Skip to content

Commit fffb4a4

Browse files
modular-magicianmodular-magician
authored
Update CMEK usage in Bigquery tests (#11953) (#8488)
[upstream:561d8275871a2279c4cc85e1295adf211e2dad00] Signed-off-by: Modular Magician <[email protected]>
1 parent eeb83d3 commit fffb4a4

File tree

5 files changed

+81
-76
lines changed

5 files changed

+81
-76
lines changed

‎.changelog/11953.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
```release-note:none
2+
```

‎google-beta/services/bigquery/resource_bigquery_job_generated_test.go‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -495,12 +495,13 @@ locals {
495495
}
496496
497497
resource "google_bigquery_table" "source" {
498-
deletion_protection = false
499498
count = local.count
500499
501500
dataset_id = google_bigquery_dataset.source[count.index].dataset_id
502501
table_id = "tf_test_job_copy%{random_suffix}_${count.index}_table"
503502
503+
deletion_protection = false
504+
504505
schema = <<EOF
505506
[
506507
{
@@ -560,7 +561,7 @@ EOF
560561
kms_key_name = google_kms_crypto_key.crypto_key.id
561562
}
562563
563-
depends_on = ["google_project_iam_member.encrypt_role"]
564+
depends_on = ["google_kms_crypto_key_iam_member.encrypt_role"]
564565
}
565566
566567
resource "google_bigquery_dataset" "dest" {
@@ -584,8 +585,8 @@ data "google_project" "project" {
584585
project_id = "%{project}"
585586
}
586587
587-
resource "google_project_iam_member" "encrypt_role" {
588-
project = data.google_project.project.project_id
588+
resource "google_kms_crypto_key_iam_member" "encrypt_role" {
589+
crypto_key_id = google_kms_crypto_key.crypto_key.id
589590
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
590591
member = "serviceAccount:bq-${data.google_project.project.number}@bigquery-encryption.iam.gserviceaccount.com"
591592
}
@@ -617,7 +618,7 @@ resource "google_bigquery_job" "job" {
617618
}
618619
}
619620
620-
depends_on = ["google_project_iam_member.encrypt_role"]
621+
depends_on = ["google_kms_crypto_key_iam_member.encrypt_role"]
621622
}
622623
`, context)
623624
}
@@ -721,7 +722,7 @@ EOF
721722
kms_key_name = google_kms_crypto_key.crypto_key.id
722723
}
723724
724-
depends_on = ["google_project_iam_member.encrypt_role"]
725+
depends_on = ["google_kms_crypto_key_iam_member.encrypt_role"]
725726
}
726727
727728
resource "google_bigquery_dataset" "dest" {
@@ -745,8 +746,8 @@ data "google_project" "project" {
745746
project_id = "%{project}"
746747
}
747748
748-
resource "google_project_iam_member" "encrypt_role" {
749-
project = data.google_project.project.project_id
749+
resource "google_kms_crypto_key_iam_member" "encrypt_role" {
750+
crypto_key_id = google_kms_crypto_key.crypto_key.id
750751
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
751752
member = "serviceAccount:bq-${data.google_project.project.number}@bigquery-encryption.iam.gserviceaccount.com"
752753
}
@@ -772,7 +773,7 @@ resource "google_bigquery_job" "job" {
772773
}
773774
}
774775
775-
depends_on = ["google_project_iam_member.encrypt_role"]
776+
depends_on = ["google_kms_crypto_key_iam_member.encrypt_role"]
776777
}
777778
`, context)
778779
}

‎google-beta/services/bigqueryconnection/resource_bigquery_connection_generated_test.go‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -468,13 +468,12 @@ resource "google_dataproc_cluster" "basic" {
468468
`, context)
469469
}
470470

471-
func TestAccBigqueryConnectionConnection_bigqueryConnectionKmsExample(t *testing.T) {
471+
func TestAccBigqueryConnectionConnection_bigqueryConnectionSqlWithCmekExample(t *testing.T) {
472472
t.Parallel()
473473

474474
context := map[string]interface{}{
475475
"deletion_protection": false,
476476
"kms_key_name": acctest.BootstrapKMSKey(t).CryptoKey.Name,
477-
"policyChanged": acctest.BootstrapPSARole(t, "bq-", "bigquery-encryption", "roles/cloudkms.cryptoKeyEncrypterDecrypter"),
478477
"random_suffix": acctest.RandString(t, 10),
479478
}
480479

@@ -484,7 +483,7 @@ func TestAccBigqueryConnectionConnection_bigqueryConnectionKmsExample(t *testing
484483
CheckDestroy: testAccCheckBigqueryConnectionConnectionDestroyProducer(t),
485484
Steps: []resource.TestStep{
486485
{
487-
Config: testAccBigqueryConnectionConnection_bigqueryConnectionKmsExample(context),
486+
Config: testAccBigqueryConnectionConnection_bigqueryConnectionSqlWithCmekExample(context),
488487
},
489488
{
490489
ResourceName: "google_bigquery_connection.bq-connection-cmek",
@@ -496,54 +495,55 @@ func TestAccBigqueryConnectionConnection_bigqueryConnectionKmsExample(t *testing
496495
})
497496
}
498497

499-
func testAccBigqueryConnectionConnection_bigqueryConnectionKmsExample(context map[string]interface{}) string {
498+
func testAccBigqueryConnectionConnection_bigqueryConnectionSqlWithCmekExample(context map[string]interface{}) string {
500499
return acctest.Nprintf(`
501500
resource "google_sql_database_instance" "instance" {
502-
name = "tf-test-my-database-instance%{random_suffix}"
503-
database_version = "POSTGRES_11"
504-
region = "us-central1"
505-
settings {
506-
tier = "db-f1-micro"
507-
}
501+
name = "tf-test-my-database-instance%{random_suffix}"
502+
region = "us-central1"
508503
509-
deletion_protection = "%{deletion_protection}"
504+
database_version = "POSTGRES_11"
505+
settings {
506+
tier = "db-f1-micro"
507+
}
508+
509+
deletion_protection = "%{deletion_protection}"
510510
}
511511
512512
resource "google_sql_database" "db" {
513-
instance = google_sql_database_instance.instance.name
514-
name = "db"
513+
instance = google_sql_database_instance.instance.name
514+
name = "db"
515515
}
516516
517517
resource "google_sql_user" "user" {
518-
name = "user%{random_suffix}"
519-
instance = google_sql_database_instance.instance.name
520-
password = "tf-test-my-password%{random_suffix}"
518+
name = "user%{random_suffix}"
519+
instance = google_sql_database_instance.instance.name
520+
password = "tf-test-my-password%{random_suffix}"
521521
}
522522
523523
data "google_bigquery_default_service_account" "bq_sa" {}
524524
525-
data "google_project" "project" {}
526-
527-
resource "google_project_iam_member" "key_sa_user" {
528-
project = data.google_project.project.project_id
525+
resource "google_kms_crypto_key_iam_member" "key_sa_user" {
526+
crypto_key_id = "%{kms_key_name}"
529527
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
530528
member = "serviceAccount:${data.google_bigquery_default_service_account.bq_sa.email}"
531529
}
532530
533531
resource "google_bigquery_connection" "bq-connection-cmek" {
534-
friendly_name = "👋"
535-
description = "a riveting description"
536-
location = "US"
537-
kms_key_name = "%{kms_key_name}"
538-
cloud_sql {
539-
instance_id = google_sql_database_instance.instance.connection_name
540-
database = google_sql_database.db.name
541-
type = "POSTGRES"
542-
credential {
543-
username = google_sql_user.user.name
544-
password = google_sql_user.user.password
545-
}
532+
friendly_name = "👋"
533+
description = "a riveting description"
534+
location = "US"
535+
kms_key_name = "%{kms_key_name}"
536+
cloud_sql {
537+
instance_id = google_sql_database_instance.instance.connection_name
538+
database = google_sql_database.db.name
539+
type = "POSTGRES"
540+
credential {
541+
username = google_sql_user.user.name
542+
password = google_sql_user.user.password
546543
}
544+
}
545+
546+
depends_on = [google_kms_crypto_key_iam_member.key_sa_user]
547547
}
548548
`, context)
549549
}

‎website/docs/r/bigquery_connection.html.markdown‎

Lines changed: 31 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -279,60 +279,61 @@ resource "google_dataproc_cluster" "basic" {
279279
}
280280
```
281281
<div class = "oics-button" style="float: right; margin: 0 0 -15px">
282-
<a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md&cloudshell_working_dir=bigquery_connection_kms&open_in_editor=main.tf" target="_blank">
282+
<a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md&cloudshell_working_dir=bigquery_connection_sql_with_cmek&open_in_editor=main.tf" target="_blank">
283283
<img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
284284
</a>
285285
</div>
286-
## Example Usage - Bigquery Connection Kms
286+
## Example Usage - Bigquery Connection Sql With Cmek
287287

288288

289289
```hcl
290290
resource "google_sql_database_instance" "instance" {
291-
name = "my-database-instance"
292-
database_version = "POSTGRES_11"
293-
region = "us-central1"
294-
settings {
295-
tier = "db-f1-micro"
296-
}
291+
name = "my-database-instance"
292+
region = "us-central1"
297293
298-
deletion_protection = "true"
294+
database_version = "POSTGRES_11"
295+
settings {
296+
tier = "db-f1-micro"
297+
}
298+
299+
deletion_protection = "true"
299300
}
300301
301302
resource "google_sql_database" "db" {
302-
instance = google_sql_database_instance.instance.name
303-
name = "db"
303+
instance = google_sql_database_instance.instance.name
304+
name = "db"
304305
}
305306
306307
resource "google_sql_user" "user" {
307-
name = "user"
308-
instance = google_sql_database_instance.instance.name
309-
password = "tf-test-my-password%{random_suffix}"
308+
name = "user"
309+
instance = google_sql_database_instance.instance.name
310+
password = "tf-test-my-password%{random_suffix}"
310311
}
311312
312313
data "google_bigquery_default_service_account" "bq_sa" {}
313314
314-
data "google_project" "project" {}
315-
316-
resource "google_project_iam_member" "key_sa_user" {
317-
project = data.google_project.project.project_id
315+
resource "google_kms_crypto_key_iam_member" "key_sa_user" {
316+
crypto_key_id = "projects/project/locations/us-central1/keyRings/us-central1/cryptoKeys/bq-key"
318317
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
319318
member = "serviceAccount:${data.google_bigquery_default_service_account.bq_sa.email}"
320319
}
321320
322321
resource "google_bigquery_connection" "bq-connection-cmek" {
323-
friendly_name = "👋"
324-
description = "a riveting description"
325-
location = "US"
326-
kms_key_name = "projects/project/locations/us-central1/keyRings/us-central1/cryptoKeys/bq-key"
327-
cloud_sql {
328-
instance_id = google_sql_database_instance.instance.connection_name
329-
database = google_sql_database.db.name
330-
type = "POSTGRES"
331-
credential {
332-
username = google_sql_user.user.name
333-
password = google_sql_user.user.password
334-
}
322+
friendly_name = "👋"
323+
description = "a riveting description"
324+
location = "US"
325+
kms_key_name = "projects/project/locations/us-central1/keyRings/us-central1/cryptoKeys/bq-key"
326+
cloud_sql {
327+
instance_id = google_sql_database_instance.instance.connection_name
328+
database = google_sql_database.db.name
329+
type = "POSTGRES"
330+
credential {
331+
username = google_sql_user.user.name
332+
password = google_sql_user.user.password
335333
}
334+
}
335+
336+
depends_on = [google_kms_crypto_key_iam_member.key_sa_user]
336337
}
337338
```
338339

‎website/docs/r/bigquery_job.html.markdown‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -309,12 +309,13 @@ locals {
309309
}
310310
311311
resource "google_bigquery_table" "source" {
312-
deletion_protection = false
313312
count = local.count
314313
315314
dataset_id = google_bigquery_dataset.source[count.index].dataset_id
316315
table_id = "job_copy_${count.index}_table"
317316
317+
deletion_protection = false
318+
318319
schema = <<EOF
319320
[
320321
{
@@ -374,7 +375,7 @@ EOF
374375
kms_key_name = google_kms_crypto_key.crypto_key.id
375376
}
376377
377-
depends_on = ["google_project_iam_member.encrypt_role"]
378+
depends_on = ["google_kms_crypto_key_iam_member.encrypt_role"]
378379
}
379380
380381
resource "google_bigquery_dataset" "dest" {
@@ -398,8 +399,8 @@ data "google_project" "project" {
398399
project_id = "my-project-name"
399400
}
400401
401-
resource "google_project_iam_member" "encrypt_role" {
402-
project = data.google_project.project.project_id
402+
resource "google_kms_crypto_key_iam_member" "encrypt_role" {
403+
crypto_key_id = google_kms_crypto_key.crypto_key.id
403404
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
404405
member = "serviceAccount:bq-${data.google_project.project.number}@bigquery-encryption.iam.gserviceaccount.com"
405406
}
@@ -431,7 +432,7 @@ resource "google_bigquery_job" "job" {
431432
}
432433
}
433434
434-
depends_on = ["google_project_iam_member.encrypt_role"]
435+
depends_on = ["google_kms_crypto_key_iam_member.encrypt_role"]
435436
}
436437
```
437438
<div class = "oics-button" style="float: right; margin: 0 0 -15px">

0 commit comments

Comments
 (0)