSPM templates are create_before_destroy, and source_image = var.boot_image makes any boot image bump a ForceNew replacement. A replacement therefore has to mint a new name while the old template still exists — and if that old template was created on the same UTC day (boot image rollout followed by a re-apply, a reinstall, or a workflow re-submission after a partial failure), the "new" name is the old one. Within a single apply at most four templates draw from the counter, so the suffix is effectively one of 001–004; whether a given run collides depends on the order the parallel creations grab values, which is why it fails intermittently rather than every time.

The regular cloudscanner_inst_templates were never affected — their prefix is 33 characters, so they stay on the full-timestamp path.

Fix

Shorten the DSPM marker to ds-, putting the prefix at 36 characters and restoring the full 26-character unique suffix (62-character names, one under GCE's 63 limit).

The names must keep the upwind-tpl- prefix: the scaler's instance template IAM binding is conditioned on it (terraform-gcp-onboarding/modules/_shared/iam/roles.tf, resource.name.extract('instanceTemplates/{template}').startsWith('upwind-tpl-')). With 11 characters spent there and 21 on scanner_id, that leaves 5 for the marker and separator.

Both prefixes now come from locals with a precondition on the 37-character limit, so this can't be crossed again unnoticed — nothing catches it today, since scanner_id is only validated as ^ucsc-[a-zA-Z0-9]{1,}$.

Rollout notes

• Changing name_prefix is ForceNew, so the next apply replaces both DSPM templates. This migration is safe: the new names come from a different prefix, so create-before-destroy cannot collide.
• Templates left behind by an apply that died before persisting state are orphans and won't be cleaned up by terraform. To unblock a workflow failing right now, delete the conflicting upwind-tpl-dspm-… template, or re-run after 00:00 UTC.

Testing

• terraform fmt -check -recursive — clean
• terraform validate on modules/main — passes
• tflint not installed locally; left to CI

🤖 Generated with Claude Code