Skip to content

Commit 43ea874

Browse files
Angelina612Angelina612
authored
Support for projects in EgressSource (#12532)
1 parent c9d389d commit 43ea874

11 files changed

+134
-14
lines changed

‎mmv1/products/accesscontextmanager/ServicePerimeter.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -384,6 +384,15 @@ properties:
384384
- name: 'accessLevel'
385385
type: String
386386
description: 'An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside.'
387+
- name: 'resource'
388+
type: String
389+
description: |
390+
A Google Cloud resource that is allowed to egress the perimeter.
391+
Requests from these resources are allowed to access data outside the perimeter.
392+
Currently only projects are allowed. Project format: `projects/{project_number}`.
393+
The resource may be in any Google Cloud organization, not just the
394+
organization that the perimeter is defined in. `*` is not allowed, the
395+
case of allowing all Google Cloud resources only is not supported.
387396
- name: 'sourceRestriction'
388397
type: Enum
389398
description: 'Whether to enforce traffic restrictions based on `sources` field. If the `sources` field is non-empty, then this field must be set to `SOURCE_RESTRICTION_ENABLED`.'
@@ -693,6 +702,15 @@ properties:
693702
- name: 'accessLevel'
694703
type: String
695704
description: 'An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside.'
705+
- name: 'resource'
706+
type: String
707+
description: |
708+
A Google Cloud resource that is allowed to egress the perimeter.
709+
Requests from these resources are allowed to access data outside the perimeter.
710+
Currently only projects are allowed. Project format: `projects/{project_number}`.
711+
The resource may be in any Google Cloud organization, not just the
712+
organization that the perimeter is defined in. `*` is not allowed, the
713+
case of allowing all Google Cloud resources only is not supported.
696714
- name: 'sourceRestriction'
697715
type: Enum
698716
description: 'Whether to enforce traffic restrictions based on `sources` field. If the `sources` field is non-empty, then this field must be set to `SOURCE_RESTRICTION_ENABLED`.'

‎mmv1/products/accesscontextmanager/ServicePerimeterDryRunEgressPolicy.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,15 @@ properties:
128128
- name: 'accessLevel'
129129
type: String
130130
description: 'An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside.'
131+
- name: 'resource'
132+
type: String
133+
description: |
134+
A Google Cloud resource that is allowed to egress the perimeter.
135+
Requests from these resources are allowed to access data outside the perimeter.
136+
Currently only projects are allowed. Project format: `projects/{project_number}`.
137+
The resource may be in any Google Cloud organization, not just the
138+
organization that the perimeter is defined in. `*` is not allowed, the
139+
case of allowing all Google Cloud resources only is not supported.
131140
- name: 'sourceRestriction'
132141
type: Enum
133142
description: 'Whether to enforce traffic restrictions based on `sources` field. If the `sources` field is non-empty, then this field must be set to `SOURCE_RESTRICTION_ENABLED`.'

‎mmv1/products/accesscontextmanager/ServicePerimeterEgressPolicy.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,15 @@ properties:
125125
- name: 'accessLevel'
126126
type: String
127127
description: 'An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside.'
128+
- name: 'resource'
129+
type: String
130+
description: |
131+
A Google Cloud resource that is allowed to egress the perimeter.
132+
Requests from these resources are allowed to access data outside the perimeter.
133+
Currently only projects are allowed. Project format: `projects/{project_number}`.
134+
The resource may be in any Google Cloud organization, not just the
135+
organization that the perimeter is defined in. `*` is not allowed, the
136+
case of allowing all Google Cloud resources only is not supported.
128137
- name: 'sourceRestriction'
129138
type: Enum
130139
description: 'Whether to enforce traffic restrictions based on `sources` field. If the `sources` field is non-empty, then this field must be set to `SOURCE_RESTRICTION_ENABLED`.'

‎mmv1/products/accesscontextmanager/ServicePerimeters.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -373,6 +373,15 @@ properties:
373373
- name: 'accessLevel'
374374
type: String
375375
description: 'An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside.'
376+
- name: 'resource'
377+
type: String
378+
description: |
379+
A Google Cloud resource that is allowed to egress the perimeter.
380+
Requests from these resources are allowed to access data outside the perimeter.
381+
Currently only projects are allowed. Project format: `projects/{project_number}`.
382+
The resource may be in any Google Cloud organization, not just the
383+
organization that the perimeter is defined in. `*` is not allowed, the
384+
case of allowing all Google Cloud resources only is not supported.
376385
- name: 'sourceRestriction'
377386
type: Enum
378387
description: 'Whether to enforce traffic restrictions based on `sources` field. If the `sources` field is non-empty, then this field must be set to `SOURCE_RESTRICTION_ENABLED`.'
@@ -674,6 +683,15 @@ properties:
674683
- name: 'accessLevel'
675684
type: String
676685
description: 'An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside.'
686+
- name: 'resource'
687+
type: String
688+
description: |
689+
A Google Cloud resource that is allowed to egress the perimeter.
690+
Requests from these resources are allowed to access data outside the perimeter.
691+
Currently only projects are allowed. Project format: `projects/{project_number}`.
692+
The resource may be in any Google Cloud organization, not just the
693+
organization that the perimeter is defined in. `*` is not allowed, the
694+
case of allowing all Google Cloud resources only is not supported.
677695
- name: 'sourceRestriction'
678696
type: Enum
679697
description: 'Whether to enforce traffic restrictions based on `sources` field. If the `sources` field is non-empty, then this field must be set to `SOURCE_RESTRICTION_ENABLED`.'

‎mmv1/templates/terraform/custom_flatten/accesscontextmanager_serviceperimeters_custom_flatten.go.tmpl

+10
Original file line numberDiff line numberDiff line change
@@ -341,6 +341,7 @@ func flattenAccessContextManagerServicePerimetersServicePerimetersStatusEgressPo
341341
}
342342
transformed = append(transformed, map[string]interface{}{
343343
"access_level": flattenAccessContextManagerServicePerimetersServicePerimetersStatusEgressPoliciesEgressFromSourcesAccessLevel(original["accessLevel"], d, config),
344+
"resource": flattenAccessContextManagerServicePerimetersServicePerimetersStatusEgressPoliciesEgressFromSourcesResource(original["resource"], d, config),
344345
})
345346
}
346347
return transformed
@@ -349,6 +350,10 @@ func flattenAccessContextManagerServicePerimetersServicePerimetersStatusEgressPo
349350
return v
350351
}
351352

353+
func flattenAccessContextManagerServicePerimetersServicePerimetersStatusEgressPoliciesEgressFromSourcesResource(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
354+
return v
355+
}
356+
352357
func flattenAccessContextManagerServicePerimetersServicePerimetersStatusEgressPoliciesEgressFromSourceRestriction(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
353358
return v
354359
}
@@ -713,6 +718,7 @@ func flattenAccessContextManagerServicePerimetersServicePerimetersSpecEgressPoli
713718
}
714719
transformed = append(transformed, map[string]interface{}{
715720
"access_level": flattenAccessContextManagerServicePerimetersServicePerimetersSpecEgressPoliciesEgressFromSourcesAccessLevel(original["accessLevel"], d, config),
721+
"resource": flattenAccessContextManagerServicePerimetersServicePerimetersSpecEgressPoliciesEgressFromSourcesResource(original["resource"], d, config),
716722
})
717723
}
718724
return transformed
@@ -721,6 +727,10 @@ func flattenAccessContextManagerServicePerimetersServicePerimetersSpecEgressPoli
721727
return v
722728
}
723729

730+
func flattenAccessContextManagerServicePerimetersServicePerimetersSpecEgressPoliciesEgressFromSourcesResource(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
731+
return v
732+
}
733+
724734
func flattenAccessContextManagerServicePerimetersServicePerimetersSpecEgressPoliciesEgressFromSourceRestriction(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
725735
return v
726736
}

‎mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_dry_run_egress_policy_test.go

+14-3
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,14 @@ func testAccAccessContextManagerServicePerimeterDryRunEgressPolicy_basicTest(t *
2020
//projects := acctest.BootstrapServicePerimeterProjects(t, 1)
2121
policyTitle := acctest.RandString(t, 10)
2222
perimeterTitle := "perimeter"
23+
projectNumber := envvar.GetTestProjectNumberFromEnv()
2324

2425
acctest.VcrTest(t, resource.TestCase{
2526
PreCheck: func() { acctest.AccTestPreCheck(t) },
2627
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
2728
Steps: []resource.TestStep{
2829
{
29-
Config: testAccAccessContextManagerServicePerimeterDryRunEgressPolicy_basic(org, policyTitle, perimeterTitle),
30+
Config: testAccAccessContextManagerServicePerimeterDryRunEgressPolicy_basic(org, policyTitle, perimeterTitle, projectNumber),
3031
},
3132
{
3233
Config: testAccAccessContextManagerServicePerimeterDryRunEgressPolicy_destroy(org, policyTitle, perimeterTitle),
@@ -83,7 +84,7 @@ func testAccCheckAccessContextManagerServicePerimeterDryRunEgressPolicyDestroyPr
8384
}
8485
}
8586

86-
func testAccAccessContextManagerServicePerimeterDryRunEgressPolicy_basic(org, policyTitle, perimeterTitleName string) string {
87+
func testAccAccessContextManagerServicePerimeterDryRunEgressPolicy_basic(org, policyTitle, perimeterTitleName, projectNumber string) string {
8788
return fmt.Sprintf(`
8889
%s
8990
@@ -127,7 +128,17 @@ resource "google_access_context_manager_service_perimeter_dry_run_egress_policy"
127128
depends_on = [google_access_context_manager_service_perimeter_dry_run_egress_policy.test-access1]
128129
}
129130
130-
`, testAccAccessContextManagerServicePerimeterDryRunEgressPolicy_destroy(org, policyTitle, perimeterTitleName))
131+
resource "google_access_context_manager_service_perimeter_dry_run_egress_policy" "test-access3" {
132+
perimeter = google_access_context_manager_service_perimeter.test-access.name
133+
egress_from {
134+
sources {
135+
resource = "projects/%s"
136+
}
137+
source_restriction = "SOURCE_RESTRICTION_ENABLED"
138+
}
139+
}
140+
141+
`, testAccAccessContextManagerServicePerimeterDryRunEgressPolicy_destroy(org, policyTitle, perimeterTitleName), projectNumber)
131142
}
132143

133144
func testAccAccessContextManagerServicePerimeterDryRunEgressPolicy_destroy(org, policyTitle, perimeterTitleName string) string {

‎mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_egress_policy_test.go

+14-3
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,14 @@ func testAccAccessContextManagerServicePerimeterEgressPolicy_basicTest(t *testin
2222
//projects := acctest.BootstrapServicePerimeterProjects(t, 1)
2323
policyTitle := acctest.RandString(t, 10)
2424
perimeterTitle := "perimeter"
25+
projectNumber := envvar.GetTestProjectNumberFromEnv()
2526

2627
acctest.VcrTest(t, resource.TestCase{
2728
PreCheck: func() { acctest.AccTestPreCheck(t) },
2829
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
2930
Steps: []resource.TestStep{
3031
{
31-
Config: testAccAccessContextManagerServicePerimeterEgressPolicy_basic(org, policyTitle, perimeterTitle),
32+
Config: testAccAccessContextManagerServicePerimeterEgressPolicy_basic(org, policyTitle, perimeterTitle, projectNumber),
3233
},
3334
{
3435
Config: testAccAccessContextManagerServicePerimeterEgressPolicy_destroy(org, policyTitle, perimeterTitle),
@@ -85,7 +86,7 @@ func testAccCheckAccessContextManagerServicePerimeterEgressPolicyDestroyProducer
8586
}
8687
}
8788

88-
func testAccAccessContextManagerServicePerimeterEgressPolicy_basic(org, policyTitle, perimeterTitleName string) string {
89+
func testAccAccessContextManagerServicePerimeterEgressPolicy_basic(org, policyTitle, perimeterTitleName, projectNumber string) string {
8990
return fmt.Sprintf(`
9091
%s
9192
@@ -129,7 +130,17 @@ resource "google_access_context_manager_service_perimeter_egress_policy" "test-a
129130
}
130131
}
131132
132-
`, testAccAccessContextManagerServicePerimeterEgressPolicy_destroy(org, policyTitle, perimeterTitleName))
133+
resource "google_access_context_manager_service_perimeter_egress_policy" "test-access3" {
134+
perimeter = google_access_context_manager_service_perimeter.test-access.name
135+
egress_from {
136+
sources {
137+
resource = "projects/%s"
138+
}
139+
source_restriction = "SOURCE_RESTRICTION_ENABLED"
140+
}
141+
}
142+
143+
`, testAccAccessContextManagerServicePerimeterEgressPolicy_destroy(org, policyTitle, perimeterTitleName), projectNumber)
133144
}
134145

135146
func testAccAccessContextManagerServicePerimeterEgressPolicy_destroy(org, policyTitle, perimeterTitleName string) string {

‎mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_service_perimeter_test.go.tmpl

+15-4
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ func testAccAccessContextManagerServicePerimeter_basicTest(t *testing.T) {
3838

3939
func testAccAccessContextManagerServicePerimeter_updateTest(t *testing.T) {
4040
org := envvar.GetTestOrgFromEnv(t)
41+
projectNumber := envvar.GetTestProjectNumberFromEnv()
4142

4243
acctest.VcrTest(t, resource.TestCase{
4344
PreCheck: func() { acctest.AccTestPreCheck(t) },
@@ -61,7 +62,7 @@ func testAccAccessContextManagerServicePerimeter_updateTest(t *testing.T) {
6162
ImportStateVerify: true,
6263
},
6364
{
64-
Config: testAccAccessContextManagerServicePerimeter_updateAllowed(org, "my policy", "level", "perimeter"),
65+
Config: testAccAccessContextManagerServicePerimeter_updateAllowed(org, "my policy", "level", "perimeter", projectNumber),
6566
},
6667
{
6768
ResourceName: "google_access_context_manager_service_perimeter.test-access",
@@ -77,7 +78,7 @@ func testAccAccessContextManagerServicePerimeter_updateTest(t *testing.T) {
7778
ImportStateVerify: true,
7879
},
7980
{
80-
Config: testAccAccessContextManagerServicePerimeter_updateAllowed(org, "my policy", "level", "perimeter"),
81+
Config: testAccAccessContextManagerServicePerimeter_updateAllowed(org, "my policy", "level", "perimeter", projectNumber),
8182
},
8283
{
8384
ResourceName: "google_access_context_manager_service_perimeter.test-access",
@@ -182,7 +183,7 @@ resource "google_access_context_manager_service_perimeter" "test-access" {
182183
`, org, policyTitle, levelTitleName, levelTitleName, perimeterTitleName, perimeterTitleName)
183184
}
184185

185-
func testAccAccessContextManagerServicePerimeter_updateAllowed(org, policyTitle, levelTitleName, perimeterTitleName string) string {
186+
func testAccAccessContextManagerServicePerimeter_updateAllowed(org, policyTitle, levelTitleName, perimeterTitleName, projectNumber string) string {
186187
return fmt.Sprintf(`
187188
resource "google_access_context_manager_access_policy" "test-access" {
188189
parent = "organizations/%s"
@@ -267,6 +268,11 @@ resource "google_access_context_manager_service_perimeter" "test-access" {
267268
sources {
268269
access_level = google_access_context_manager_access_level.test-access.name
269270
}
271+
272+
sources {
273+
resource = "projects/%s"
274+
}
275+
270276
source_restriction = "SOURCE_RESTRICTION_ENABLED"
271277
}
272278
egress_to {
@@ -347,6 +353,11 @@ resource "google_access_context_manager_service_perimeter" "test-access" {
347353
sources {
348354
access_level = google_access_context_manager_access_level.test-access.name
349355
}
356+
357+
sources {
358+
resource = "projects/%s"
359+
}
360+
350361
source_restriction = "SOURCE_RESTRICTION_ENABLED"
351362
}
352363
egress_to {
@@ -369,7 +380,7 @@ resource "google_access_context_manager_service_perimeter" "test-access" {
369380
}
370381
}
371382
}
372-
`, org, policyTitle, levelTitleName, levelTitleName, perimeterTitleName, perimeterTitleName)
383+
`, org, policyTitle, levelTitleName, levelTitleName, perimeterTitleName, perimeterTitleName, projectNumber, projectNumber)
373384
}
374385

375386
func testAccAccessContextManagerServicePerimeter_updateDryrun(org, policyTitle, levelTitleName, perimeterTitleName string) string {

‎mmv1/third_party/terraform/services/accesscontextmanager/resource_access_context_manager_services_perimeters_test.go

+20-3
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import (
1616
// can exist, they need to be run serially. See AccessPolicy for the test runner.
1717
func testAccAccessContextManagerServicePerimeters_basicTest(t *testing.T) {
1818
org := envvar.GetTestOrgFromEnv(t)
19+
projectNumber := envvar.GetTestProjectNumberFromEnv()
1920

2021
acctest.VcrTest(t, resource.TestCase{
2122
PreCheck: func() { acctest.AccTestPreCheck(t) },
@@ -32,7 +33,7 @@ func testAccAccessContextManagerServicePerimeters_basicTest(t *testing.T) {
3233
ImportStateVerifyIgnore: []string{"service_perimeters"},
3334
},
3435
{
35-
Config: testAccAccessContextManagerServicePerimeters_update(org, "my policy", "level", "storage_perimeter", "bigquery_perimeter", "bigtable_perimeter", "bigquery_omni_perimeter"),
36+
Config: testAccAccessContextManagerServicePerimeters_update(org, "my policy", "level", "storage_perimeter", "bigquery_perimeter", "bigtable_perimeter", "bigquery_omni_perimeter", projectNumber),
3637
},
3738
{
3839
ResourceName: "google_access_context_manager_service_perimeters.test-access",
@@ -153,7 +154,7 @@ resource "google_access_context_manager_service_perimeters" "test-access" {
153154
`, org, policyTitle, levelTitleName, levelTitleName, perimeterTitleName1, perimeterTitleName1, perimeterTitleName2, perimeterTitleName2, perimeterTitleName3, perimeterTitleName3)
154155
}
155156

156-
func testAccAccessContextManagerServicePerimeters_update(org, policyTitle, levelTitleName, perimeterTitleName1, perimeterTitleName2, perimeterTitleName3, perimeterTitleName4 string) string {
157+
func testAccAccessContextManagerServicePerimeters_update(org, policyTitle, levelTitleName, perimeterTitleName1, perimeterTitleName2, perimeterTitleName3, perimeterTitleName4, projectNumber string) string {
157158
return fmt.Sprintf(`
158159
resource "google_access_context_manager_access_policy" "test-access" {
159160
parent = "organizations/%s"
@@ -285,6 +286,14 @@ resource "google_access_context_manager_service_perimeters" "test-access" {
285286
resources = ["*"]
286287
}
287288
}
289+
egress_policies {
290+
egress_from {
291+
sources {
292+
resource = "projects/%s"
293+
}
294+
source_restriction = "SOURCE_RESTRICTION_ENABLED"
295+
}
296+
}
288297
}
289298
status {
290299
restricted_services = ["bigquery.googleapis.com", "storage.googleapis.com"]
@@ -361,10 +370,18 @@ resource "google_access_context_manager_service_perimeters" "test-access" {
361370
resources = ["*"]
362371
}
363372
}
373+
egress_policies {
374+
egress_from {
375+
sources {
376+
resource = "projects/%s"
377+
}
378+
source_restriction = "SOURCE_RESTRICTION_ENABLED"
379+
}
380+
}
364381
}
365382
}
366383
}
367-
`, org, policyTitle, levelTitleName, levelTitleName, perimeterTitleName1, perimeterTitleName1, perimeterTitleName2, perimeterTitleName2, perimeterTitleName3, perimeterTitleName3, perimeterTitleName4, perimeterTitleName4)
384+
`, org, policyTitle, levelTitleName, levelTitleName, perimeterTitleName1, perimeterTitleName1, perimeterTitleName2, perimeterTitleName2, perimeterTitleName3, perimeterTitleName3, perimeterTitleName4, perimeterTitleName4, projectNumber, projectNumber)
368385
}
369386

370387
func testAccAccessContextManagerServicePerimeters_empty(org, policyTitle, levelTitleName string) string {

‎mmv1/third_party/tgc/tests/data/example_access_context_manager_service_perimeter.json

+3
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@
2020
"sources": [
2121
{
2222
"accessLevel": "accessPolicies/987654/accessLevels/restrict_storage"
23+
},
24+
{
25+
"resource": "projects/4321"
2326
}
2427
]
2528
}

0 commit comments

Comments
 (0)