googleapis/mcp-toolbox · error

error creating AlloyDB user: %w

Error message

error creating AlloyDB user: %w

What it means

This error wraps a failure from the AlloyDB Admin API Users.Create call, which creates a database user (IAM-based or password-based) on a cluster. It fires when the REST request to projects/*/locations/*/clusters/*/users returns an error before any long-running operation completes. The wrapped error retains the Google API details for downstream inspection.

Source

Thrown at internal/sources/alloydbadmin/alloydbadmin.go:230

	if userType == "ALLOYDB_BUILT_IN" {
		user.Password = password
	}

	if len(roles) > 0 {
		user.DatabaseRoles = roles
	}

	service, err := s.getService(ctx, accessToken)
	if err != nil {
		return nil, err
	}

	urlString := fmt.Sprintf("projects/%s/locations/%s/clusters/%s", project, location, cluster)

	// The Create API returns a long-running operation.
	resp, err := service.Projects.Locations.Clusters.Users.Create(urlString, user).UserId(userID).Do()
	if err != nil {
		return nil, fmt.Errorf("error creating AlloyDB user: %w", err)
	}

	return resp, nil
}

func (s *Source) GetCluster(ctx context.Context, project, location, cluster, accessToken string) (any, error) {
	service, err := s.getService(ctx, accessToken)
	if err != nil {
		return nil, err
	}

	urlString := fmt.Sprintf("projects/%s/locations/%s/clusters/%s", project, location, cluster)

	resp, err := service.Projects.Locations.Clusters.Get(urlString).Do()
	if err != nil {
		return nil, fmt.Errorf("error getting AlloyDB cluster: %w", err)
	}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Verify the cluster exists and project/location/cluster names are spelled correctly
2. Ensure the userId is unique in the cluster and meets validation rules
3. Confirm the access token has alloydb.admin or cloud-platform scope and is fresh
4. Unwrap with errors.As(*googleapi.Error) to see the exact status (400/403/409) and fix inputs accordingly
5. Check the User struct fields (userType, password, databaseRoles) against the AlloyDB API schema

Example fix

// before
resp, err := service.Projects.Locations.Clusters.Users.Create(urlString, user).UserId(userID).Do()
if err != nil { return nil, fmt.Errorf("error creating AlloyDB user: %w", err) }
// after
resp, err := service.Projects.Locations.Clusters.Users.Create(urlString, user).UserId(userID).Do()
if err != nil {
    var gerr *googleapi.Error
    if errors.As(err, &gerr) && gerr.Code == 409 {
        return nil, fmt.Errorf("user %q already exists in cluster %q: %w", userID, cluster, err)
    }
    return nil, fmt.Errorf("error creating AlloyDB user: %w", err)
}

// Go: pre-check user uniqueness and inputs
if userID == "" || userType == "" {
    return fmt.Errorf("userID and userType are required")
}
if _, err := s.GetUsers(ctx, project, location, cluster, userID, accessToken); err == nil {
    return fmt.Errorf("user %s already exists in cluster %s", userID, cluster)
}

func IsAlreadyExists(err error) bool {
    var gerr *googleapi.Error
    return errors.As(err, &gerr) && gerr.Code == 409
}

_, err := s.CreateUser(ctx, userType, password, roles, accessToken, project, location, cluster, userID)
if err != nil {
    var gerr *googleapi.Error
    if errors.As(err, &gerr) && gerr.Code == 409 {
        return nil // treat as idempotent success
    }
    return err
}

When it happens

Trigger: Calling Source.CreateUser with a malformed cluster URL, a duplicate or invalid userId, a missing required user type field, or an unauthorized access token when calling Users.Create(urlString, user).UserId(userID).Do().

Common situations: Creating a user that already exists (409), granting roles that require IAM permissions the caller lacks, using a token without the alloydb.admin scope, typos in project/location/cluster, or invalid password policy violations.

Related errors

• error creating AlloyDB instance: %w
• error getting AlloyDB cluster: %w
• error getting AlloyDB instance: %w
• error getting AlloyDB user: %w
• error listing AlloyDB clusters: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/aed7b41abd5d716c. Report an issue: GitHub.