Skip to content

Commit 215d89f

Browse files
author
Charlesleonius
committed
Access Context Manager - Add support for roles in service perimeter resources.
1 parent 8765b37 commit 215d89f

14 files changed

+164
-23
lines changed

‎mmv1/products/accesscontextmanager/ServicePerimeter.yaml

+32
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,14 @@ properties:
313313
is_set: true
314314
item_type:
315315
type: String
316+
- name: 'roles'
317+
type: Array
318+
item_type:
319+
type: String
320+
description: |
321+
A list of IAM roles that represent the set of operations that the sources
322+
specified in the corresponding `IngressFrom`
323+
are allowed to perform.
316324
- name: 'operations'
317325
type: Array
318326
description: |
@@ -428,6 +436,14 @@ properties:
428436
is_set: true
429437
item_type:
430438
type: String
439+
- name: 'roles'
440+
type: Array
441+
item_type:
442+
type: String
443+
description: |
444+
A list of IAM roles that represent the set of operations that the sources
445+
specified in the corresponding `EgressFrom`
446+
are allowed to perform.
431447
- name: 'operations'
432448
type: Array
433449
description: |
@@ -622,6 +638,14 @@ properties:
622638
is_set: true
623639
item_type:
624640
type: String
641+
- name: 'roles'
642+
type: Array
643+
item_type:
644+
type: String
645+
description: |
646+
A list of IAM roles that represent the set of operations that the sources
647+
specified in the corresponding `IngressFrom`
648+
are allowed to perform.
625649
- name: 'operations'
626650
type: Array
627651
description: |
@@ -735,6 +759,14 @@ properties:
735759
is_set: true
736760
item_type:
737761
type: String
762+
- name: 'roles'
763+
type: Array
764+
item_type:
765+
type: String
766+
description: |
767+
A list of IAM roles that represent the set of operations that the sources
768+
specified in the corresponding `EgressFrom`
769+
are allowed to perform.
738770
- name: 'operations'
739771
type: Array
740772
description: |

‎mmv1/products/accesscontextmanager/ServicePerimeterDryRunEgressPolicy.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,14 @@ properties:
157157
s3://bucket/path). Currently '*' is not allowed.
158158
item_type:
159159
type: String
160+
- name: 'roles'
161+
type: Array
162+
item_type:
163+
type: String
164+
description: |
165+
A list of IAM roles that represent the set of operations that the sources
166+
specified in the corresponding `EgressFrom`
167+
are allowed to perform.
160168
- name: 'operations'
161169
type: Array
162170
description: |

‎mmv1/products/accesscontextmanager/ServicePerimeterDryRunIngressPolicy.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,14 @@ properties:
166166
diff_suppress_func: AccessContextManagerServicePerimeterDryRunIngressPolicyIngressToResourcesDiffSuppressFunc
167167
item_type:
168168
type: String
169+
- name: 'roles'
170+
type: Array
171+
item_type:
172+
type: String
173+
description: |
174+
A list of IAM roles that represent the set of operations that the sources
175+
specified in the corresponding `IngressFrom`
176+
are allowed to perform.
169177
- name: 'operations'
170178
type: Array
171179
description: |

‎mmv1/products/accesscontextmanager/ServicePerimeterEgressPolicy.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,14 @@ properties:
155155
s3://bucket/path). Currently '*' is not allowed.
156156
item_type:
157157
type: String
158+
- name: 'roles'
159+
type: Array
160+
item_type:
161+
type: String
162+
description: |
163+
A list of IAM roles that represent the set of operations that the sources
164+
specified in the corresponding `EgressFrom`
165+
are allowed to perform.
158166
- name: 'operations'
159167
type: Array
160168
description: |

‎mmv1/products/accesscontextmanager/ServicePerimeterIngressPolicy.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,14 @@ properties:
166166
diff_suppress_func: AccessContextManagerServicePerimeterIngressPolicyIngressToResourcesDiffSuppressFunc
167167
item_type:
168168
type: String
169+
- name: 'roles'
170+
type: Array
171+
item_type:
172+
type: String
173+
description: |
174+
A list of IAM roles that represent the set of operations that the sources
175+
specified in the corresponding `IngressFrom`
176+
are allowed to perform.
169177
- name: 'operations'
170178
type: Array
171179
description: |

‎mmv1/products/accesscontextmanager/ServicePerimeters.yaml

+36
Original file line numberDiff line numberDiff line change
@@ -293,6 +293,15 @@ properties:
293293
is_set: true
294294
item_type:
295295
type: String
296+
- name: 'roles'
297+
type: Array
298+
item_type:
299+
type: String
300+
is_set: true
301+
description: |
302+
A list of IAM roles that represent the set of operations that the sources
303+
specified in the corresponding `IngressFrom`
304+
are allowed to perform.
296305
- name: 'operations'
297306
type: Array
298307
description: |
@@ -405,6 +414,15 @@ properties:
405414
is_set: true
406415
item_type:
407416
type: String
417+
- name: 'roles'
418+
type: Array
419+
item_type:
420+
type: String
421+
is_set: true
422+
description: |
423+
A list of IAM roles that represent the set of operations that the sources
424+
specified in the corresponding `EgressFrom`
425+
are allowed to perform.
408426
- name: 'operations'
409427
type: Array
410428
description: |
@@ -592,6 +610,15 @@ properties:
592610
is_set: true
593611
item_type:
594612
type: String
613+
- name: 'roles'
614+
type: Array
615+
item_type:
616+
type: String
617+
is_set: true
618+
description: |
619+
A list of IAM roles that represent the set of operations that the sources
620+
specified in the corresponding `IngressFrom`
621+
are allowed to perform.
595622
- name: 'operations'
596623
type: Array
597624
description: |
@@ -706,6 +733,15 @@ properties:
706733
is_set: true
707734
item_type:
708735
type: String
736+
- name: 'roles'
737+
type: Array
738+
item_type:
739+
type: String
740+
is_set: true
741+
description: |
742+
A list of IAM roles that represent the set of operations that the sources
743+
specified in the corresponding `EgressFrom`
744+
are allowed to perform.
709745
- name: 'operations'
710746
type: Array
711747
description: |

‎mmv1/templates/terraform/custom_flatten/accesscontextmanager_serviceperimeters_custom_flatten.go.tmpl

+17
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,13 @@ func flatten{{$.GetPrefix}}{{$.TitlelizeProperty}}(v interface{}, d *schema.Reso
3434
return sorted
3535
}
3636

37+
func flattenStringArrayToStringSet(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
38+
if v == nil {
39+
return v
40+
}
41+
return schema.NewSet(schema.HashString, v.([]interface{}))
42+
}
43+
3744
func flattenAccessContextManagerServicePerimetersServicePerimetersName(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
3845
return v
3946
}
@@ -219,6 +226,8 @@ func flattenAccessContextManagerServicePerimetersServicePerimetersStatusIngressP
219226
flattenAccessContextManagerServicePerimetersServicePerimetersStatusIngressPoliciesIngressToResources(original["resources"], d, config)
220227
transformed["operations"] =
221228
flattenAccessContextManagerServicePerimetersServicePerimetersStatusIngressPoliciesIngressToOperations(original["operations"], d, config)
229+
transformed["roles"] =
230+
flattenStringArrayToStringSet(original["roles"], d, config)
222231
return []interface{}{transformed}
223232
}
224233
func flattenAccessContextManagerServicePerimetersServicePerimetersStatusIngressPoliciesIngressToResources(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
@@ -368,8 +377,11 @@ func flattenAccessContextManagerServicePerimetersServicePerimetersStatusEgressPo
368377
flattenAccessContextManagerServicePerimetersServicePerimetersStatusEgressPoliciesEgressToExternalResources(original["externalResources"], d, config)
369378
transformed["operations"] =
370379
flattenAccessContextManagerServicePerimetersServicePerimetersStatusEgressPoliciesEgressToOperations(original["operations"], d, config)
380+
transformed["roles"] =
381+
flattenStringArrayToStringSet(original["roles"], d, config)
371382
return []interface{}{transformed}
372383
}
384+
373385
func flattenAccessContextManagerServicePerimetersServicePerimetersStatusEgressPoliciesEgressToResources(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
374386
if v == nil {
375387
return v
@@ -591,6 +603,8 @@ func flattenAccessContextManagerServicePerimetersServicePerimetersSpecIngressPol
591603
flattenAccessContextManagerServicePerimetersServicePerimetersSpecIngressPoliciesIngressToResources(original["resources"], d, config)
592604
transformed["operations"] =
593605
flattenAccessContextManagerServicePerimetersServicePerimetersSpecIngressPoliciesIngressToOperations(original["operations"], d, config)
606+
transformed["roles"] =
607+
flattenStringArrayToStringSet(original["roles"], d, config)
594608
return []interface{}{transformed}
595609
}
596610
func flattenAccessContextManagerServicePerimetersServicePerimetersSpecIngressPoliciesIngressToResources(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
@@ -740,8 +754,11 @@ func flattenAccessContextManagerServicePerimetersServicePerimetersSpecEgressPoli
740754
flattenAccessContextManagerServicePerimetersServicePerimetersSpecEgressPoliciesEgressToExternalResources(original["externalResources"], d, config)
741755
transformed["operations"] =
742756
flattenAccessContextManagerServicePerimetersServicePerimetersSpecEgressPoliciesEgressToOperations(original["operations"], d, config)
757+
transformed["roles"] =
758+
flattenStringArrayToStringSet(original["roles"], d, config)
743759
return []interface{}{transformed}
744760
}
761+
745762
func flattenAccessContextManagerServicePerimetersServicePerimetersSpecEgressPoliciesEgressToResources(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
746763
if v == nil {
747764
return v

‎mmv1/templates/terraform/examples/access_context_manager_service_perimeter_granular_controls.tf.tmpl

+9-22
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,33 @@
11
resource "google_access_context_manager_access_policy" "access-policy" {
22
parent = "organizations/123456789"
3-
title = "Policy with Granular Controls Group Support"
3+
title = "Policy with Granular Controls Support"
44
}
55

6-
resource "google_access_context_manager_service_perimeter" "test-access" {
7-
parent = "accessPolicies/${google_access_context_manager_access_policy.test-access.name}"
8-
name = "accessPolicies/${google_access_context_manager_access_policy.test-access.name}/servicePerimeters/%s"
6+
resource "google_access_context_manager_service_perimeter" "granular-controls-perimeter" {
7+
parent = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}"
8+
name = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}/servicePerimeters/%s"
99
title = "%s"
1010
perimeter_type = "PERIMETER_TYPE_REGULAR"
1111
status {
12-
restricted_services = ["bigquery.googleapis.com", "storage.googleapis.com"]
12+
restricted_services = ["bigquery.googleapis.com"]
1313

1414
vpc_accessible_services {
1515
enable_restriction = true
16-
allowed_services = ["bigquery.googleapis.com", "storage.googleapis.com"]
16+
allowed_services = ["bigquery.googleapis.com"]
1717
}
1818

1919
ingress_policies {
2020
ingress_from {
2121
sources {
22-
access_level = google_access_context_manager_access_level.test-access.name
22+
resource = "projects/1234"
2323
}
2424
identities = ["group:[email protected]"]
2525
identities = ["principal://iam.googleapis.com/locations/global/workforcePools/1234/subject/janedoe"]
2626
identities = ["principalSet://iam.googleapis.com/locations/global/workforcePools/1234/*"]
2727
}
28-
2928
ingress_to {
3029
resources = [ "*" ]
31-
operations {
32-
service_name = "storage.googleapis.com"
33-
34-
method_selectors {
35-
method = "google.storage.objects.create"
36-
}
37-
}
30+
roles = ["roles/bigquery.admin", "organizations/1234/roles/bigquery_custom_role"]
3831
}
3932
}
4033

@@ -46,13 +39,7 @@ resource "google_access_context_manager_service_perimeter" "test-access" {
4639
}
4740
egress_to {
4841
resources = [ "*" ]
49-
operations {
50-
service_name = "storage.googleapis.com"
51-
52-
method_selectors {
53-
method = "google.storage.objects.create"
54-
}
55-
}
42+
roles = ["roles/bigquery.admin", "organizations/1234/roles/bigquery_custom_role"]
5643
}
5744
}
5845
}

‎mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_dry_run_egress_policy_test.go

+4
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,10 @@ resource "google_access_context_manager_service_perimeter_dry_run_egress_policy"
124124
}
125125
source_restriction = "SOURCE_RESTRICTION_ENABLED"
126126
}
127+
egress_to {
128+
resources = ["*"]
129+
roles = ["roles/bigquery.admin"]
130+
}
127131
depends_on = [google_access_context_manager_service_perimeter_dry_run_egress_policy.test-access1]
128132
}
129133

‎mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_dry_run_ingress_policy_test.go

+4
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,10 @@ resource "google_access_context_manager_service_perimeter_dry_run_ingress_policy
126126
access_level = google_access_context_manager_access_level.test-access.name
127127
}
128128
}
129+
ingress_to {
130+
resources = ["*"]
131+
roles = ["roles/bigquery.admin"]
132+
}
129133
depends_on = [google_access_context_manager_service_perimeter_dry_run_ingress_policy.test-access1]
130134
}
131135

‎mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_egress_policy_test.go

+4-1
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,6 @@ resource "google_access_context_manager_service_perimeter_egress_policy" "test-a
102102
}
103103
}
104104
}
105-
106105
}
107106
108107
resource "google_access_context_manager_access_level" "test-access" {
@@ -127,6 +126,10 @@ resource "google_access_context_manager_service_perimeter_egress_policy" "test-a
127126
}
128127
source_restriction = "SOURCE_RESTRICTION_ENABLED"
129128
}
129+
egress_to {
130+
resources = ["*"]
131+
roles = ["roles/bigquery.admin"]
132+
}
130133
}
131134
132135
`, testAccAccessContextManagerServicePerimeterEgressPolicy_destroy(org, policyTitle, perimeterTitleName))

‎mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_ingress_policy_test.go

+4
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,10 @@ resource "google_access_context_manager_service_perimeter_ingress_policy" "test-
127127
ingress_from {
128128
identity_type = "ANY_IDENTITY"
129129
}
130+
ingress_to {
131+
resources = ["*"]
132+
roles = ["roles/bigquery.admin"]
133+
}
130134
}
131135
132136
`, testAccAccessContextManagerServicePerimeterIngressPolicy_destroy(org, policyTitle, perimeterTitleName))

‎mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_test.go.tmpl

+10
Original file line numberDiff line numberDiff line change
@@ -338,6 +338,7 @@ resource "google_access_context_manager_service_perimeter" "test-access" {
338338
}
339339
ingress_to {
340340
resources = ["*"]
341+
roles = ["roles/bigquery.admin"]
341342
}
342343
}
343344

@@ -367,6 +368,15 @@ resource "google_access_context_manager_service_perimeter" "test-access" {
367368
resources = ["*"]
368369
}
369370
}
371+
egress_policies {
372+
egress_from {
373+
identity_type = "ANY_IDENTITY"
374+
}
375+
egress_to {
376+
resources = ["*"]
377+
roles = ["roles/bigquery.admin"]
378+
}
379+
}
370380
}
371381
}
372382
`, org, policyTitle, levelTitleName, levelTitleName, perimeterTitleName, perimeterTitleName)

0 commit comments

Comments
 (0)