Skip to content

Commit a693e81

Browse files
derekchu-googlederekchu-google
committed
add principal access boundary policy resource.
Fixes hashicorp/terraform-provider-google#19905
1 parent a88f745 commit a693e81

File tree

4 files changed

+304
-0
lines changed

4 files changed

+304
-0
lines changed

‎mmv1/products/iam3/PrincipalAccessBoundaryPolicy.yaml

+157
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
# Copyright 2024 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
name: 'PrincipalAccessBoundaryPolicy'
16+
description: Description
17+
id_format: 'organizations/{{organization}}/locations/{{location}}/principalAccessBoundaryPolicies/{{principal_access_boundary_policy_id}}'
18+
base_url: 'organizations/{{organization}}/locations/{{location}}/principalAccessBoundaryPolicies'
19+
self_link: 'organizations/{{organization}}/locations/{{location}}/principalAccessBoundaryPolicies/{{principal_access_boundary_policy_id}}'
20+
create_url: 'organizations/{{organization}}/locations/{{location}}/principalAccessBoundaryPolicies?principalAccessBoundaryPolicyId={{principal_access_boundary_policy_id}}'
21+
update_verb: 'PATCH'
22+
update_mask: true
23+
import_format:
24+
- 'organizations/{{organization}}/locations/{{location}}/principalAccessBoundaryPolicies/{{principal_access_boundary_policy_id}}'
25+
timeouts:
26+
insert_minutes: 20
27+
update_minutes: 20
28+
delete_minutes: 20
29+
autogen_async: true
30+
async:
31+
actions: ['create', 'delete', 'update']
32+
type: 'OpAsync'
33+
operation:
34+
base_url: '{{op_id}}'
35+
path: 'name'
36+
wait_ms: 1000
37+
result:
38+
path: 'response'
39+
resource_inside_response: true
40+
error:
41+
path: 'error'
42+
message: 'message'
43+
examples:
44+
- name: 'iam3_principal_access_boundary_policy'
45+
primary_resource_id: 'my-pab-policy'
46+
test_env_vars:
47+
org_id: 'ORG_ID'
48+
vars:
49+
organization: 'ORG_ID'
50+
location: 'global'
51+
display_name: 'test pab policy'
52+
pab_id: 'test-pab-policy'
53+
parameters:
54+
- name: 'organization'
55+
type: String
56+
description: |
57+
The parent organization of the principal access boundary policy.
58+
url_param_only: true
59+
required: true
60+
immutable: true
61+
- name: 'location'
62+
type: String
63+
description: |
64+
The location the principal access boundary policy is in.
65+
url_param_only: true
66+
required: true
67+
immutable: true
68+
- name: 'principalAccessBoundaryPolicyId'
69+
type: String
70+
description: |
71+
The ID to use to create the principal access boundary policy.
72+
This value must start with a lowercase letter followed by up to 62 lowercase letters, numbers, hyphens, or dots. Pattern, /a-z{2,62}/.
73+
url_param_only: true
74+
required: true
75+
immutable: true
76+
properties:
77+
- name: 'name'
78+
type: String
79+
description: |
80+
Identifier. The resource name of the principal access boundary policy. The following format is supported:
81+
`organizations/{organization_id}/locations/{location}/principalAccessBoundaryPolicies/{policy_id}`
82+
output: true
83+
- name: 'uid'
84+
type: String
85+
description: |
86+
Output only. The globally unique ID of the principal access boundary policy.
87+
output: true
88+
- name: 'etag'
89+
type: String
90+
description: |
91+
Optional. The etag for the principal access boundary. If this is provided on update, it must match the server's etag.
92+
default_from_api: true
93+
- name: 'displayName'
94+
type: String
95+
description: |
96+
Optional. The description of the principal access boundary policy. Must be less than or equal to 63 characters.
97+
- name: 'annotations'
98+
type: KeyValueAnnotations
99+
description: |
100+
Optional. User defined annotations. See https://google.aip.dev/148#annotations
101+
for more details such as format and size limitations
102+
- name: 'createTime'
103+
type: String
104+
description: |
105+
Output only. The time when the principal access boundary policy was created.
106+
output: true
107+
- name: 'updateTime'
108+
type: String
109+
description: |
110+
Output only. The time when the principal access boundary policy was most recently updated.
111+
output: true
112+
- name: 'details'
113+
type: NestedObject
114+
description: |
115+
Principal access boundary policy details
116+
default_from_api: true
117+
properties:
118+
- name: 'rules'
119+
type: Array
120+
description: |
121+
Required. A list of principal access boundary policy rules. The number of rules in a policy is limited to 500.
122+
required: true
123+
item_type:
124+
type: NestedObject
125+
properties:
126+
- name: 'description'
127+
type: String
128+
description: |
129+
Optional. The description of the principal access boundary policy rule. Must be less than or equal to 256 characters.
130+
- name: 'resources'
131+
type: Array
132+
description: |
133+
Required. A list of Cloud Resource Manager resources. The resource
134+
and all the descendants are included. The number of resources in a policy
135+
is limited to 500 across all rules.
136+
The following resource types are supported:
137+
* Organizations, such as `//cloudresourcemanager.googleapis.com/organizations/123`.
138+
* Folders, such as `//cloudresourcemanager.googleapis.com/folders/123`.
139+
* Projects, such as `//cloudresourcemanager.googleapis.com/projects/123`
140+
or `//cloudresourcemanager.googleapis.com/projects/my-project-id`.
141+
required: true
142+
item_type:
143+
type: String
144+
- name: 'effect'
145+
type: String
146+
description: |
147+
Required. The access relationship of principals to the resources in this rule.
148+
Possible values: EFFECT_UNSPECIFIED ALLOW
149+
required: true
150+
- name: 'enforcementVersion'
151+
type: String
152+
description: |
153+
Optional. The version number that indicates which Google Cloud services
154+
are included in the enforcement (e.g. \"latest\", \"1\", ...). If empty, the
155+
PAB policy version will be set to the current latest version, and this version
156+
won't get updated when new versions are released.
157+
default_from_api: true

‎mmv1/products/iam3/product.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Copyright 2024 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
---
14+
name: 'IAM3'
15+
display_name: 'Cloud IAM'
16+
versions:
17+
- name: 'ga'
18+
base_url: 'https://iam.googleapis.com/v3/'
19+
scopes:
20+
- 'https://www.googleapis.com/auth/iam'

‎mmv1/templates/terraform/examples/iam3_principal_access_boundary_policy.tf.tmpl

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
resource "google_iam3_principal_access_boundary_policy" "{{$.PrimaryResourceId}}" {
2+
organization = "{{index $.TestEnvVars "org_id"}}"
3+
location = "global"
4+
display_name = "{{index $.Vars "display_name"}}"
5+
principal_access_boundary_policy_id = "{{index $.Vars "pab_id"}}"
6+
}

‎mmv1/third_party/terraform/services/iam3/resource_iam3_principal_access_boundary_policy_test.go

+121
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
package iam3_test
2+
3+
import (
4+
"testing"
5+
6+
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
7+
"github.com/hashicorp/terraform-provider-google/google/acctest"
8+
"github.com/hashicorp/terraform-provider-google/google/envvar"
9+
)
10+
11+
func TestAccIAM3PrincipalAccessBoundaryPolicy_iam3PrincipalAccessBoundaryPolicyExample_update(t *testing.T) {
12+
t.Parallel()
13+
14+
context := map[string]interface{}{
15+
"org_id": envvar.GetTestOrgFromEnv(t),
16+
"random_suffix": acctest.RandString(t, 10),
17+
}
18+
19+
acctest.VcrTest(t, resource.TestCase{
20+
PreCheck: func() { acctest.AccTestPreCheck(t) },
21+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
22+
CheckDestroy: testAccCheckIAM3PrincipalAccessBoundaryPolicyDestroyProducer(t),
23+
Steps: []resource.TestStep{
24+
{
25+
Config: testAccIAM3PrincipalAccessBoundaryPolicy_iam3PrincipalAccessBoundaryPolicyExample_full(context),
26+
},
27+
{
28+
ResourceName: "google_iam3_principal_access_boundary_policy.my-pab-policy",
29+
ImportState: true,
30+
ImportStateVerify: true,
31+
ImportStateVerifyIgnore: []string{"annotations", "location", "organization", "principal_access_boundary_policy_id"},
32+
},
33+
{
34+
Config: testAccIAM3PrincipalAccessBoundaryPolicy_iam3PrincipalAccessBoundaryPolicyExample_update(context),
35+
},
36+
{
37+
ResourceName: "google_iam3_principal_access_boundary_policy.my-pab-policy",
38+
ImportState: true,
39+
ImportStateVerify: true,
40+
ImportStateVerifyIgnore: []string{"annotations", "location", "organization", "principal_access_boundary_policy_id"},
41+
},
42+
},
43+
})
44+
}
45+
46+
func testAccIAM3PrincipalAccessBoundaryPolicy_iam3PrincipalAccessBoundaryPolicyExample_full(context map[string]interface{}) string {
47+
return acctest.Nprintf(`
48+
resource "google_iam3_principal_access_boundary_policy" "my-pab-policy" {
49+
organization = "%{org_id}"
50+
location = "global"
51+
display_name = "test pab policy%{random_suffix}"
52+
principal_access_boundary_policy_id = "test-pab-policy%{random_suffix}"
53+
}
54+
`, context)
55+
}
56+
57+
func testAccIAM3PrincipalAccessBoundaryPolicy_iam3PrincipalAccessBoundaryPolicyExample_update(context map[string]interface{}) string {
58+
return acctest.Nprintf(`
59+
60+
resource "google_project" "project" {
61+
project_id = "tf-test%{random_suffix}"
62+
name = "tf-test%{random_suffix}"
63+
org_id = "%{org_id}"
64+
}
65+
66+
resource "google_iam3_principal_access_boundary_policy" "my-pab-policy" {
67+
organization = "${org_id}"
68+
location = "global"
69+
display_name = "test pab policy%{random_suffix}"
70+
principal_access_boundary_policy_id = "test-pab-policy%{random_suffix}"
71+
details {
72+
rules {
73+
description = "PAB rule%{random_suffix}"
74+
effect = allow
75+
resources = [//cloudresourcemanager.googleapis.com/projects/${google_project.project.project_id}"]
76+
}
77+
enforcement_version = "1"
78+
}
79+
}
80+
`, context)
81+
}
82+
83+
/*
84+
func testAccCheckIAM3PrincipalAccessBoundaryPolicyDestroyProducer(t *testing.T) func(s *terraform.State) error {
85+
return func(s *terraform.State) error {
86+
for name, rs := range s.RootModule().Resources {
87+
if rs.Type != "google_iam3_principal_access_boundary_policy" {
88+
continue
89+
}
90+
if strings.HasPrefix(name, "data.") {
91+
continue
92+
}
93+
config := acctest.GoogleProviderConfig(t)
94+
95+
url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{IAM3BasePath}}organizations/{{organization}}/locations/{{location}}/principalAccessBoundaryPolicies/{{principal_access_boundary_policy_id}}")
96+
if err != nil {
97+
return err
98+
}
99+
100+
billingProject := ""
101+
102+
if config.BillingProject != "" {
103+
billingProject = config.BillingProject
104+
}
105+
106+
_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
107+
Config: config,
108+
Method: "GET",
109+
Project: billingProject,
110+
RawURL: url,
111+
UserAgent: config.UserAgent,
112+
})
113+
if err == nil {
114+
return fmt.Errorf("IAM3PrincipalAccessBoundaryPolicy still exists at %s", url)
115+
}
116+
}
117+
118+
return nil
119+
}
120+
}
121+
*/

0 commit comments

Comments
 (0)