Skip to content

Commit 8655bb0

Browse files
chengliwmc2thorn
chengliwm
and
c2thorn
authored
Add new resource FolderKajPolicyConfig (#15228)
Co-authored-by: Cameron Thornton <[email protected]>
1 parent 0b824e0 commit 8655bb0

File tree

3 files changed

+316
-0
lines changed

3 files changed

+316
-0
lines changed

‎mmv1/products/kms/FolderKajPolicyConfig.yaml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
# Copyright 2024 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
name: 'FolderKajPolicyConfig'
16+
api_resource_type_kind: KeyAccessJustificationsPolicyConfig
17+
api_variant_patterns:
18+
- 'folders/{{folder}}/kajPolicyConfig'
19+
description: |
20+
`FolderKajPolicyConfigs` is a folder-level singleton resource
21+
used to configure the default KAJ policy of newly created key.
22+
23+
~> **Note:** FolderKajPolicyConfigs cannot be deleted from Google Cloud Platform.
24+
Destroying a Terraform-managed FolderKajPolicyConfigs will remove it from state but
25+
*will not delete the resource from Google Cloud Platform.*
26+
min_version: 'beta'
27+
references:
28+
guides:
29+
'Set default Key Access Justifications policy': 'https://cloud.google.com/assured-workloads/key-access-justifications/docs/set-default-policy'
30+
api: 'https://cloud.google.com/kms/docs/reference/rest/v1/KeyAccessJustificationsPolicyConfig'
31+
docs:
32+
id_format: 'folders/{{folder}}/kajPolicyConfig'
33+
base_url: 'folders/{{folder}}/kajPolicyConfig'
34+
self_link: 'folders/{{folder}}/kajPolicyConfig'
35+
# This is a singleton resource that is already created, so create
36+
# is really an update, and therefore should be PATCHed.
37+
create_url: 'folders/{{folder}}/kajPolicyConfig?updateMask=defaultKeyAccessJustificationPolicy'
38+
create_verb: 'PATCH'
39+
update_url: 'folders/{{folder}}/kajPolicyConfig?updateMask=defaultKeyAccessJustificationPolicy'
40+
update_verb: 'PATCH'
41+
# This is a singleton resource that cannot be deleted.
42+
exclude_delete: true
43+
exclude_sweeper: true
44+
import_format:
45+
- 'folders/{{folder}}/kajPolicyConfig'
46+
timeouts:
47+
insert_minutes: 20
48+
update_minutes: 20
49+
delete_minutes: 20
50+
custom_code:
51+
post_create: 'templates/terraform/post_create/sleep_1_min.go.tmpl'
52+
post_update: 'templates/terraform/post_create/sleep_1_min.go.tmpl'
53+
examples:
54+
- name: 'kms_folder_kaj_policy_config_basic'
55+
# random external provider
56+
skip_vcr: true
57+
primary_resource_id: "example"
58+
min_version: 'beta'
59+
vars:
60+
folder_name: 'my-folder'
61+
test_env_vars:
62+
org_id: 'ORG_ID'
63+
billing_account: 'BILLING_ACCT'
64+
external_providers: ["random", "time"]
65+
parameters:
66+
- name: 'folder'
67+
type: String
68+
description: |
69+
The numeric folder number for which to retrieve config.
70+
min_version: 'beta'
71+
url_param_only: true
72+
required: true
73+
immutable: true
74+
properties:
75+
- name: 'defaultKeyAccessJustificationPolicy'
76+
type: NestedObject
77+
description: |
78+
The default key access justification policy used when a CryptoKey is
79+
created in this folder. This is only used when a Key Access Justifications
80+
policy is not provided in the CreateCryptoKeyRequest.
81+
properties:
82+
- name: 'allowedAccessReasons'
83+
type: Array
84+
description: |
85+
A KeyAccessJustificationsPolicy specifies zero or more allowed
86+
AccessReason values for encrypt, decrypt, and sign operations on a
87+
CryptoKey.
88+
item_type:
89+
type: Enum
90+
description: |
91+
Describes the reason for a data access. Please refer to
92+
https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
93+
for the detailed semantic meaning of justification reason codes.
94+
enum_values:
95+
- 'CUSTOMER_INITIATED_SUPPORT'
96+
- 'GOOGLE_INITIATED_SERVICE'
97+
- 'THIRD_PARTY_DATA_REQUEST'
98+
- 'GOOGLE_INITIATED_REVIEW'
99+
- 'CUSTOMER_INITIATED_ACCESS'
100+
- 'GOOGLE_INITIATED_SYSTEM_OPERATION'
101+
- 'REASON_NOT_EXPECTED'
102+
- 'MODIFIED_CUSTOMER_INITIATED_ACCESS'
103+
- 'MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION'
104+
- 'GOOGLE_RESPONSE_TO_PRODUCTION_ALERT'
105+
- 'CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING'

‎mmv1/templates/terraform/examples/kms_folder_kaj_policy_config_basic.tf.tmpl‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# Create Folder in GCP Organization.
2+
resource "google_folder" "kaj_folder" {
3+
provider = google-beta
4+
display_name = "{{index $.Vars "folder_name"}}"
5+
parent = "organizations/{{index $.TestEnvVars "org_id"}}"
6+
deletion_protection = false
7+
}
8+
9+
resource "random_id" "project_suffix" {
10+
byte_length = 4
11+
}
12+
13+
# Create a project for enabling KMS API.
14+
resource "google_project" "kms_project" {
15+
provider = google-beta
16+
project_id = "kms-api-project${random_id.project_suffix.hex}"
17+
name = "kms-api-project${random_id.project_suffix.hex}"
18+
folder_id = google_folder.kaj_folder.folder_id
19+
billing_account = "{{index $.TestEnvVars "billing_account"}}"
20+
depends_on = [google_folder.kaj_folder]
21+
deletion_policy = "DELETE"
22+
}
23+
24+
# Enable the Cloud KMS API.
25+
resource "google_project_service" "kms_api_service" {
26+
provider = google-beta
27+
service = "cloudkms.googleapis.com"
28+
project = google_project.kms_project.project_id
29+
disable_dependent_services = true
30+
depends_on = [google_project.kms_project]
31+
}
32+
33+
resource "time_sleep" "wait_enable_service_api" {
34+
depends_on = [google_project_service.kms_api_service]
35+
create_duration = "30s"
36+
}
37+
# Update folder level KAJ default policy
38+
resource "google_kms_folder_kaj_policy_config" "{{$.PrimaryResourceId}}" {
39+
provider = google-beta
40+
folder = google_folder.kaj_folder.folder_id
41+
default_key_access_justification_policy {
42+
allowed_access_reasons = [
43+
"CUSTOMER_INITIATED_ACCESS",
44+
"GOOGLE_INITIATED_SYSTEM_OPERATION",
45+
]
46+
}
47+
depends_on = [time_sleep.wait_enable_service_api]
48+
}

‎mmv1/third_party/terraform/services/kms/resource_kms_folder_kaj_policy_config_test.go.tmpl‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
package kms_test
2+
3+
{{- if ne $.TargetVersionName "ga" }}
4+
import (
5+
"testing"
6+
7+
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
8+
"github.com/hashicorp/terraform-plugin-testing/plancheck"
9+
10+
"github.com/hashicorp/terraform-provider-google/google/acctest"
11+
"github.com/hashicorp/terraform-provider-google/google/envvar"
12+
)
13+
14+
func TestAccKMSFolderKajPolicyConfig_update(t *testing.T) {
15+
acctest.SkipIfVcr(t)
16+
t.Parallel()
17+
18+
context := map[string]interface{}{
19+
"billing_account": envvar.GetTestBillingAccountFromEnv(t),
20+
"org_id": envvar.GetTestOrgFromEnv(t),
21+
"random_suffix": acctest.RandString(t, 10),
22+
}
23+
24+
acctest.VcrTest(t, resource.TestCase{
25+
PreCheck: func() { acctest.AccTestPreCheck(t) },
26+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
27+
ExternalProviders: map[string]resource.ExternalProvider{
28+
"random": {},
29+
"time": {},
30+
},
31+
Steps: []resource.TestStep{
32+
{
33+
Config: testAccKMSFolderKajPolicyConfig_basic(context),
34+
},
35+
{
36+
ResourceName: "google_kms_folder_kaj_policy_config.example",
37+
ImportState: true,
38+
ImportStateVerify: true,
39+
ImportStateVerifyIgnore: []string{"folder"},
40+
},
41+
{
42+
Config: testAccKMSFolderKajPolicyConfig_update(context),
43+
ConfigPlanChecks: resource.ConfigPlanChecks{
44+
PreApply: []plancheck.PlanCheck{
45+
plancheck.ExpectResourceAction("google_kms_folder_kaj_policy_config.example", plancheck.ResourceActionUpdate),
46+
},
47+
},
48+
},
49+
{
50+
ResourceName: "google_kms_folder_kaj_policy_config.example",
51+
ImportState: true,
52+
ImportStateVerify: true,
53+
ImportStateVerifyIgnore: []string{"folder"},
54+
},
55+
},
56+
})
57+
}
58+
59+
func testAccKMSFolderKajPolicyConfig_basic(context map[string]interface{}) string {
60+
return acctest.Nprintf(`
61+
# Create Folder in GCP Organization.
62+
resource "google_folder" "kaj_folder" {
63+
provider = google-beta
64+
display_name = "tf-test-my-folder%{random_suffix}"
65+
parent = "organizations/%{org_id}"
66+
deletion_protection = false
67+
}
68+
69+
resource "random_id" "project_suffix" {
70+
byte_length = 4
71+
}
72+
73+
# Create a project for enabling KMS API.
74+
resource "google_project" "kms_project" {
75+
provider = google-beta
76+
project_id = "kms-api-project${random_id.project_suffix.hex}"
77+
name = "kms-api-project${random_id.project_suffix.hex}"
78+
folder_id = google_folder.kaj_folder.folder_id
79+
billing_account = "%{billing_account}"
80+
depends_on = [google_folder.kaj_folder]
81+
deletion_policy = "DELETE"
82+
}
83+
84+
# Enable the Cloud KMS API.
85+
resource "google_project_service" "kms_api_service" {
86+
provider = google-beta
87+
service = "cloudkms.googleapis.com"
88+
project = google_project.kms_project.project_id
89+
disable_dependent_services = true
90+
depends_on = [google_project.kms_project]
91+
}
92+
93+
resource "time_sleep" "wait_enable_service_api" {
94+
depends_on = [google_project_service.kms_api_service]
95+
create_duration = "30s"
96+
}
97+
# Update folder level KAJ default policy
98+
resource "google_kms_folder_kaj_policy_config" "example" {
99+
provider = google-beta
100+
folder = google_folder.kaj_folder.folder_id
101+
default_key_access_justification_policy {
102+
allowed_access_reasons = [
103+
"CUSTOMER_INITIATED_ACCESS",
104+
"GOOGLE_INITIATED_SYSTEM_OPERATION",
105+
]
106+
}
107+
depends_on = [time_sleep.wait_enable_service_api]
108+
}
109+
`, context)
110+
}
111+
112+
func testAccKMSFolderKajPolicyConfig_update(context map[string]interface{}) string {
113+
return acctest.Nprintf(`
114+
# Create Folder in GCP Organization.
115+
resource "google_folder" "kaj_folder" {
116+
provider = google-beta
117+
display_name = "tf-test-my-folder%{random_suffix}"
118+
parent = "organizations/%{org_id}"
119+
deletion_protection = false
120+
}
121+
122+
resource "random_id" "project_suffix" {
123+
byte_length = 4
124+
}
125+
126+
# Create a project for enabling KMS API.
127+
resource "google_project" "kms_project" {
128+
provider = google-beta
129+
project_id = "kms-api-project${random_id.project_suffix.hex}"
130+
name = "kms-api-project${random_id.project_suffix.hex}"
131+
folder_id = google_folder.kaj_folder.folder_id
132+
billing_account = "%{billing_account}"
133+
depends_on = [google_folder.kaj_folder]
134+
deletion_policy = "DELETE"
135+
}
136+
137+
# Enable the Cloud KMS API.
138+
resource "google_project_service" "kms_api_service" {
139+
provider = google-beta
140+
service = "cloudkms.googleapis.com"
141+
project = google_project.kms_project.project_id
142+
disable_dependent_services = true
143+
depends_on = [google_project.kms_project]
144+
}
145+
146+
resource "time_sleep" "wait_enable_service_api" {
147+
depends_on = [google_project_service.kms_api_service]
148+
create_duration = "30s"
149+
}
150+
# Update folder level KAJ default policy
151+
resource "google_kms_folder_kaj_policy_config" "example" {
152+
provider = google-beta
153+
folder = google_folder.kaj_folder.folder_id
154+
default_key_access_justification_policy {
155+
allowed_access_reasons = [
156+
"CUSTOMER_INITIATED_ACCESS",
157+
]
158+
}
159+
depends_on = [time_sleep.wait_enable_service_api]
160+
}
161+
`, context)
162+
}
163+
{{- end }}

0 commit comments

Comments
 (0)