Skip to content

Commit a879f0c

Browse files
chengliwmchengliwm
authored
Add new resource OrganizationKajPolicyConfig (#15219)
1 parent 5663208 commit a879f0c

File tree

4 files changed

+197
-0
lines changed

4 files changed

+197
-0
lines changed

‎mmv1/products/kms/OrganizationKajPolicyConfig.yaml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
# Copyright 2024 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
name: 'OrganizationKajPolicyConfig'
16+
api_resource_type_kind: KeyAccessJustificationsPolicyConfig
17+
api_variant_patterns:
18+
- 'organizations/{{organization}}/kajPolicyConfig'
19+
description: |
20+
`OrganizationKajPolicyConfig` is a organization-level singleton resource
21+
used to configure the default KAJ policy of newly created key.
22+
23+
~> **Note:** OrganizationKajPolicyConfig cannot be deleted from Google Cloud Platform.
24+
Destroying a Terraform-managed OrganizationKajPolicyConfig will remove it from state but
25+
*will not delete the resource from Google Cloud Platform.*
26+
min_version: 'beta'
27+
references:
28+
guides:
29+
'Set default Key Access Justifications policy': 'https://cloud.google.com/assured-workloads/key-access-justifications/docs/set-default-policy'
30+
api: 'https://cloud.google.com/kms/docs/reference/rest/v1/KeyAccessJustificationsPolicyConfig'
31+
docs:
32+
id_format: 'organizations/{{organization}}/kajPolicyConfig'
33+
base_url: 'organizations/{{organization}}/kajPolicyConfig'
34+
self_link: 'organizations/{{organization}}/kajPolicyConfig'
35+
# This is a singleton resource that is already created, so create
36+
# is really an update, and therefore should be PATCHed.
37+
create_url: 'organizations/{{organization}}/kajPolicyConfig?updateMask=defaultKeyAccessJustificationPolicy'
38+
create_verb: 'PATCH'
39+
update_url: 'organizations/{{organization}}/kajPolicyConfig?updateMask=defaultKeyAccessJustificationPolicy'
40+
update_verb: 'PATCH'
41+
# This is a singleton resource that cannot be deleted.
42+
exclude_delete: true
43+
exclude_sweeper: true
44+
import_format:
45+
- 'organizations/{{organization}}/kajPolicyConfig'
46+
timeouts:
47+
insert_minutes: 20
48+
update_minutes: 20
49+
delete_minutes: 20
50+
custom_code:
51+
post_create: 'templates/terraform/post_create/sleep_1_min.go.tmpl'
52+
post_update: 'templates/terraform/post_create/sleep_1_min.go.tmpl'
53+
examples:
54+
- name: 'kms_organization_kaj_policy_config_basic'
55+
primary_resource_id: "example"
56+
min_version: 'beta'
57+
test_env_vars:
58+
org_id: 'ORG_ID'
59+
parameters:
60+
- name: 'organization'
61+
type: String
62+
description: |
63+
The organization number for which to retrieve config.
64+
min_version: 'beta'
65+
url_param_only: true
66+
required: true
67+
immutable: true
68+
properties:
69+
- name: 'defaultKeyAccessJustificationPolicy'
70+
type: NestedObject
71+
description: |
72+
The default key access justification policy used when a CryptoKey is
73+
created in this organization. This is only used when a Key Access Justifications
74+
policy is not provided in the CreateCryptoKeyRequest.
75+
properties:
76+
- name: 'allowedAccessReasons'
77+
type: Array
78+
description: |
79+
A KeyAccessJustificationsPolicy specifies zero or more allowed
80+
AccessReason values for encrypt, decrypt, and sign operations on a
81+
CryptoKey.
82+
item_type:
83+
type: Enum
84+
description: |
85+
Describes the reason for a data access. Please refer to
86+
https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
87+
for the detailed semantic meaning of justification reason codes.
88+
enum_values:
89+
- 'CUSTOMER_INITIATED_SUPPORT'
90+
- 'GOOGLE_INITIATED_SERVICE'
91+
- 'THIRD_PARTY_DATA_REQUEST'
92+
- 'GOOGLE_INITIATED_REVIEW'
93+
- 'CUSTOMER_INITIATED_ACCESS'
94+
- 'GOOGLE_INITIATED_SYSTEM_OPERATION'
95+
- 'REASON_NOT_EXPECTED'
96+
- 'MODIFIED_CUSTOMER_INITIATED_ACCESS'
97+
- 'MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION'
98+
- 'GOOGLE_RESPONSE_TO_PRODUCTION_ALERT'
99+
- 'CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING'

‎mmv1/templates/terraform/examples/kms_organization_kaj_policy_config_basic.tf.tmpl‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
resource "google_kms_organization_kaj_policy_config" "{{$.PrimaryResourceId}}" {
2+
provider = google-beta
3+
organization = "{{index $.TestEnvVars "org_id"}}"
4+
default_key_access_justification_policy {
5+
allowed_access_reasons = [
6+
"CUSTOMER_INITIATED_ACCESS",
7+
"GOOGLE_INITIATED_SYSTEM_OPERATION",
8+
]
9+
}
10+
}

‎mmv1/templates/terraform/post_create/sleep_1_min.go.tmpl‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
// This is useful if the resource in question doesn't have a perfectly consistent API
2+
// That is, the Operation for Create might return before the Get operation shows the
3+
// completed state of the resource.
4+
time.Sleep(1 * time.Minute)

‎mmv1/third_party/terraform/services/kms/resource_kms_organization_kaj_policy_config_test.go.tmpl‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
package kms_test
2+
3+
{{- if ne $.TargetVersionName "ga" }}
4+
import (
5+
"testing"
6+
7+
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
8+
"github.com/hashicorp/terraform-plugin-testing/plancheck"
9+
10+
"github.com/hashicorp/terraform-provider-google/google/acctest"
11+
"github.com/hashicorp/terraform-provider-google/google/envvar"
12+
)
13+
14+
func TestAccKMSOrganizationKajPolicyConfig_update(t *testing.T) {
15+
t.Parallel()
16+
17+
context := map[string]interface{}{
18+
"org_id": envvar.GetTestOrgFromEnv(t),
19+
"random_suffix": acctest.RandString(t, 10),
20+
}
21+
22+
acctest.VcrTest(t, resource.TestCase{
23+
PreCheck: func() { acctest.AccTestPreCheck(t) },
24+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
25+
ExternalProviders: map[string]resource.ExternalProvider{
26+
"time": {},
27+
},
28+
Steps: []resource.TestStep{
29+
{
30+
Config: testAccKMSOrganizationKajPolicyConfig_basic(context),
31+
},
32+
{
33+
ResourceName: "google_kms_organization_kaj_policy_config.example",
34+
ImportState: true,
35+
ImportStateVerify: true,
36+
ImportStateVerifyIgnore: []string{"organization"},
37+
},
38+
{
39+
Config: testAccKMSOrganizationKajPolicyConfig_update(context),
40+
ConfigPlanChecks: resource.ConfigPlanChecks{
41+
PreApply: []plancheck.PlanCheck{
42+
plancheck.ExpectResourceAction("google_kms_organization_kaj_policy_config.example", plancheck.ResourceActionUpdate),
43+
},
44+
},
45+
},
46+
{
47+
ResourceName: "google_kms_organization_kaj_policy_config.example",
48+
ImportState: true,
49+
ImportStateVerify: true,
50+
ImportStateVerifyIgnore: []string{"organization"},
51+
},
52+
},
53+
})
54+
}
55+
56+
func testAccKMSOrganizationKajPolicyConfig_basic(context map[string]interface{}) string {
57+
return acctest.Nprintf(`
58+
resource "google_kms_organization_kaj_policy_config" "example" {
59+
provider = google-beta
60+
organization = "%{org_id}"
61+
default_key_access_justification_policy {
62+
allowed_access_reasons = [
63+
"CUSTOMER_INITIATED_ACCESS",
64+
"GOOGLE_INITIATED_SYSTEM_OPERATION",
65+
]
66+
}
67+
}
68+
`, context)
69+
}
70+
71+
func testAccKMSOrganizationKajPolicyConfig_update(context map[string]interface{}) string {
72+
return acctest.Nprintf(`
73+
resource "google_kms_organization_kaj_policy_config" "example" {
74+
provider = google-beta
75+
organization = "%{org_id}"
76+
default_key_access_justification_policy {
77+
allowed_access_reasons = [
78+
"CUSTOMER_INITIATED_ACCESS",
79+
]
80+
}
81+
}
82+
`, context)
83+
}
84+
{{- end }}

0 commit comments

Comments
 (0)