Skip to content

Commit 5f717f4

Browse files
modular-magicianCharles Leon
and
Charles Leon
authored
Add support for ACM Scoped Policies and Access Policy IAM (#5785) (#11409)
Co-authored-by: Charles Leon <[email protected]> Signed-off-by: Modular Magician <[email protected]> Co-authored-by: Charles Leon <[email protected]>
1 parent 97bc17e commit 5f717f4

9 files changed

+561
-3
lines changed

.changelog/5785.txt

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
```release-note:enhancement
2+
access context manager: Added support for scoped policies in `google_access_context_manager_access_policy`
3+
```
4+
```release-note:new-resource
5+
`google_access_context_manager_access_policy_iam_policy`
6+
```
7+
```release-note:new-resource
8+
`google_access_context_manager_access_policy_iam_binding`
9+
```
10+
```release-note:new-resource
11+
`google_access_context_manager_access_policy_iam_member`
12+
```
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
// ----------------------------------------------------------------------------
2+
//
3+
// *** AUTO GENERATED CODE *** Type: MMv1 ***
4+
//
5+
// ----------------------------------------------------------------------------
6+
//
7+
// This file is automatically generated by Magic Modules and manual
8+
// changes will be clobbered when the file is regenerated.
9+
//
10+
// Please read more about how to change this file in
11+
// .github/CONTRIBUTING.md.
12+
//
13+
// ----------------------------------------------------------------------------
14+
package google
15+
16+
import (
17+
"fmt"
18+
19+
"github.com/hashicorp/errwrap"
20+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
21+
"google.golang.org/api/cloudresourcemanager/v1"
22+
)
23+
24+
var AccessContextManagerAccessPolicyIamSchema = map[string]*schema.Schema{
25+
"name": {
26+
Type: schema.TypeString,
27+
Required: true,
28+
ForceNew: true,
29+
DiffSuppressFunc: compareSelfLinkOrResourceName,
30+
},
31+
}
32+
33+
type AccessContextManagerAccessPolicyIamUpdater struct {
34+
name string
35+
d TerraformResourceData
36+
Config *Config
37+
}
38+
39+
func AccessContextManagerAccessPolicyIamUpdaterProducer(d TerraformResourceData, config *Config) (ResourceIamUpdater, error) {
40+
values := make(map[string]string)
41+
42+
if v, ok := d.GetOk("name"); ok {
43+
values["name"] = v.(string)
44+
}
45+
46+
// We may have gotten either a long or short name, so attempt to parse long name if possible
47+
m, err := getImportIdQualifiers([]string{"accessPolicies/(?P<name>[^/]+)", "(?P<name>[^/]+)"}, d, config, d.Get("name").(string))
48+
if err != nil {
49+
return nil, err
50+
}
51+
52+
for k, v := range m {
53+
values[k] = v
54+
}
55+
56+
u := &AccessContextManagerAccessPolicyIamUpdater{
57+
name: values["name"],
58+
d: d,
59+
Config: config,
60+
}
61+
62+
if err := d.Set("name", u.GetResourceId()); err != nil {
63+
return nil, fmt.Errorf("Error setting name: %s", err)
64+
}
65+
66+
return u, nil
67+
}
68+
69+
func AccessContextManagerAccessPolicyIdParseFunc(d *schema.ResourceData, config *Config) error {
70+
values := make(map[string]string)
71+
72+
m, err := getImportIdQualifiers([]string{"accessPolicies/(?P<name>[^/]+)", "(?P<name>[^/]+)"}, d, config, d.Id())
73+
if err != nil {
74+
return err
75+
}
76+
77+
for k, v := range m {
78+
values[k] = v
79+
}
80+
81+
u := &AccessContextManagerAccessPolicyIamUpdater{
82+
name: values["name"],
83+
d: d,
84+
Config: config,
85+
}
86+
if err := d.Set("name", u.GetResourceId()); err != nil {
87+
return fmt.Errorf("Error setting name: %s", err)
88+
}
89+
d.SetId(u.GetResourceId())
90+
return nil
91+
}
92+
93+
func (u *AccessContextManagerAccessPolicyIamUpdater) GetResourceIamPolicy() (*cloudresourcemanager.Policy, error) {
94+
url, err := u.qualifyAccessPolicyUrl("getIamPolicy")
95+
if err != nil {
96+
return nil, err
97+
}
98+
99+
var obj map[string]interface{}
100+
101+
userAgent, err := generateUserAgentString(u.d, u.Config.userAgent)
102+
if err != nil {
103+
return nil, err
104+
}
105+
106+
policy, err := sendRequest(u.Config, "POST", "", url, userAgent, obj)
107+
if err != nil {
108+
return nil, errwrap.Wrapf(fmt.Sprintf("Error retrieving IAM policy for %s: {{err}}", u.DescribeResource()), err)
109+
}
110+
111+
out := &cloudresourcemanager.Policy{}
112+
err = Convert(policy, out)
113+
if err != nil {
114+
return nil, errwrap.Wrapf("Cannot convert a policy to a resource manager policy: {{err}}", err)
115+
}
116+
117+
return out, nil
118+
}
119+
120+
func (u *AccessContextManagerAccessPolicyIamUpdater) SetResourceIamPolicy(policy *cloudresourcemanager.Policy) error {
121+
json, err := ConvertToMap(policy)
122+
if err != nil {
123+
return err
124+
}
125+
126+
obj := make(map[string]interface{})
127+
obj["policy"] = json
128+
129+
url, err := u.qualifyAccessPolicyUrl("setIamPolicy")
130+
if err != nil {
131+
return err
132+
}
133+
134+
userAgent, err := generateUserAgentString(u.d, u.Config.userAgent)
135+
if err != nil {
136+
return err
137+
}
138+
139+
_, err = sendRequestWithTimeout(u.Config, "POST", "", url, userAgent, obj, u.d.Timeout(schema.TimeoutCreate))
140+
if err != nil {
141+
return errwrap.Wrapf(fmt.Sprintf("Error setting IAM policy for %s: {{err}}", u.DescribeResource()), err)
142+
}
143+
144+
return nil
145+
}
146+
147+
func (u *AccessContextManagerAccessPolicyIamUpdater) qualifyAccessPolicyUrl(methodIdentifier string) (string, error) {
148+
urlTemplate := fmt.Sprintf("{{AccessContextManagerBasePath}}%s:%s", fmt.Sprintf("accessPolicies/%s", u.name), methodIdentifier)
149+
url, err := replaceVars(u.d, u.Config, urlTemplate)
150+
if err != nil {
151+
return "", err
152+
}
153+
return url, nil
154+
}
155+
156+
func (u *AccessContextManagerAccessPolicyIamUpdater) GetResourceId() string {
157+
return fmt.Sprintf("accessPolicies/%s", u.name)
158+
}
159+
160+
func (u *AccessContextManagerAccessPolicyIamUpdater) GetMutexKey() string {
161+
return fmt.Sprintf("iam-accesscontextmanager-accesspolicy-%s", u.GetResourceId())
162+
}
163+
164+
func (u *AccessContextManagerAccessPolicyIamUpdater) DescribeResource() string {
165+
return fmt.Sprintf("accesscontextmanager accesspolicy %q", u.GetResourceId())
166+
}

google/provider.go

+5-2
Original file line numberDiff line numberDiff line change
@@ -830,8 +830,8 @@ func Provider() *schema.Provider {
830830
}
831831

832832
// Generated resources: 217
833-
// Generated IAM resources: 102
834-
// Total generated resources: 319
833+
// Generated IAM resources: 105
834+
// Total generated resources: 322
835835
func ResourceMap() map[string]*schema.Resource {
836836
resourceMap, _ := ResourceMapWithErrors()
837837
return resourceMap
@@ -844,6 +844,9 @@ func ResourceMapWithErrors() (map[string]*schema.Resource, error) {
844844
"google_project_access_approval_settings": resourceAccessApprovalProjectSettings(),
845845
"google_organization_access_approval_settings": resourceAccessApprovalOrganizationSettings(),
846846
"google_access_context_manager_access_policy": resourceAccessContextManagerAccessPolicy(),
847+
"google_access_context_manager_access_policy_iam_binding": ResourceIamBinding(AccessContextManagerAccessPolicyIamSchema, AccessContextManagerAccessPolicyIamUpdaterProducer, AccessContextManagerAccessPolicyIdParseFunc),
848+
"google_access_context_manager_access_policy_iam_member": ResourceIamMember(AccessContextManagerAccessPolicyIamSchema, AccessContextManagerAccessPolicyIamUpdaterProducer, AccessContextManagerAccessPolicyIdParseFunc),
849+
"google_access_context_manager_access_policy_iam_policy": ResourceIamPolicy(AccessContextManagerAccessPolicyIamSchema, AccessContextManagerAccessPolicyIamUpdaterProducer, AccessContextManagerAccessPolicyIdParseFunc),
847850
"google_access_context_manager_access_level": resourceAccessContextManagerAccessLevel(),
848851
"google_access_context_manager_access_levels": resourceAccessContextManagerAccessLevels(),
849852
"google_access_context_manager_access_level_condition": resourceAccessContextManagerAccessLevelCondition(),

google/resource_access_context_manager_access_policy.go

+37
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,16 @@ Format: organizations/{organization_id}`,
5454
Required: true,
5555
Description: `Human readable title. Does not affect behavior.`,
5656
},
57+
"scopes": {
58+
Type: schema.TypeList,
59+
Optional: true,
60+
Description: `Folder or project on which this policy is applicable.
61+
Format: folders/{{folder_id}} or projects/{{project_id}}`,
62+
MaxItems: 1,
63+
Elem: &schema.Schema{
64+
Type: schema.TypeString,
65+
},
66+
},
5767
"create_time": {
5868
Type: schema.TypeString,
5969
Computed: true,
@@ -94,6 +104,12 @@ func resourceAccessContextManagerAccessPolicyCreate(d *schema.ResourceData, meta
94104
} else if v, ok := d.GetOkExists("title"); !isEmptyValue(reflect.ValueOf(titleProp)) && (ok || !reflect.DeepEqual(v, titleProp)) {
95105
obj["title"] = titleProp
96106
}
107+
scopesProp, err := expandAccessContextManagerAccessPolicyScopes(d.Get("scopes"), d, config)
108+
if err != nil {
109+
return err
110+
} else if v, ok := d.GetOkExists("scopes"); !isEmptyValue(reflect.ValueOf(scopesProp)) && (ok || !reflect.DeepEqual(v, scopesProp)) {
111+
obj["scopes"] = scopesProp
112+
}
97113

98114
url, err := replaceVars(d, config, "{{AccessContextManagerBasePath}}accessPolicies")
99115
if err != nil {
@@ -199,6 +215,9 @@ func resourceAccessContextManagerAccessPolicyRead(d *schema.ResourceData, meta i
199215
if err := d.Set("title", flattenAccessContextManagerAccessPolicyTitle(res["title"], d, config)); err != nil {
200216
return fmt.Errorf("Error reading AccessPolicy: %s", err)
201217
}
218+
if err := d.Set("scopes", flattenAccessContextManagerAccessPolicyScopes(res["scopes"], d, config)); err != nil {
219+
return fmt.Errorf("Error reading AccessPolicy: %s", err)
220+
}
202221

203222
return nil
204223
}
@@ -219,6 +238,12 @@ func resourceAccessContextManagerAccessPolicyUpdate(d *schema.ResourceData, meta
219238
} else if v, ok := d.GetOkExists("title"); !isEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, titleProp)) {
220239
obj["title"] = titleProp
221240
}
241+
scopesProp, err := expandAccessContextManagerAccessPolicyScopes(d.Get("scopes"), d, config)
242+
if err != nil {
243+
return err
244+
} else if v, ok := d.GetOkExists("scopes"); !isEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, scopesProp)) {
245+
obj["scopes"] = scopesProp
246+
}
222247

223248
url, err := replaceVars(d, config, "{{AccessContextManagerBasePath}}accessPolicies/{{name}}")
224249
if err != nil {
@@ -231,6 +256,10 @@ func resourceAccessContextManagerAccessPolicyUpdate(d *schema.ResourceData, meta
231256
if d.HasChange("title") {
232257
updateMask = append(updateMask, "title")
233258
}
259+
260+
if d.HasChange("scopes") {
261+
updateMask = append(updateMask, "scopes")
262+
}
234263
// updateMask is a URL parameter but not present in the schema, so replaceVars
235264
// won't set it
236265
url, err = addQueryParams(url, map[string]string{"updateMask": strings.Join(updateMask, ",")})
@@ -342,10 +371,18 @@ func flattenAccessContextManagerAccessPolicyTitle(v interface{}, d *schema.Resou
342371
return v
343372
}
344373

374+
func flattenAccessContextManagerAccessPolicyScopes(v interface{}, d *schema.ResourceData, config *Config) interface{} {
375+
return v
376+
}
377+
345378
func expandAccessContextManagerAccessPolicyParent(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
346379
return v, nil
347380
}
348381

349382
func expandAccessContextManagerAccessPolicyTitle(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
350383
return v, nil
351384
}
385+
386+
func expandAccessContextManagerAccessPolicyScopes(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
387+
return v, nil
388+
}

0 commit comments

Comments
 (0)