chore: update

Author: ecmadao

provider/data_source_policy.go

@@ -86,30 +86,35 @@ func getMaskingExceptionPolicySchema(computed bool) *schema.Schema {
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
 							"database": {
-								Type:        schema.TypeString,
-								Computed:    computed,
-								Optional:    true,
-								Description: "The database full name in instances/{instance resource id}/databases/{database name} format",
+								Type:         schema.TypeString,
+								Computed:     computed,
+								Optional:     true,
+								ValidateFunc: validation.StringIsNotEmpty,
+								Description:  "The database full name in instances/{instance resource id}/databases/{database name} format",
 							},
 							"schema": {
 								Type:     schema.TypeString,
 								Computed: computed,
 								Optional: true,
 							},
 							"table": {
-								Type:     schema.TypeString,
-								Computed: computed,
-								Optional: true,
+								Type:         schema.TypeString,
+								Computed:     computed,
+								Optional:     true,
+								ValidateFunc: validation.StringIsNotEmpty,
 							},
 							"column": {
-								Type:     schema.TypeString,
-								Computed: computed,
-								Optional: true,
+								Type:         schema.TypeString,
+								Computed:     computed,
+								Optional:     true,
+								ValidateFunc: validation.StringIsNotEmpty,
 							},
 							"member": {
-								Type:     schema.TypeString,
-								Computed: computed,
-								Optional: true,
+								Type:         schema.TypeString,
+								Computed:     computed,
+								Optional:     true,
+								ValidateFunc: validation.StringIsNotEmpty,
+								Description:  "The member in user:{email} format.",
 							},
 							"masking_level": {
 								Type:     schema.TypeString,
@@ -133,7 +138,7 @@ func getMaskingExceptionPolicySchema(computed bool) *schema.Schema {
 								Type:        schema.TypeString,
 								Computed:    computed,
 								Optional:    true,
-								Description: "The exception expire timestamp",
+								Description: "The expiration timestamp in YYYY-MM-DDThh:mm:ss.000Z format",
 							},
 						},
 					},
@@ -164,14 +169,16 @@ func getMaskingPolicySchema(computed bool) *schema.Schema {
 								Optional: true,
 							},
 							"table": {
-								Type:     schema.TypeString,
-								Computed: computed,
-								Optional: true,
+								Type:         schema.TypeString,
+								Computed:     computed,
+								Optional:     true,
+								ValidateFunc: validation.StringIsNotEmpty,
 							},
 							"column": {
-								Type:     schema.TypeString,
-								Computed: computed,
-								Optional: true,
+								Type:         schema.TypeString,
+								Computed:     computed,
+								Optional:     true,
+								ValidateFunc: validation.StringIsNotEmpty,
 							},
 							"full_masking_algorithm_id": {
 								Type:     schema.TypeString,

provider/resource_policy.go

@@ -266,6 +266,10 @@ func convertToMaskingExceptionPolicy(d *schema.ResourceData) (*v1pb.MaskingExcep
 		if expire, ok := rawException["expire_timestamp"].(string); ok && expire != "" {
 			expressions = append(expressions, fmt.Sprintf(`request.time < timestamp("%s")`, expire))
 		}
+		member := rawException["member"].(string)
+		if !strings.HasPrefix(member, "user:") {
+			return nil, errors.Errorf("member should in user:{email} format")
+		}
 		policy.MaskingExceptions = append(policy.MaskingExceptions, &v1pb.MaskingExceptionPolicy_MaskingException{
 			Member: rawException["member"].(string),
 			Action: v1pb.MaskingExceptionPolicy_MaskingException_Action(