title: Terraform: Cross project referencing not allowed
body: <p>I'm seeing something strange with <code>google_compute_firewall</code>, the compute instance is in a shared subnet. </p>
  
  <p>I assume a firewall rule needs to be associated to the network which that subnet belongs to. But we can't add the firewall rule to that network because:</p>
  
  <pre><code>google_compute_firewall.intacct-firewall: Error creating Firewall: googleapi: Error 400: Invalid value for field 'resource.network': 'projects/it-production-186816/global/networks/production'. Cross project referencing is not allowed for this resource., invalid
  </code></pre>
  
  <p>Unable to find anything documented for firewall rules on shared networks. Are we to add the firewall to the local VPC and not the shared VPC?</p>
  
  <p>The compute image has this network configuration:</p>
  
  <pre><code>  network_interface {
      subnetwork         = "${var.subnetwork}"
      subnetwork_project = "${var.vpc_parent}"
      access_config      = {
        nat_ip = "${google_compute_address.dokku.address}"
      }
    }
  </code></pre>
  
  <p>So although the compute instance is in <code>project-1</code>, the network it's using is in <code>project-2</code></p>
  
  <p>EDIT:</p>
  
  <p>My main.tf: </p>
  
  <pre><code># Backend config
  terraform {
    backend "gcs" {
      bucket      = "intacct-staging-remote-backend"
      project     = "fr-intacct-staging"
      credentials = "./creds/serviceaccount.json"
    }
  }
  #
  # Provider config
  provider "google" {
    region      = "${var.gcp_region}"
    project     = "${var.gcp_project}"
    credentials = "${file("./creds/serviceaccount.json")}"
  }
  #
  # Static IP Address for the app
  resource "google_compute_address" "dokku" {
    name = "fr-intacct-staging-ip"
    address_type = "EXTERNAL"
  }
  #
  # Compute Instance Config
  resource "google_compute_instance" "dokku" {
    project                   = "${var.gcp_project}"
    name                      = "dokku-host1"
    machine_type              = "${var.comp_type}"
    zone                      = "${var.gcp_zone}"
    allow_stopping_for_update = "true"
  
    tags = ["intacct"]
  
    # Install Dokku
    metadata_startup_script   = &lt;&lt;SCRIPT
  sudo yum install -y wget
  wget https://raw.githubusercontent.com/dokku/dokku/v0.14.5/bootstrap.sh
  sudo DOKKU_TAG=${var.dokku_version} bash bootstrap.sh
  sudo dokku apps:create fr-intacct-staging
  sudo echo "net.ipv4.ip_forward=1" &gt;&gt; /etc/sysctl.conf
  sudo systemctl restart network
  setenforce 0
  SCRIPT
  
    boot_disk {
      initialize_params {
        image = "${var.compute_image}"
      }
    }
    network_interface {
      subnetwork         = "${var.subnetwork}"
      subnetwork_project = "${var.vpc_parent}"
      access_config      = {
        nat_ip = "${google_compute_address.dokku.address}"
      }
    }
  }
  #
  # Firewall rule for app access
  resource "google_compute_firewall" "intacct-firewall" {
    name    = "intacct-firewall"
    network = "projects/it-production-186816/global/networks/production"
    allow {
      protocol = "tcp"
      ports    = [ "80" ]
    }
    source_ranges = [ "0.0.0.0/0" ]
    target_tags   = [ "intacct" ]
  }
  </code></pre>
  
  <p>It seems wrong to be using another provider config for the other project to add a firewall rule.</p>
  
  <p>If it is that way, then so be it... but since the service account in use has permission on the other project, it seems wrong that we'd have to use another provider for the other project?</p>