Skip to content

Commit 2013c83

Browse files
chengliwmchengliwm
authored
Add new resource ProjectKajPolicyConfig (#15257)
1 parent f0ca83b commit 2013c83

File tree

3 files changed

+263
-0
lines changed

3 files changed

+263
-0
lines changed

‎mmv1/products/kms/ProjectKajPolicyConfig.yaml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# Copyright 2024 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
name: 'ProjectKajPolicyConfig'
16+
api_resource_type_kind: KeyAccessJustificationsPolicyConfig
17+
api_variant_patterns:
18+
- 'projects/{{project}}/kajPolicyConfig'
19+
description: |
20+
`ProjectKajPolicyConfig` is a project-level singleton resource
21+
used to configure the default KAJ policy of newly created key.
22+
23+
~> **Note:** ProjectKajPolicyConfig cannot be deleted from Google Cloud Platform.
24+
Destroying a Terraform-managed ProjectKajPolicyConfig will remove it from state but
25+
*will not delete the resource from Google Cloud Platform.*
26+
min_version: 'beta'
27+
references:
28+
guides:
29+
'Set default Key Access Justifications policy': 'https://cloud.google.com/assured-workloads/key-access-justifications/docs/set-default-policy'
30+
api: 'https://cloud.google.com/kms/docs/reference/rest/v1/KeyAccessJustificationsPolicyConfig'
31+
docs:
32+
id_format: 'projects/{{project}}/kajPolicyConfig'
33+
base_url: 'projects/{{project}}/kajPolicyConfig'
34+
self_link: 'projects/{{project}}/kajPolicyConfig'
35+
# This is a singleton resource that is already created, so create
36+
# is really an update, and therefore should be PATCHed.
37+
create_url: 'projects/{{project}}/kajPolicyConfig?updateMask=defaultKeyAccessJustificationPolicy'
38+
create_verb: 'PATCH'
39+
update_url: 'projects/{{project}}/kajPolicyConfig?updateMask=defaultKeyAccessJustificationPolicy'
40+
update_verb: 'PATCH'
41+
# This is a singleton resource that cannot be deleted.
42+
exclude_delete: true
43+
exclude_sweeper: true
44+
import_format:
45+
- 'projects/{{project}}/kajPolicyConfig'
46+
timeouts:
47+
insert_minutes: 20
48+
update_minutes: 20
49+
delete_minutes: 20
50+
custom_code:
51+
post_create: 'templates/terraform/post_create/sleep_1_min.go.tmpl'
52+
post_update: 'templates/terraform/post_create/sleep_1_min.go.tmpl'
53+
examples:
54+
- name: 'kms_project_kaj_policy_config_basic'
55+
primary_resource_id: 'example'
56+
min_version: 'beta'
57+
vars:
58+
project_id: 'my-project'
59+
test_env_vars:
60+
org_id: 'ORG_ID'
61+
billing_account: 'BILLING_ACCT'
62+
external_providers: ["time"]
63+
parameters:
64+
properties:
65+
- name: 'defaultKeyAccessJustificationPolicy'
66+
type: NestedObject
67+
description: |
68+
The default key access justification policy used when a CryptoKey is
69+
created in this project. This is only used when a Key Access Justifications
70+
policy is not provided in the CreateCryptoKeyRequest.
71+
properties:
72+
- name: 'allowedAccessReasons'
73+
type: Array
74+
description: |
75+
A KeyAccessJustificationsPolicy specifies zero or more allowed
76+
AccessReason values for encrypt, decrypt, and sign operations on a
77+
CryptoKey.
78+
item_type:
79+
type: Enum
80+
description: |
81+
Describes the reason for a data access. Please refer to
82+
https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
83+
for the detailed semantic meaning of justification reason codes.
84+
enum_values:
85+
- 'CUSTOMER_INITIATED_SUPPORT'
86+
- 'GOOGLE_INITIATED_SERVICE'
87+
- 'THIRD_PARTY_DATA_REQUEST'
88+
- 'GOOGLE_INITIATED_REVIEW'
89+
- 'CUSTOMER_INITIATED_ACCESS'
90+
- 'GOOGLE_INITIATED_SYSTEM_OPERATION'
91+
- 'REASON_NOT_EXPECTED'
92+
- 'MODIFIED_CUSTOMER_INITIATED_ACCESS'
93+
- 'MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION'
94+
- 'GOOGLE_RESPONSE_TO_PRODUCTION_ALERT'
95+
- 'CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING'

‎mmv1/templates/terraform/examples/kms_project_kaj_policy_config_basic.tf.tmpl‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Create a project
2+
resource "google_project" "kms_project" {
3+
provider = google-beta
4+
project_id = "{{index $.Vars "project_id"}}"
5+
name = "{{index $.Vars "project_id"}}"
6+
org_id = "{{index $.TestEnvVars "org_id"}}"
7+
billing_account = "{{index $.TestEnvVars "billing_account"}}"
8+
deletion_policy = "DELETE"
9+
}
10+
11+
# Enable the Cloud KMS API.
12+
resource "google_project_service" "kms_api_service" {
13+
provider = google-beta
14+
service = "cloudkms.googleapis.com"
15+
project = google_project.kms_project.project_id
16+
disable_dependent_services = true
17+
depends_on = [google_project.kms_project]
18+
}
19+
20+
resource "time_sleep" "wait_enable_service_api" {
21+
depends_on = [google_project_service.kms_api_service]
22+
create_duration = "30s"
23+
}
24+
25+
resource "google_kms_project_kaj_policy_config" "{{$.PrimaryResourceId}}" {
26+
provider = google-beta
27+
project = google_project.kms_project.project_id
28+
default_key_access_justification_policy {
29+
allowed_access_reasons = [
30+
"CUSTOMER_INITIATED_ACCESS",
31+
"GOOGLE_INITIATED_SYSTEM_OPERATION",
32+
]
33+
}
34+
depends_on = [time_sleep.wait_enable_service_api]
35+
}

‎mmv1/third_party/terraform/services/kms/resource_kms_project_kaj_policy_config_test.go.tmpl‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
package kms_test
2+
3+
{{- if ne $.TargetVersionName "ga" }}
4+
import (
5+
"testing"
6+
7+
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
8+
"github.com/hashicorp/terraform-plugin-testing/plancheck"
9+
10+
"github.com/hashicorp/terraform-provider-google/google/acctest"
11+
"github.com/hashicorp/terraform-provider-google/google/envvar"
12+
)
13+
14+
func TestAccKMSProjectKajPolicyConfig_update(t *testing.T) {
15+
t.Parallel()
16+
17+
context := map[string]interface{}{
18+
"billing_account": envvar.GetTestBillingAccountFromEnv(t),
19+
"org_id": envvar.GetTestOrgFromEnv(t),
20+
"random_suffix": acctest.RandString(t, 10),
21+
}
22+
23+
acctest.VcrTest(t, resource.TestCase{
24+
PreCheck: func() { acctest.AccTestPreCheck(t) },
25+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
26+
ExternalProviders: map[string]resource.ExternalProvider{
27+
"time": {},
28+
},
29+
Steps: []resource.TestStep{
30+
{
31+
Config: testAccKMSProjectKajPolicyConfig_basic(context),
32+
},
33+
{
34+
ResourceName: "google_kms_project_kaj_policy_config.example",
35+
ImportState: true,
36+
ImportStateVerify: true,
37+
},
38+
{
39+
Config: testAccKMSProjectKajPolicyConfig_update(context),
40+
ConfigPlanChecks: resource.ConfigPlanChecks{
41+
PreApply: []plancheck.PlanCheck{
42+
plancheck.ExpectResourceAction("google_kms_project_kaj_policy_config.example", plancheck.ResourceActionUpdate),
43+
},
44+
},
45+
},
46+
{
47+
ResourceName: "google_kms_project_kaj_policy_config.example",
48+
ImportState: true,
49+
ImportStateVerify: true,
50+
},
51+
},
52+
})
53+
}
54+
55+
func testAccKMSProjectKajPolicyConfig_basic(context map[string]interface{}) string {
56+
return acctest.Nprintf(`
57+
# Create a project
58+
resource "google_project" "kms_project" {
59+
provider = google-beta
60+
project_id = "tf-test-my-project%{random_suffix}"
61+
name = "tf-test-my-project%{random_suffix}"
62+
org_id = "%{org_id}"
63+
billing_account = "%{billing_account}"
64+
deletion_policy = "DELETE"
65+
}
66+
67+
# Enable the Cloud KMS API.
68+
resource "google_project_service" "kms_api_service" {
69+
provider = google-beta
70+
service = "cloudkms.googleapis.com"
71+
project = google_project.kms_project.project_id
72+
disable_dependent_services = true
73+
depends_on = [google_project.kms_project]
74+
}
75+
76+
resource "time_sleep" "wait_enable_service_api" {
77+
depends_on = [google_project_service.kms_api_service]
78+
create_duration = "30s"
79+
}
80+
81+
resource "google_kms_project_kaj_policy_config" "example" {
82+
provider = google-beta
83+
project = google_project.kms_project.project_id
84+
default_key_access_justification_policy {
85+
allowed_access_reasons = [
86+
"CUSTOMER_INITIATED_ACCESS",
87+
"GOOGLE_INITIATED_SYSTEM_OPERATION",
88+
]
89+
}
90+
depends_on = [time_sleep.wait_enable_service_api]
91+
}
92+
`, context)
93+
}
94+
95+
func testAccKMSProjectKajPolicyConfig_update(context map[string]interface{}) string {
96+
return acctest.Nprintf(`
97+
# Create a project
98+
resource "google_project" "kms_project" {
99+
provider = google-beta
100+
project_id = "tf-test-my-project%{random_suffix}"
101+
name = "tf-test-my-project%{random_suffix}"
102+
org_id = "%{org_id}"
103+
billing_account = "%{billing_account}"
104+
deletion_policy = "DELETE"
105+
}
106+
107+
# Enable the Cloud KMS API.
108+
resource "google_project_service" "kms_api_service" {
109+
provider = google-beta
110+
service = "cloudkms.googleapis.com"
111+
project = google_project.kms_project.project_id
112+
disable_dependent_services = true
113+
depends_on = [google_project.kms_project]
114+
}
115+
116+
resource "time_sleep" "wait_enable_service_api" {
117+
depends_on = [google_project_service.kms_api_service]
118+
create_duration = "30s"
119+
}
120+
121+
resource "google_kms_project_kaj_policy_config" "example" {
122+
provider = google-beta
123+
project = google_project.kms_project.project_id
124+
default_key_access_justification_policy {
125+
allowed_access_reasons = [
126+
"CUSTOMER_INITIATED_ACCESS",
127+
]
128+
}
129+
depends_on = [time_sleep.wait_enable_service_api]
130+
}
131+
`, context)
132+
}
133+
{{- end}}

0 commit comments

Comments
 (0)