Skip to content

Commit 0974a52

Browse files
shuyama1shuyama1
authored
Update tests to use bootstrapped KMS keys (#12609)
1 parent 834d30b commit 0974a52

18 files changed

+78
-258
lines changed

‎mmv1/products/bigquery/Job.yaml

+6-4
Original file line numberDiff line numberDiff line change
@@ -107,10 +107,11 @@ examples:
107107
vars:
108108
job_id: 'job_copy'
109109
account_name: 'bqowner'
110-
key_name: 'example-key'
111-
keyring_name: 'example-keyring'
110+
kms_key_name: 'example-key'
112111
test_env_vars:
113112
project: 'PROJECT_NAME'
113+
test_vars_overrides:
114+
'kms_key_name': 'acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", "global", "tf-bootstrap-bigquery-job-key1").CryptoKey.Name'
114115
ignore_read_extra:
115116
- 'etag'
116117
- 'status.0.state'
@@ -119,10 +120,11 @@ examples:
119120
vars:
120121
job_id: 'job_copy'
121122
account_name: 'bqowner'
122-
key_name: 'example-key'
123-
keyring_name: 'example-keyring'
123+
kms_key_name: 'example-key'
124124
test_env_vars:
125125
project: 'PROJECT_NAME'
126+
test_vars_overrides:
127+
'kms_key_name': 'acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", "global", "tf-bootstrap-bigquery-job-key2").CryptoKey.Name'
126128
ignore_read_extra:
127129
- 'etag'
128130
- 'copy.0.destination_table.0.table_id'

‎mmv1/products/dataproc/Batch.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -65,13 +65,13 @@ examples:
6565
vars:
6666
dataproc_batch: 'dataproc-batch'
6767
prevent_destroy: 'true'
68-
key_name: 'example-key'
69-
keyring_name: 'example-keyring'
68+
kms_key_name: 'example-key'
7069
bucket_name: 'dataproc-bucket'
7170
test_env_vars:
7271
project_name: 'PROJECT_NAME'
7372
test_vars_overrides:
7473
'prevent_destroy': 'false'
74+
'kms_key_name': 'acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", "us-central1", "tf-bootstrap-dataproc-batch-key1").CryptoKey.Name'
7575
ignore_read_extra:
7676
- 'runtime_config.0.properties'
7777
- name: 'dataproc_batch_sparksql'

‎mmv1/products/metastore/Service.yaml

+1-2
Original file line numberDiff line numberDiff line change
@@ -71,8 +71,7 @@ examples:
7171
primary_resource_id: 'default'
7272
vars:
7373
metastore_service_name: 'example-service'
74-
key_name: 'example-key'
75-
keyring_name: 'example-keyring'
74+
'kms_key_name': 'acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", "us-central1", "tf-bootstrap-metastore-service-key1").CryptoKey.Name'
7675
exclude_docs: true
7776
skip_vcr: true
7877
- name: 'dataproc_metastore_service_cmek_example'

‎mmv1/products/netapp/kmsconfig.yaml

+3-2
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,9 @@ examples:
6060
primary_resource_id: 'kmsConfig'
6161
vars:
6262
kms_name: 'kms-test'
63-
key_ring_value: 'key-ring'
64-
crypto_name: 'crypto-name'
63+
kms_key_name: 'crypto-name'
64+
test_vars_overrides:
65+
'kms_key_name': 'acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", "us-central1", "tf-bootstrap-netapp-kmsconfig-key1").CryptoKey.Name'
6566
parameters:
6667
- name: 'location'
6768
type: String

‎mmv1/products/securesourcemanager/Instance.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -68,11 +68,11 @@ examples:
6868
primary_resource_name: 'fmt.Sprintf("tf-test-my-instance%s", context["random_suffix"])'
6969
vars:
7070
instance_id: 'my-instance'
71-
keyring_name: 'my-keyring'
72-
key_name: 'my-key'
71+
kms_key_name: 'my-key'
7372
prevent_destroy: 'true'
7473
test_vars_overrides:
7574
'prevent_destroy': 'false'
75+
'kms_key_name': 'acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", "us-central1", "tf-bootstrap-secure-source-manager-key1").CryptoKey.Name'
7676
oics_vars_overrides:
7777
'prevent_destroy': 'false'
7878
- name: 'secure_source_manager_instance_private'

‎mmv1/templates/terraform/examples/bigquery_job_copy.tf.tmpl

+3-13
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ resource "google_bigquery_table" "dest" {
6666
EOF
6767

6868
encryption_configuration {
69-
kms_key_name = google_kms_crypto_key.crypto_key.id
69+
kms_key_name = "{{index $.Vars "kms_key_name"}}"
7070
}
7171

7272
depends_on = ["google_kms_crypto_key_iam_member.encrypt_role"]
@@ -79,22 +79,12 @@ resource "google_bigquery_dataset" "dest" {
7979
location = "US"
8080
}
8181

82-
resource "google_kms_crypto_key" "crypto_key" {
83-
name = "{{index $.Vars "key_name"}}"
84-
key_ring = google_kms_key_ring.key_ring.id
85-
}
86-
87-
resource "google_kms_key_ring" "key_ring" {
88-
name = "{{index $.Vars "keyring_name"}}"
89-
location = "global"
90-
}
91-
9282
data "google_project" "project" {
9383
project_id = "{{index $.TestEnvVars "project"}}"
9484
}
9585

9686
resource "google_kms_crypto_key_iam_member" "encrypt_role" {
97-
crypto_key_id = google_kms_crypto_key.crypto_key.id
87+
crypto_key_id = "{{index $.Vars "kms_key_name"}}"
9888
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
9989
member = "serviceAccount:bq-${data.google_project.project.number}@bigquery-encryption.iam.gserviceaccount.com"
10090
}
@@ -122,7 +112,7 @@ resource "google_bigquery_job" "{{$.PrimaryResourceId}}" {
122112
}
123113

124114
destination_encryption_configuration {
125-
kms_key_name = google_kms_crypto_key.crypto_key.id
115+
kms_key_name = "{{index $.Vars "kms_key_name"}}"
126116
}
127117
}
128118

‎mmv1/templates/terraform/examples/bigquery_job_copy_table_reference.tf.tmpl

+3-13
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ resource "google_bigquery_table" "dest" {
6767
EOF
6868

6969
encryption_configuration {
70-
kms_key_name = google_kms_crypto_key.crypto_key.id
70+
kms_key_name = "{{index $.Vars "kms_key_name"}}"
7171
}
7272

7373
depends_on = ["google_kms_crypto_key_iam_member.encrypt_role"]
@@ -80,22 +80,12 @@ resource "google_bigquery_dataset" "dest" {
8080
location = "US"
8181
}
8282

83-
resource "google_kms_crypto_key" "crypto_key" {
84-
name = "{{index $.Vars "key_name"}}"
85-
key_ring = google_kms_key_ring.key_ring.id
86-
}
87-
88-
resource "google_kms_key_ring" "key_ring" {
89-
name = "{{index $.Vars "keyring_name"}}"
90-
location = "global"
91-
}
92-
9383
data "google_project" "project" {
9484
project_id = "{{index $.TestEnvVars "project"}}"
9585
}
9686

9787
resource "google_kms_crypto_key_iam_member" "encrypt_role" {
98-
crypto_key_id = google_kms_crypto_key.crypto_key.id
88+
crypto_key_id = "{{index $.Vars "kms_key_name"}}"
9989
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
10090
member = "serviceAccount:bq-${data.google_project.project.number}@bigquery-encryption.iam.gserviceaccount.com"
10191
}
@@ -117,7 +107,7 @@ resource "google_bigquery_job" "{{$.PrimaryResourceId}}" {
117107
}
118108

119109
destination_encryption_configuration {
120-
kms_key_name = google_kms_crypto_key.crypto_key.id
110+
kms_key_name = "{{index $.Vars "kms_key_name"}}"
121111
}
122112
}
123113

‎mmv1/templates/terraform/examples/dataproc_batch_spark_full.tf.tmpl

+2-13
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ resource "google_dataproc_batch" "{{$.PrimaryResourceId}}" {
1818
execution_config {
1919
ttl = "3600s"
2020
network_tags = ["tag1"]
21-
kms_key = google_kms_crypto_key.crypto_key.id
21+
kms_key = "{{index $.Vars "kms_key_name"}}"
2222
network_uri = "default"
2323
service_account = "${data.google_project.project.number}[email protected]"
2424
staging_bucket = google_storage_bucket.bucket.name
@@ -49,19 +49,8 @@ resource "google_storage_bucket" "bucket" {
4949
force_destroy = true
5050
}
5151

52-
resource "google_kms_crypto_key" "crypto_key" {
53-
name = "{{index $.Vars "key_name"}}"
54-
key_ring = google_kms_key_ring.key_ring.id
55-
purpose = "ENCRYPT_DECRYPT"
56-
}
57-
58-
resource "google_kms_key_ring" "key_ring" {
59-
name = "{{index $.Vars "keyring_name"}}"
60-
location = "us-central1"
61-
}
62-
6352
resource "google_kms_crypto_key_iam_member" "crypto_key_member_1" {
64-
crypto_key_id = google_kms_crypto_key.crypto_key.id
53+
crypto_key_id = "{{index $.Vars "kms_key_name"}}"
6554
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
6655
member = "serviceAccount:service-${data.google_project.project.number}@dataproc-accounts.iam.gserviceaccount.com"
6756
}

‎mmv1/templates/terraform/examples/dataproc_metastore_service_cmek_test.tf.tmpl

+3-15
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ resource "google_dataproc_metastore_service" "{{$.PrimaryResourceId}}" {
88
location = "us-central1"
99

1010
encryption_config {
11-
kms_key = google_kms_crypto_key.crypto_key.id
11+
kms_key = "{{index $.Vars "kms_key_name"}}"
1212
}
1313

1414
hive_metastore_config {
@@ -21,27 +21,15 @@ resource "google_dataproc_metastore_service" "{{$.PrimaryResourceId}}" {
2121
]
2222
}
2323

24-
resource "google_kms_crypto_key" "crypto_key" {
25-
name = "{{index $.Vars "key_name"}}"
26-
key_ring = google_kms_key_ring.key_ring.id
27-
28-
purpose = "ENCRYPT_DECRYPT"
29-
}
30-
31-
resource "google_kms_key_ring" "key_ring" {
32-
name = "{{index $.Vars "keyring_name"}}"
33-
location = "us-central1"
34-
}
35-
3624
resource "google_kms_crypto_key_iam_member" "crypto_key_member_1" {
37-
crypto_key_id = google_kms_crypto_key.crypto_key.id
25+
crypto_key_id = "{{index $.Vars "kms_key_name"}}"
3826
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
3927

4028
member = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-metastore.iam.gserviceaccount.com"
4129
}
4230

4331
resource "google_kms_crypto_key_iam_member" "crypto_key_member_2" {
44-
crypto_key_id = google_kms_crypto_key.crypto_key.id
32+
crypto_key_id = "{{index $.Vars "kms_key_name"}}"
4533
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
4634

4735
member = "serviceAccount:${data.google_storage_project_service_account.gcs_account.email_address}"

‎mmv1/templates/terraform/examples/kmsConfig_create.tf.tmpl

+1-12
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,6 @@
1-
resource "google_kms_key_ring" "keyring" {
2-
name = "{{index $.Vars "key_ring_value"}}"
3-
location = "us-central1"
4-
}
5-
6-
resource "google_kms_crypto_key" "crypto_key" {
7-
name = "{{index $.Vars "crypto_name"}}"
8-
key_ring = google_kms_key_ring.keyring.id
9-
# rotation_period = "7776000s"
10-
}
11-
121
resource "google_netapp_kmsconfig" "{{$.PrimaryResourceId}}" {
132
name = "{{index $.Vars "kms_name"}}"
143
description="this is a test description"
15-
crypto_key_name=google_kms_crypto_key.crypto_key.id
4+
crypto_key_name="{{index $.Vars "kms_key_name"}}"
165
location="us-central1"
176
}

‎mmv1/templates/terraform/examples/secure_source_manager_instance_cmek.tf.tmpl

+2-12
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,5 @@
1-
resource "google_kms_key_ring" "key_ring" {
2-
name = "{{index $.Vars "keyring_name"}}"
3-
location = "us-central1"
4-
}
5-
6-
resource "google_kms_crypto_key" "crypto_key" {
7-
name = "{{index $.Vars "key_name"}}"
8-
key_ring = google_kms_key_ring.key_ring.id
9-
}
10-
111
resource "google_kms_crypto_key_iam_member" "crypto_key_binding" {
12-
crypto_key_id = google_kms_crypto_key.crypto_key.id
2+
crypto_key_id = "{{index $.Vars "kms_key_name"}}"
133
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
144

155
member = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-sourcemanager.iam.gserviceaccount.com"
@@ -18,7 +8,7 @@ resource "google_kms_crypto_key_iam_member" "crypto_key_binding" {
188
resource "google_secure_source_manager_instance" "{{$.PrimaryResourceId}}" {
199
location = "us-central1"
2010
instance_id = "{{index $.Vars "instance_id"}}"
21-
kms_key = google_kms_crypto_key.crypto_key.id
11+
kms_key = "{{index $.Vars "kms_key_name"}}"
2212

2313
depends_on = [
2414
google_kms_crypto_key_iam_member.crypto_key_binding

‎mmv1/third_party/terraform/services/alloydb/resource_alloydb_backup_test.go

+3-13
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ func TestAccAlloydbBackup_usingCMEK(t *testing.T) {
171171
context := map[string]interface{}{
172172
"network_name": acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydb-backup-cmek-1"),
173173
"random_suffix": acctest.RandString(t, 10),
174-
"key_name": "tf-test-key-" + acctest.RandString(t, 10),
174+
"kms_key_name": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", "us-central1", "tf-bootstrap-alloydb-backup-key1").CryptoKey.Name,
175175
}
176176

177177
acctest.VcrTest(t, resource.TestCase{
@@ -204,7 +204,7 @@ resource "google_alloydb_backup" "default" {
204204
"label2" = "updated_key2"
205205
}
206206
encryption_config {
207-
kms_key_name = google_kms_crypto_key.key.id
207+
kms_key_name = "%{kms_key_name}"
208208
}
209209
depends_on = [
210210
google_alloydb_instance.default,
@@ -231,18 +231,8 @@ data "google_compute_network" "default" {
231231
}
232232
data "google_project" "project" {}
233233
234-
resource "google_kms_key_ring" "keyring" {
235-
name = "%{key_name}"
236-
location = "us-central1"
237-
}
238-
239-
resource "google_kms_crypto_key" "key" {
240-
name = "%{key_name}"
241-
key_ring = google_kms_key_ring.keyring.id
242-
}
243-
244234
resource "google_kms_crypto_key_iam_member" "crypto_key" {
245-
crypto_key_id = google_kms_crypto_key.key.id
235+
crypto_key_id = "%{kms_key_name}"
246236
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
247237
member = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-alloydb.iam.gserviceaccount.com"
248238
}

0 commit comments

Comments
 (0)