Skip to content

Commit 9c562c5

Browse files
derekchu-googleSarahFrench
derekchu-google
and
SarahFrench
authored
add google_iam_principal_access_boundary_policy resource (#12044)
Co-authored-by: Sarah French <[email protected]>
1 parent 4eb884b commit 9c562c5

File tree

6 files changed

+287
-0
lines changed

6 files changed

+287
-0
lines changed

‎mmv1/products/iam3/PrincipalAccessBoundaryPolicy.yaml

+161
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
# Copyright 2024 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
name: 'PrincipalAccessBoundaryPolicy'
16+
description: An IAM Principal Access Boundary Policy resource
17+
references:
18+
guides:
19+
'Create and apply Principal Access Boundaries': 'https://cloud.google.com/iam/docs/principal-access-boundary-policies-create'
20+
api: 'https://cloud.google.com/iam/docs/reference/rest/v3beta/organizations.locations.principalAccessBoundaryPolicies'
21+
min_version: 'beta'
22+
id_format: 'organizations/{{organization}}/locations/{{location}}/principalAccessBoundaryPolicies/{{principal_access_boundary_policy_id}}'
23+
base_url: 'organizations/{{organization}}/locations/{{location}}/principalAccessBoundaryPolicies'
24+
self_link: 'organizations/{{organization}}/locations/{{location}}/principalAccessBoundaryPolicies/{{principal_access_boundary_policy_id}}'
25+
create_url: 'organizations/{{organization}}/locations/{{location}}/principalAccessBoundaryPolicies?principalAccessBoundaryPolicyId={{principal_access_boundary_policy_id}}'
26+
update_verb: 'PATCH'
27+
update_mask: true
28+
import_format:
29+
- 'organizations/{{organization}}/locations/{{location}}/principalAccessBoundaryPolicies/{{principal_access_boundary_policy_id}}'
30+
timeouts:
31+
insert_minutes: 20
32+
update_minutes: 20
33+
delete_minutes: 20
34+
autogen_async: true
35+
async:
36+
actions: ['create', 'delete', 'update']
37+
type: 'OpAsync'
38+
operation:
39+
base_url: '{{op_id}}'
40+
path: 'name'
41+
wait_ms: 1000
42+
result:
43+
path: 'response'
44+
resource_inside_response: true
45+
error:
46+
path: 'error'
47+
message: 'message'
48+
examples:
49+
- name: 'iam_principal_access_boundary_policy'
50+
min_version: 'beta'
51+
primary_resource_id: 'my-pab-policy'
52+
test_env_vars:
53+
org_id: 'ORG_ID'
54+
vars:
55+
display_name: 'test pab policy'
56+
pab_id: 'test-pab-policy'
57+
parameters:
58+
- name: 'organization'
59+
type: String
60+
description: |
61+
The parent organization of the principal access boundary policy.
62+
url_param_only: true
63+
required: true
64+
immutable: true
65+
- name: 'location'
66+
type: String
67+
description: |
68+
The location the principal access boundary policy is in.
69+
url_param_only: true
70+
required: true
71+
immutable: true
72+
- name: 'principalAccessBoundaryPolicyId'
73+
type: String
74+
description: |
75+
The ID to use to create the principal access boundary policy.
76+
This value must start with a lowercase letter followed by up to 62 lowercase letters, numbers, hyphens, or dots. Pattern, /a-z{2,62}/.
77+
url_param_only: true
78+
required: true
79+
immutable: true
80+
properties:
81+
- name: 'name'
82+
type: String
83+
description: |
84+
Identifier. The resource name of the principal access boundary policy. The following format is supported:
85+
`organizations/{organization_id}/locations/{location}/principalAccessBoundaryPolicies/{policy_id}`
86+
output: true
87+
- name: 'uid'
88+
type: String
89+
description: |
90+
Output only. The globally unique ID of the principal access boundary policy.
91+
output: true
92+
- name: 'etag'
93+
type: String
94+
description: |
95+
The etag for the principal access boundary. If this is provided on update, it must match the server's etag.
96+
output: true
97+
- name: 'displayName'
98+
type: String
99+
description: |
100+
The description of the principal access boundary policy. Must be less than or equal to 63 characters.
101+
- name: 'annotations'
102+
type: KeyValueAnnotations
103+
description: |
104+
User defined annotations. See https://google.aip.dev/148#annotations
105+
for more details such as format and size limitations
106+
- name: 'createTime'
107+
type: String
108+
description: |
109+
Output only. The time when the principal access boundary policy was created.
110+
output: true
111+
- name: 'updateTime'
112+
type: String
113+
description: |
114+
Output only. The time when the principal access boundary policy was most recently updated.
115+
output: true
116+
- name: 'details'
117+
type: NestedObject
118+
description: |
119+
Principal access boundary policy details
120+
default_from_api: true
121+
properties:
122+
- name: 'rules'
123+
type: Array
124+
description: |
125+
A list of principal access boundary policy rules. The number of rules in a policy is limited to 500.
126+
required: true
127+
item_type:
128+
type: NestedObject
129+
properties:
130+
- name: 'description'
131+
type: String
132+
description: |
133+
The description of the principal access boundary policy rule. Must be less than or equal to 256 characters.
134+
- name: 'resources'
135+
type: Array
136+
description: |
137+
A list of Cloud Resource Manager resources. The resource
138+
and all the descendants are included. The number of resources in a policy
139+
is limited to 500 across all rules.
140+
The following resource types are supported:
141+
* Organizations, such as `//cloudresourcemanager.googleapis.com/organizations/123`.
142+
* Folders, such as `//cloudresourcemanager.googleapis.com/folders/123`.
143+
* Projects, such as `//cloudresourcemanager.googleapis.com/projects/123`
144+
or `//cloudresourcemanager.googleapis.com/projects/my-project-id`.
145+
required: true
146+
item_type:
147+
type: String
148+
- name: 'effect'
149+
type: String
150+
description: |
151+
The access relationship of principals to the resources in this rule.
152+
Possible values: ALLOW
153+
required: true
154+
- name: 'enforcementVersion'
155+
type: String
156+
description: |
157+
The version number that indicates which Google Cloud services
158+
are included in the enforcement (e.g. \"latest\", \"1\", ...). If empty, the
159+
PAB policy version will be set to the current latest version, and this version
160+
won't get updated when new versions are released.
161+
default_from_api: true

‎mmv1/products/iam3/product.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Copyright 2024 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
---
14+
name: 'IAM3'
15+
legacy_name: 'iam'
16+
display_name: 'Cloud IAM'
17+
versions:
18+
- name: 'beta'
19+
base_url: 'https://iam.googleapis.com/v3beta/'
20+
scopes:
21+
- 'https://www.googleapis.com/auth/iam'

‎mmv1/templates/terraform/examples/iam_principal_access_boundary_policy.tf.tmpl

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resource "google_iam_principal_access_boundary_policy" "{{$.PrimaryResourceId}}" {
2+
provider = google-beta
3+
organization = "{{index $.TestEnvVars "org_id"}}"
4+
location = "global"
5+
display_name = "{{index $.Vars "display_name"}}"
6+
principal_access_boundary_policy_id = "{{index $.Vars "pab_id"}}"
7+
}

‎mmv1/third_party/terraform/.teamcity/components/inputs/services_beta.kt

+5
Original file line numberDiff line numberDiff line change
@@ -446,6 +446,11 @@ var ServicesListBeta = mapOf(
446446
"displayName" to "Iam2",
447447
"path" to "./google-beta/services/iam2"
448448
),
449+
"iam3" to mapOf(
450+
"name" to "iam3",
451+
"displayName" to "Iam3",
452+
"path" to "./google-beta/services/iam3"
453+
),
449454
"iambeta" to mapOf(
450455
"name" to "iambeta",
451456
"displayName" to "Iambeta",

‎mmv1/third_party/terraform/.teamcity/components/inputs/services_ga.kt

+5
Original file line numberDiff line numberDiff line change
@@ -441,6 +441,11 @@ var ServicesListGa = mapOf(
441441
"displayName" to "Iam2",
442442
"path" to "./google/services/iam2"
443443
),
444+
"iam3" to mapOf(
445+
"name" to "iam3",
446+
"displayName" to "Iam3",
447+
"path" to "./google/services/iam3"
448+
),
444449
"iambeta" to mapOf(
445450
"name" to "iambeta",
446451
"displayName" to "Iambeta",

‎mmv1/third_party/terraform/services/iam3/resource_iam_principal_access_boundary_policy_test.go.tmpl

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
package iam3_test
2+
{{- if ne $.TargetVersionName "ga" }}
3+
4+
import (
5+
"testing"
6+
7+
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
8+
"github.com/hashicorp/terraform-provider-google/google/acctest"
9+
"github.com/hashicorp/terraform-provider-google/google/envvar"
10+
)
11+
12+
func TestAccIAM3PrincipalAccessBoundaryPolicy_iam3PrincipalAccessBoundaryPolicyExample_update(t *testing.T) {
13+
t.Parallel()
14+
15+
context := map[string]interface{}{
16+
"org_id": envvar.GetTestOrgFromEnv(t),
17+
"random_suffix": acctest.RandString(t, 10),
18+
}
19+
20+
acctest.VcrTest(t, resource.TestCase{
21+
PreCheck: func() { acctest.AccTestPreCheck(t) },
22+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
23+
CheckDestroy: testAccCheckIAM3PrincipalAccessBoundaryPolicyDestroyProducer(t),
24+
Steps: []resource.TestStep{
25+
{
26+
Config: testAccIAM3PrincipalAccessBoundaryPolicy_iam3PrincipalAccessBoundaryPolicyExample_full(context),
27+
},
28+
{
29+
ResourceName: "google_iam_principal_access_boundary_policy.my-pab-policy",
30+
ImportState: true,
31+
ImportStateVerify: true,
32+
ImportStateVerifyIgnore: []string{"annotations", "location", "organization", "principal_access_boundary_policy_id", "etag"},
33+
},
34+
{
35+
Config: testAccIAM3PrincipalAccessBoundaryPolicy_iam3PrincipalAccessBoundaryPolicyExample_update(context),
36+
},
37+
{
38+
ResourceName: "google_iam_principal_access_boundary_policy.my-pab-policy",
39+
ImportState: true,
40+
ImportStateVerify: true,
41+
ImportStateVerifyIgnore: []string{"annotations", "location", "organization", "principal_access_boundary_policy_id", "etag"},
42+
},
43+
},
44+
})
45+
}
46+
47+
func testAccIAM3PrincipalAccessBoundaryPolicy_iam3PrincipalAccessBoundaryPolicyExample_full(context map[string]interface{}) string {
48+
return acctest.Nprintf(`
49+
resource "google_iam_principal_access_boundary_policy" "my-pab-policy" {
50+
provider = google-beta
51+
organization = "%{org_id}"
52+
location = "global"
53+
display_name = "test pab policy%{random_suffix}"
54+
principal_access_boundary_policy_id = "test-pab-policy%{random_suffix}"
55+
}
56+
`, context)
57+
}
58+
59+
func testAccIAM3PrincipalAccessBoundaryPolicy_iam3PrincipalAccessBoundaryPolicyExample_update(context map[string]interface{}) string {
60+
return acctest.Nprintf(`
61+
62+
resource "google_project" "project" {
63+
provider = google-beta
64+
project_id = "tf-test%{random_suffix}"
65+
name = "tf-test%{random_suffix}"
66+
org_id = "%{org_id}"
67+
deletion_policy = "DELETE"
68+
}
69+
70+
resource "google_iam_principal_access_boundary_policy" "my-pab-policy" {
71+
provider = google-beta
72+
organization = "%{org_id}"
73+
location = "global"
74+
display_name = "test pab policy%{random_suffix}"
75+
principal_access_boundary_policy_id = "test-pab-policy%{random_suffix}"
76+
annotations = {"foo": "bar"}
77+
details {
78+
rules {
79+
description = "PAB rule%{random_suffix}"
80+
effect = "ALLOW"
81+
resources = ["//cloudresourcemanager.googleapis.com/projects/${google_project.project.project_id}"]
82+
}
83+
enforcement_version = "1"
84+
}
85+
}
86+
`, context)
87+
}
88+
{{- end }}

0 commit comments

Comments
 (0)