Skip to content

Commit a641e00

Browse files
CharlesleoniusCharlesleonius
authored and
Dawid212
committed
Access Context Manager - Add support for roles in service perimeter resources (GoogleCloudPlatform#13413)
Co-authored-by: Charlesleonius <[email protected]>
1 parent 88d5b48 commit a641e00

20 files changed

+354
-27
lines changed

‎mmv1/products/accesscontextmanager/ServicePerimeter.yaml

+38
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ custom_code:
6868
custom_import: 'templates/terraform/custom_import/set_access_policy_parent_from_self_link.go.tmpl'
6969
# Skipping the sweeper due to the non-standard base_url
7070
exclude_sweeper: true
71+
# Exclude tests for examples becauses tests run in parallel and will conflict when trying to create the org level access policy
7172
examples:
7273
- name: 'access_context_manager_service_perimeter_basic'
7374
primary_resource_id: 'service-perimeter'
@@ -85,6 +86,11 @@ examples:
8586
vars:
8687
service_perimeter_name: 'restrict_bigquery_dryrun_storage'
8788
exclude_test: true
89+
- name: 'access_context_manager_service_perimeter_granular_controls'
90+
primary_resource_id: 'service-perimeter'
91+
vars:
92+
service_perimeter_name: 'granular_controls'
93+
exclude_test: true
8894
parameters:
8995
# Parent is a path parameter that _cannot_ be read or sent in the request at all.
9096
# This must be done at the provider level.
@@ -313,6 +319,14 @@ properties:
313319
is_set: true
314320
item_type:
315321
type: String
322+
- name: 'roles'
323+
type: Array
324+
item_type:
325+
type: String
326+
description: |
327+
A list of IAM roles that represent the set of operations that the sources
328+
specified in the corresponding `IngressFrom`
329+
are allowed to perform.
316330
- name: 'operations'
317331
type: Array
318332
description: |
@@ -441,6 +455,14 @@ properties:
441455
is_set: true
442456
item_type:
443457
type: String
458+
- name: 'roles'
459+
type: Array
460+
item_type:
461+
type: String
462+
description: |
463+
A list of IAM roles that represent the set of operations that the sources
464+
specified in the corresponding `EgressFrom`
465+
are allowed to perform.
444466
- name: 'operations'
445467
type: Array
446468
description: |
@@ -639,6 +661,14 @@ properties:
639661
is_set: true
640662
item_type:
641663
type: String
664+
- name: 'roles'
665+
type: Array
666+
item_type:
667+
type: String
668+
description: |
669+
A list of IAM roles that represent the set of operations that the sources
670+
specified in the corresponding `IngressFrom`
671+
are allowed to perform.
642672
- name: 'operations'
643673
type: Array
644674
description: |
@@ -765,6 +795,14 @@ properties:
765795
is_set: true
766796
item_type:
767797
type: String
798+
- name: 'roles'
799+
type: Array
800+
item_type:
801+
type: String
802+
description: |
803+
A list of IAM roles that represent the set of operations that the sources
804+
specified in the corresponding `EgressFrom`
805+
are allowed to perform.
768806
- name: 'operations'
769807
type: Array
770808
description: |

‎mmv1/products/accesscontextmanager/ServicePerimeterDryRunEgressPolicy.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -80,11 +80,16 @@ custom_code:
8080
exclude_tgc: true
8181
# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
8282
exclude_sweeper: true
83+
# Exclude tests for examples becauses tests run in parallel and will conflict when trying to create the org level access policy
8384
examples:
8485
- name: 'access_context_manager_service_perimeter_dry_run_egress_policy'
8586
vars:
8687
egress_policy_title: 'egress policy title'
8788
exclude_test: true
89+
- name: 'access_context_manager_service_perimeter_dry_run_egress_policy_granular_controls'
90+
vars:
91+
egress_policy_title: 'granular controls egress policy title'
92+
exclude_test: true
8893
parameters:
8994
- name: 'perimeter'
9095
type: ResourceRef
@@ -173,6 +178,14 @@ properties:
173178
s3://bucket/path). Currently '*' is not allowed.
174179
item_type:
175180
type: String
181+
- name: 'roles'
182+
type: Array
183+
item_type:
184+
type: String
185+
description: |
186+
A list of IAM roles that represent the set of operations that the sources
187+
specified in the corresponding `EgressFrom`
188+
are allowed to perform.
176189
- name: 'operations'
177190
type: Array
178191
description: |

‎mmv1/products/accesscontextmanager/ServicePerimeterDryRunIngressPolicy.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -81,11 +81,16 @@ custom_code:
8181
exclude_tgc: true
8282
# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
8383
exclude_sweeper: true
84+
# Exclude tests for examples becauses tests run in parallel and will conflict when trying to create the org level access policy
8485
examples:
8586
- name: 'access_context_manager_service_perimeter_dry_run_ingress_policy'
8687
vars:
8788
ingress_policy_title: 'ingress policy title'
8889
exclude_test: true
90+
- name: 'access_context_manager_service_perimeter_dry_run_ingress_policy_granular_controls'
91+
vars:
92+
ingress_policy_title: 'granular controls ingress policy title'
93+
exclude_test: true
8994
parameters:
9095
- name: 'perimeter'
9196
type: ResourceRef
@@ -173,6 +178,14 @@ properties:
173178
diff_suppress_func: AccessContextManagerServicePerimeterDryRunIngressPolicyIngressToResourcesDiffSuppressFunc
174179
item_type:
175180
type: String
181+
- name: 'roles'
182+
type: Array
183+
item_type:
184+
type: String
185+
description: |
186+
A list of IAM roles that represent the set of operations that the sources
187+
specified in the corresponding `IngressFrom`
188+
are allowed to perform.
176189
- name: 'operations'
177190
type: Array
178191
description: |

‎mmv1/products/accesscontextmanager/ServicePerimeterDryRunResource.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ custom_code:
7676
exclude_tgc: true
7777
# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
7878
exclude_sweeper: true
79+
# Exclude tests for examples becauses tests run in parallel and will conflict when trying to create the org level access policy
7980
examples:
8081
- name: 'access_context_manager_service_perimeter_dry_run_resource_basic'
8182
primary_resource_id: 'service-perimeter-dry-run-resource'

‎mmv1/products/accesscontextmanager/ServicePerimeterEgressPolicy.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,10 @@ examples:
8484
vars:
8585
egress_policy_title: 'egress policy title'
8686
exclude_test: true
87+
- name: 'access_context_manager_service_perimeter_egress_policy_granular_controls'
88+
vars:
89+
egress_policy_title: 'granular controls egress policy title'
90+
exclude_test: true
8791
parameters:
8892
- name: 'perimeter'
8993
type: ResourceRef
@@ -173,6 +177,14 @@ properties:
173177
s3://bucket/path). Currently '*' is not allowed.
174178
item_type:
175179
type: String
180+
- name: 'roles'
181+
type: Array
182+
item_type:
183+
type: String
184+
description: |
185+
A list of IAM roles that represent the set of operations that the sources
186+
specified in the corresponding `EgressFrom`
187+
are allowed to perform.
176188
- name: 'operations'
177189
type: Array
178190
description: |

‎mmv1/products/accesscontextmanager/ServicePerimeterIngressPolicy.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -80,11 +80,16 @@ custom_code:
8080
exclude_tgc: true
8181
# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
8282
exclude_sweeper: true
83+
# Exclude tests for examples becauses tests run in parallel and will conflict when trying to create the org level access policy
8384
examples:
8485
- name: 'access_context_manager_service_perimeter_ingress_policy'
8586
vars:
8687
ingress_policy_title: 'ingress policy title'
8788
exclude_test: true
89+
- name: 'access_context_manager_service_perimeter_ingress_policy_granular_controls'
90+
vars:
91+
ingress_policy_title: 'ingress policy title'
92+
exclude_test: true
8893
parameters:
8994
- name: 'perimeter'
9095
type: ResourceRef
@@ -175,6 +180,14 @@ properties:
175180
diff_suppress_func: AccessContextManagerServicePerimeterIngressPolicyIngressToResourcesDiffSuppressFunc
176181
item_type:
177182
type: String
183+
- name: 'roles'
184+
type: Array
185+
item_type:
186+
type: String
187+
description: |
188+
A list of IAM roles that represent the set of operations that the sources
189+
specified in the corresponding `IngressFrom`
190+
are allowed to perform.
178191
- name: 'operations'
179192
type: Array
180193
description: |

‎mmv1/products/accesscontextmanager/ServicePerimeterResource.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ custom_code:
7575
exclude_tgc: true
7676
# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
7777
exclude_sweeper: true
78+
# Exclude tests for examples becauses tests run in parallel and will conflict when trying to create the org level access policy
7879
examples:
7980
- name: 'access_context_manager_service_perimeter_resource_basic'
8081
primary_resource_id: 'service-perimeter-resource'

‎mmv1/products/accesscontextmanager/ServicePerimeters.yaml

+37
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ custom_code:
5050
custom_import: 'templates/terraform/custom_import/set_access_policy_parent_from_access_policy.go.tmpl'
5151
# Skipping the sweeper due to the non-standard base_url
5252
exclude_sweeper: true
53+
# Exclude tests for examples becauses tests run in parallel and will conflict when trying to create the org level access policy
5354
examples:
5455
- name: 'access_context_manager_service_perimeters_basic'
5556
primary_resource_id: 'service-perimeter'
@@ -294,6 +295,15 @@ properties:
294295
is_set: true
295296
item_type:
296297
type: String
298+
- name: 'roles'
299+
type: Array
300+
item_type:
301+
type: String
302+
is_set: true
303+
description: |
304+
A list of IAM roles that represent the set of operations that the sources
305+
specified in the corresponding `IngressFrom`
306+
are allowed to perform.
297307
- name: 'operations'
298308
type: Array
299309
description: |
@@ -419,6 +429,15 @@ properties:
419429
is_set: true
420430
item_type:
421431
type: String
432+
- name: 'roles'
433+
type: Array
434+
item_type:
435+
type: String
436+
is_set: true
437+
description: |
438+
A list of IAM roles that represent the set of operations that the sources
439+
specified in the corresponding `EgressFrom`
440+
are allowed to perform.
422441
- name: 'operations'
423442
type: Array
424443
description: |
@@ -610,6 +629,15 @@ properties:
610629
is_set: true
611630
item_type:
612631
type: String
632+
- name: 'roles'
633+
type: Array
634+
item_type:
635+
type: String
636+
is_set: true
637+
description: |
638+
A list of IAM roles that represent the set of operations that the sources
639+
specified in the corresponding `IngressFrom`
640+
are allowed to perform.
613641
- name: 'operations'
614642
type: Array
615643
description: |
@@ -737,6 +765,15 @@ properties:
737765
is_set: true
738766
item_type:
739767
type: String
768+
- name: 'roles'
769+
type: Array
770+
item_type:
771+
type: String
772+
is_set: true
773+
description: |
774+
A list of IAM roles that represent the set of operations that the sources
775+
specified in the corresponding `EgressFrom`
776+
are allowed to perform.
740777
- name: 'operations'
741778
type: Array
742779
description: |

‎mmv1/templates/terraform/custom_flatten/accesscontextmanager_serviceperimeters_custom_flatten.go.tmpl

+17
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,13 @@ func flatten{{$.GetPrefix}}{{$.TitlelizeProperty}}(v interface{}, d *schema.Reso
3434
return sorted
3535
}
3636

37+
func flattenStringArrayToStringSet(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
38+
if v == nil {
39+
return v
40+
}
41+
return schema.NewSet(schema.HashString, v.([]interface{}))
42+
}
43+
3744
func flattenAccessContextManagerServicePerimetersServicePerimetersName(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
3845
return v
3946
}
@@ -220,6 +227,8 @@ func flattenAccessContextManagerServicePerimetersServicePerimetersStatusIngressP
220227
flattenAccessContextManagerServicePerimetersServicePerimetersStatusIngressPoliciesIngressToResources(original["resources"], d, config)
221228
transformed["operations"] =
222229
flattenAccessContextManagerServicePerimetersServicePerimetersStatusIngressPoliciesIngressToOperations(original["operations"], d, config)
230+
transformed["roles"] =
231+
flattenStringArrayToStringSet(original["roles"], d, config)
223232
return []interface{}{transformed}
224233
}
225234
func flattenAccessContextManagerServicePerimetersServicePerimetersStatusIngressPoliciesIngressToResources(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
@@ -379,8 +388,11 @@ func flattenAccessContextManagerServicePerimetersServicePerimetersStatusEgressPo
379388
flattenAccessContextManagerServicePerimetersServicePerimetersStatusEgressPoliciesEgressToExternalResources(original["externalResources"], d, config)
380389
transformed["operations"] =
381390
flattenAccessContextManagerServicePerimetersServicePerimetersStatusEgressPoliciesEgressToOperations(original["operations"], d, config)
391+
transformed["roles"] =
392+
flattenStringArrayToStringSet(original["roles"], d, config)
382393
return []interface{}{transformed}
383394
}
395+
384396
func flattenAccessContextManagerServicePerimetersServicePerimetersStatusEgressPoliciesEgressToResources(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
385397
if v == nil {
386398
return v
@@ -607,6 +619,8 @@ func flattenAccessContextManagerServicePerimetersServicePerimetersSpecIngressPol
607619
flattenAccessContextManagerServicePerimetersServicePerimetersSpecIngressPoliciesIngressToResources(original["resources"], d, config)
608620
transformed["operations"] =
609621
flattenAccessContextManagerServicePerimetersServicePerimetersSpecIngressPoliciesIngressToOperations(original["operations"], d, config)
622+
transformed["roles"] =
623+
flattenStringArrayToStringSet(original["roles"], d, config)
610624
return []interface{}{transformed}
611625
}
612626
func flattenAccessContextManagerServicePerimetersServicePerimetersSpecIngressPoliciesIngressToResources(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
@@ -766,8 +780,11 @@ func flattenAccessContextManagerServicePerimetersServicePerimetersSpecEgressPoli
766780
flattenAccessContextManagerServicePerimetersServicePerimetersSpecEgressPoliciesEgressToExternalResources(original["externalResources"], d, config)
767781
transformed["operations"] =
768782
flattenAccessContextManagerServicePerimetersServicePerimetersSpecEgressPoliciesEgressToOperations(original["operations"], d, config)
783+
transformed["roles"] =
784+
flattenStringArrayToStringSet(original["roles"], d, config)
769785
return []interface{}{transformed}
770786
}
787+
771788
func flattenAccessContextManagerServicePerimetersServicePerimetersSpecEgressPoliciesEgressToResources(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
772789
if v == nil {
773790
return v

‎mmv1/templates/terraform/examples/access_context_manager_service_perimeter_dry_run_egress_policy_granular_controls.tf.tmpl

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
resource "google_access_context_manager_service_perimeter" "storage-perimeter" {
2+
parent = "accesspolicies/${google_access_context_manager_access_policy.access-policy.name}"
3+
name = "accesspolicies/${google_access_context_manager_access_policy.access-policy.name}/serviceperimeters/storage-perimeter"
4+
title = "Storage Perimeter"
5+
spec {
6+
restricted_services = ["storage.googleapis.com"]
7+
}
8+
lifecycle {
9+
ignore_changes = [spec[0].egress_policies] # Allows egress policies to be managed by google_access_context_manager_service_perimeter_dry_run_egress_policy resources
10+
}
11+
}
12+
13+
resource "google_access_context_manager_service_perimeter_dry_run_egress_policy" "egress_policy" {
14+
perimeter = "${google_access_context_manager_service_perimeter.storage-perimeter.name}"
15+
title = "{{index $.Vars "egress_policy_title"}}"
16+
egress_from {
17+
identities = ["group:[email protected]"]
18+
identities = ["principal://iam.googleapis.com/locations/global/workforcePools/1234/subject/janedoe"]
19+
identities = ["principalSet://iam.googleapis.com/locations/global/workforcePools/1234/*"]
20+
}
21+
egress_to {
22+
resources = [ "*" ]
23+
roles = ["roles/bigquery.admin", "organizations/1234/roles/bigquery_custom_role"]
24+
}
25+
lifecycle {
26+
create_before_destroy = true
27+
}
28+
}
29+
30+
31+
resource "google_access_context_manager_access_policy" "access-policy" {
32+
parent = "organizations/123456789"
33+
title = "Storage Policy"
34+
}

0 commit comments

Comments
 (0)