Is it possible to provision sip_trunk_resource via TF provider v1.18? Getting 403 Forbidden on apply.
Sydney region. CLI v2.0.4. User has admin role.
Error points to missing telephony permissions.
Docs are silent on required scopes for code deployment.
403 on sip_trunk_resource usually means the service account lacks the specific Telephony Admin scope. Admin role isn’t enough for API calls. you need telephony:siptrunk:write.
check your oauth token scopes. if you’re using client credentials, verify the grant includes that scope.
here’s the pact consumer contract snippet for the creation step. it expects a 201 Created with the resource URI in the location header.
consumer('SIP Trunk Provisioner')
.havingInteraction('provision new sip trunk')
.uponReceiving('a request to create a sip trunk')
.withRequest({
method: 'POST',
path: '/api/v2/telephony/sip/sites/{siteId}/trunks',
headers: { 'Content-Type': 'application/json' },
body: {
name: 'Test Trunk',
sipAddress: '10.0.0.1',
port: 5060
}
})
.willRespondWith({
status: 201,
headers: {
'Location': like('/api/v2/telephony/sip/trunks/{id}')
},
body: {
id: term({ generate: 'abc-123', match: /\w+-\w+/ }),
name: 'Test Trunk'
}
});
if the contract passes but TF fails, it’s definitely a scope issue. check the token.
yeah, admin role doesn’t cover that scope. add telephony:siptrunk:write to your service account.
"scopes": ["telephony:siptrunk:write", "organization:read"]
that should clear the 403.
403 is definitely the scope. telephony:siptrunk:write is required, not just admin. check your oauth token scopes.
the admin role in the UI is pretty broad but the API scopes are much stricter. adding that telephony:siptrunk:write scope is definitely the right move.
just a heads up though, sometimes the terraform provider cache gets out of sync after a scope change. if you still see the 403 after updating the service account, try clearing the local state or re-authenticating the provider block. it’s a minor annoyance but happens more than you’d think.