Skip to content

Commit a2223bb

Browse files
modular-magicianmodular-magician
authored
Update Documentation for ACM Service Perimeter resources to reflect Granular Controls group support (#10087) (#17558)
groups [upstream:f72682f39d30f1eb3263acf8a6b4c3603ba4acdd] Signed-off-by: Modular Magician <[email protected]>
1 parent 2ccc543 commit a2223bb

9 files changed

+150
-58
lines changed

‎.changelog/10087.txt

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
```release-note:none
2+
accesscontextmanager: updated documentation reflecting group support in `google_access_context_manager_service_perimeter`
3+
```
4+
```release-note:none
5+
accesscontextmanager: updated documentation reflecting group support in `google_access_context_manager_service_perimeters`
6+
```
7+
```release-note:none
8+
accesscontextmanager: updated documentation reflecting group support in `google_access_context_manager_service_perimeter_egress_policy`
9+
```
10+
```release-note:none
11+
accesscontextmanager: updated documentation reflecting group support in `google_access_context_manager_service_perimeter_ingress_policy`
12+
```

‎google/services/accesscontextmanager/resource_access_context_manager_service_perimeter.go

+16-12
Original file line numberDiff line numberDiff line change
@@ -146,9 +146,10 @@ a perimeter bridge.`,
146146
"identities": {
147147
Type: schema.TypeSet,
148148
Optional: true,
149-
Description: `A list of identities that are allowed access through this 'EgressPolicy'.
150-
Should be in the format of email address. The email address should
151-
represent individual user or service account only.`,
149+
Description: `'A list of identities that are allowed access through this 'EgressPolicy'.
150+
To specify an identity or identity group, use the IAM v1
151+
format specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
152+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'`,
152153
Elem: &schema.Schema{
153154
Type: schema.TypeString,
154155
},
@@ -285,9 +286,10 @@ to apply.`,
285286
"identities": {
286287
Type: schema.TypeSet,
287288
Optional: true,
288-
Description: `A list of identities that are allowed access through this ingress policy.
289-
Should be in the format of email address. The email address should represent
290-
individual user or service account only.`,
289+
Description: `'A list of identities that are allowed access through this 'IngressPolicy'.
290+
To specify an identity or identity group, use the IAM v1
291+
format specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
292+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'`,
291293
Elem: &schema.Schema{
292294
Type: schema.TypeString,
293295
},
@@ -510,9 +512,10 @@ a perimeter bridge.`,
510512
"identities": {
511513
Type: schema.TypeSet,
512514
Optional: true,
513-
Description: `A list of identities that are allowed access through this 'EgressPolicy'.
514-
Should be in the format of email address. The email address should
515-
represent individual user or service account only.`,
515+
Description: `'A list of identities that are allowed access through this 'EgressPolicy'.
516+
To specify an identity or identity group, use the IAM v1
517+
format specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
518+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'`,
516519
Elem: &schema.Schema{
517520
Type: schema.TypeString,
518521
},
@@ -649,9 +652,10 @@ to apply.`,
649652
"identities": {
650653
Type: schema.TypeSet,
651654
Optional: true,
652-
Description: `A list of identities that are allowed access through this ingress policy.
653-
Should be in the format of email address. The email address should represent
654-
individual user or service account only.`,
655+
Description: `'A list of identities that are allowed access through this 'IngressPolicy'.
656+
To specify an identity or identity group, use the IAM v1
657+
format specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
658+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'`,
655659
Elem: &schema.Schema{
656660
Type: schema.TypeString,
657661
},

‎google/services/accesscontextmanager/resource_access_context_manager_service_perimeter_egress_policy.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -67,8 +67,8 @@ func ResourceAccessContextManagerServicePerimeterEgressPolicy() *schema.Resource
6767
Type: schema.TypeList,
6868
Optional: true,
6969
Description: `A list of identities that are allowed access through this 'EgressPolicy'.
70-
Should be in the format of email address. The email address should
71-
represent individual user or service account only.`,
70+
Should be in the format of an email address. The email address should
71+
represent an individual user, service account, or Google group.`,
7272
Elem: &schema.Schema{
7373
Type: schema.TypeString,
7474
},

‎google/services/accesscontextmanager/resource_access_context_manager_service_perimeter_ingress_policy.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -67,9 +67,9 @@ to apply.`,
6767
"identities": {
6868
Type: schema.TypeList,
6969
Optional: true,
70-
Description: `A list of identities that are allowed access through this ingress policy.
71-
Should be in the format of email address. The email address should represent
72-
individual user or service account only.`,
70+
Description: `A list of identities that are allowed access through this 'IngressPolicy'.
71+
Should be in the format of an email address. The email address should represent
72+
an individual user, service account, or Google group.`,
7373
Elem: &schema.Schema{
7474
Type: schema.TypeString,
7575
},

‎google/services/accesscontextmanager/resource_access_context_manager_service_perimeters.go

+16-12
Original file line numberDiff line numberDiff line change
@@ -150,9 +150,10 @@ a perimeter bridge.`,
150150
"identities": {
151151
Type: schema.TypeSet,
152152
Optional: true,
153-
Description: `A list of identities that are allowed access through this 'EgressPolicy'.
154-
Should be in the format of email address. The email address should
155-
represent individual user or service account only.`,
153+
Description: `'A list of identities that are allowed access through this 'EgressPolicy'.
154+
To specify an identity or identity group, use the IAM v1 format
155+
specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
156+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'`,
156157
Elem: &schema.Schema{
157158
Type: schema.TypeString,
158159
},
@@ -289,9 +290,10 @@ to apply.`,
289290
"identities": {
290291
Type: schema.TypeSet,
291292
Optional: true,
292-
Description: `A list of identities that are allowed access through this ingress policy.
293-
Should be in the format of email address. The email address should represent
294-
individual user or service account only.`,
293+
Description: `'A list of identities that are allowed access through this 'IngressPolicy'.
294+
To specify an identity or identity group, use the IAM v1 format
295+
specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
296+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'`,
295297
Elem: &schema.Schema{
296298
Type: schema.TypeString,
297299
},
@@ -511,9 +513,10 @@ a perimeter bridge.`,
511513
"identities": {
512514
Type: schema.TypeSet,
513515
Optional: true,
514-
Description: `A list of identities that are allowed access through this 'EgressPolicy'.
515-
Should be in the format of email address. The email address should
516-
represent individual user or service account only.`,
516+
Description: `'A list of identities that are allowed access through this 'EgressPolicy'.
517+
To specify an identity or identity group, use the IAM v1 format
518+
specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
519+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'`,
517520
Elem: &schema.Schema{
518521
Type: schema.TypeString,
519522
},
@@ -739,9 +742,10 @@ to apply.`,
739742
"identities": {
740743
Type: schema.TypeSet,
741744
Optional: true,
742-
Description: `A list of identities that are allowed access through this ingress policy.
743-
Should be in the format of email address. The email address should represent
744-
individual user or service account only.`,
745+
Description: `'A list of identities that are allowed access through this 'IngressPolicy'.
746+
To specify an identity or identity group, use the IAM v1 format
747+
specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
748+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'`,
745749
Elem: &schema.Schema{
746750
Type: schema.TypeString,
747751
},

‎website/docs/r/access_context_manager_service_perimeter.html.markdown

+80-12
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,70 @@ resource "google_access_context_manager_access_policy" "access-policy" {
223223
title = "my policy"
224224
}
225225
```
226+
## Example Usage - Access Context Manager Service Perimeter Granular Controls
227+
228+
229+
```hcl
230+
resource "google_access_context_manager_access_policy" "access-policy" {
231+
parent = "organizations/123456789"
232+
title = "Policy with Granular Controls Group Support"
233+
}
234+
235+
resource "google_access_context_manager_service_perimeter" "test-access" {
236+
parent = "accessPolicies/${google_access_context_manager_access_policy.test-access.name}"
237+
name = "accessPolicies/${google_access_context_manager_access_policy.test-access.name}/servicePerimeters/%s"
238+
title = "%s"
239+
perimeter_type = "PERIMETER_TYPE_REGULAR"
240+
status {
241+
restricted_services = ["bigquery.googleapis.com", "storage.googleapis.com"]
242+
243+
vpc_accessible_services {
244+
enable_restriction = true
245+
allowed_services = ["bigquery.googleapis.com", "storage.googleapis.com"]
246+
}
247+
248+
ingress_policies {
249+
ingress_from {
250+
sources {
251+
access_level = google_access_context_manager_access_level.test-access.name
252+
}
253+
identities = ["group:[email protected]"]
254+
identities = ["principal://iam.googleapis.com/locations/global/workforcePools/1234/subject/janedoe"]
255+
identities = ["principalSet://iam.googleapis.com/locations/global/workforcePools/1234/*"]
256+
}
257+
258+
ingress_to {
259+
resources = [ "*" ]
260+
operations {
261+
service_name = "storage.googleapis.com"
262+
263+
method_selectors {
264+
method = "google.storage.objects.create"
265+
}
266+
}
267+
}
268+
}
269+
270+
egress_policies {
271+
egress_from {
272+
identities = ["group:[email protected]"]
273+
identities = ["principal://iam.googleapis.com/locations/global/workforcePools/1234/subject/janedoe"]
274+
identities = ["principalSet://iam.googleapis.com/locations/global/workforcePools/1234/*"]
275+
}
276+
egress_to {
277+
resources = [ "*" ]
278+
operations {
279+
service_name = "storage.googleapis.com"
280+
281+
method_selectors {
282+
method = "google.storage.objects.create"
283+
}
284+
}
285+
}
286+
}
287+
}
288+
}
289+
```
226290

227291
## Argument Reference
228292

@@ -389,9 +453,10 @@ The following arguments are supported:
389453

390454
* `identities` -
391455
(Optional)
392-
A list of identities that are allowed access through this ingress policy.
393-
Should be in the format of email address. The email address should represent
394-
individual user or service account only.
456+
'A list of identities that are allowed access through this `IngressPolicy`.
457+
To specify an identity or identity group, use the IAM v1
458+
format specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
459+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'
395460

396461
* `sources` -
397462
(Optional)
@@ -506,9 +571,10 @@ The following arguments are supported:
506571

507572
* `identities` -
508573
(Optional)
509-
A list of identities that are allowed access through this `EgressPolicy`.
510-
Should be in the format of email address. The email address should
511-
represent individual user or service account only.
574+
'A list of identities that are allowed access through this `EgressPolicy`.
575+
To specify an identity or identity group, use the IAM v1
576+
format specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
577+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'
512578

513579

514580
<a name="nested_sources"></a>The `sources` block supports:
@@ -659,9 +725,10 @@ The following arguments are supported:
659725

660726
* `identities` -
661727
(Optional)
662-
A list of identities that are allowed access through this ingress policy.
663-
Should be in the format of email address. The email address should represent
664-
individual user or service account only.
728+
'A list of identities that are allowed access through this `IngressPolicy`.
729+
To specify an identity or identity group, use the IAM v1
730+
format specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
731+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'
665732

666733
* `sources` -
667734
(Optional)
@@ -776,9 +843,10 @@ The following arguments are supported:
776843

777844
* `identities` -
778845
(Optional)
779-
A list of identities that are allowed access through this `EgressPolicy`.
780-
Should be in the format of email address. The email address should
781-
represent individual user or service account only.
846+
'A list of identities that are allowed access through this `EgressPolicy`.
847+
To specify an identity or identity group, use the IAM v1
848+
format specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
849+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'
782850

783851

784852
<a name="nested_sources"></a>The `sources` block supports:

‎website/docs/r/access_context_manager_service_perimeter_egress_policy.html.markdown

+2-2
Original file line numberDiff line numberDiff line change
@@ -69,8 +69,8 @@ The following arguments are supported:
6969
* `identities` -
7070
(Optional)
7171
A list of identities that are allowed access through this `EgressPolicy`.
72-
Should be in the format of email address. The email address should
73-
represent individual user or service account only.
72+
Should be in the format of an email address. The email address should
73+
represent an individual user, service account, or Google group.
7474

7575
* `sources` -
7676
(Optional)

‎website/docs/r/access_context_manager_service_perimeter_ingress_policy.html.markdown

+3-3
Original file line numberDiff line numberDiff line change
@@ -70,9 +70,9 @@ The following arguments are supported:
7070

7171
* `identities` -
7272
(Optional)
73-
A list of identities that are allowed access through this ingress policy.
74-
Should be in the format of email address. The email address should represent
75-
individual user or service account only.
73+
A list of identities that are allowed access through this `IngressPolicy`.
74+
Should be in the format of an email address. The email address should represent
75+
an individual user, service account, or Google group.
7676

7777
* `sources` -
7878
(Optional)

‎website/docs/r/access_context_manager_service_perimeters.html.markdown

+16-12
Original file line numberDiff line numberDiff line change
@@ -262,9 +262,10 @@ The following arguments are supported:
262262

263263
* `identities` -
264264
(Optional)
265-
A list of identities that are allowed access through this ingress policy.
266-
Should be in the format of email address. The email address should represent
267-
individual user or service account only.
265+
'A list of identities that are allowed access through this `IngressPolicy`.
266+
To specify an identity or identity group, use the IAM v1 format
267+
specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
268+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'
268269

269270
* `sources` -
270271
(Optional)
@@ -369,9 +370,10 @@ The following arguments are supported:
369370

370371
* `identities` -
371372
(Optional)
372-
A list of identities that are allowed access through this `EgressPolicy`.
373-
Should be in the format of email address. The email address should
374-
represent individual user or service account only.
373+
'A list of identities that are allowed access through this `EgressPolicy`.
374+
To specify an identity or identity group, use the IAM v1 format
375+
specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
376+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'
375377

376378
* `sources` -
377379
(Optional)
@@ -532,9 +534,10 @@ The following arguments are supported:
532534

533535
* `identities` -
534536
(Optional)
535-
A list of identities that are allowed access through this ingress policy.
536-
Should be in the format of email address. The email address should represent
537-
individual user or service account only.
537+
'A list of identities that are allowed access through this `IngressPolicy`.
538+
To specify an identity or identity group, use the IAM v1 format
539+
specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
540+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'
538541

539542
* `sources` -
540543
(Optional)
@@ -639,9 +642,10 @@ The following arguments are supported:
639642

640643
* `identities` -
641644
(Optional)
642-
A list of identities that are allowed access through this `EgressPolicy`.
643-
Should be in the format of email address. The email address should
644-
represent individual user or service account only.
645+
'A list of identities that are allowed access through this `EgressPolicy`.
646+
To specify an identity or identity group, use the IAM v1 format
647+
specified [here](https://cloud.google.com/iam/docs/principal-identifiers.md#v1).
648+
The following prefixes are supprted: user, group, serviceAccount, principal, and principalSet.'
645649

646650
* `sources` -
647651
(Optional)

0 commit comments

Comments
 (0)