Deprecate run_as_service_account field in client (#13583) (#22312)

[upstream:eff696154c90353a650bef5a0f242cf76cf68212]

Signed-off-by: Modular Magician <[email protected]>

Author: modular-magician

.changelog/13583.txt

@@ -0,0 +1,3 @@
+```release-note:deprecation
+integrations: deprecated `run_as_service_account` field in `google_integrations_client` resource
+```

google/services/integrations/resource_integrations_client.go

@@ -119,6 +119,7 @@ encrypted with GMEK.`,
 			"run_as_service_account": {
 				Type:        schema.TypeString,
 				Optional:    true,
+				Deprecated:  "`run_as_service_account` is deprecated and will be removed in a future major release.",
 				ForceNew:    true,
 				Description: `User input run-as service account, if empty, will bring up a new default service account.`,
 			},

google/services/integrations/resource_integrations_client_generated_test.go

@@ -66,6 +66,12 @@ resource "google_integrations_client" "example" {
 func TestAccIntegrationsClient_integrationsClientFullExample(t *testing.T) {
 	acctest.SkipIfVcr(t)
 	t.Parallel()
+	acctest.BootstrapIamMembers(t, []acctest.IamMember{
+		{
+			Member: "serviceAccount:service-{project_number}@gcp-sa-integrations.iam.gserviceaccount.com",
+			Role:   "roles/cloudkmskacls.serviceAgent",
+		},
+	})
 
 	context := map[string]interface{}{
 		"crypto_key_name": "tftest-shared-key-1",
@@ -111,15 +117,9 @@ data "google_kms_crypto_key_version" "test_key" {
   crypto_key = data.google_kms_crypto_key.cryptokey.id
 }
 
-resource "google_service_account" "service_account" {
-  account_id   = "tf-test-service-acc%{random_suffix}"
-  display_name = "Service Account"
-}
-
 resource "google_integrations_client" "example" {
   location = "us-east1"
   create_sample_integrations = true
-  run_as_service_account = google_service_account.service_account.email
   cloud_kms_config {
     kms_location = "us-east1"
     kms_ring = basename(data.google_kms_key_ring.keyring.id)
@@ -131,6 +131,48 @@ resource "google_integrations_client" "example" {
 `, context)
 }
 
+func TestAccIntegrationsClient_integrationsClientServiceAccountExample(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckIntegrationsClientDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccIntegrationsClient_integrationsClientServiceAccountExample(context),
+			},
+			{
+				ResourceName:            "google_integrations_client.example",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"cloud_kms_config", "create_sample_integrations", "location", "run_as_service_account"},
+			},
+		},
+	})
+}
+
+func testAccIntegrationsClient_integrationsClientServiceAccountExample(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+data "google_project" "default" {
+}
+
+resource "google_service_account" "service_account" {
+  account_id   = "tf-test-service-acc%{random_suffix}"
+  display_name = "Service Account"
+}
+
+resource "google_integrations_client" "example" {
+  location = "asia-east1"
+  run_as_service_account = google_service_account.service_account.email
+}
+`, context)
+}
+
 func testAccCheckIntegrationsClientDestroyProducer(t *testing.T) func(s *terraform.State) error {
 	return func(s *terraform.State) error {
 		for name, rs := range s.RootModule().Resources {

website/docs/r/integrations_client.html.markdown

@@ -70,15 +70,9 @@ data "google_kms_crypto_key_version" "test_key" {
   crypto_key = data.google_kms_crypto_key.cryptokey.id
 }
 
-resource "google_service_account" "service_account" {
-  account_id   = "service-acc"
-  display_name = "Service Account"
-}
-
 resource "google_integrations_client" "example" {
   location = "us-east1"
   create_sample_integrations = true
-  run_as_service_account = google_service_account.service_account.email
   cloud_kms_config {
     kms_location = "us-east1"
     kms_ring = basename(data.google_kms_key_ring.keyring.id)
@@ -112,9 +106,11 @@ The following arguments are supported:
   Indicates if sample integrations should be created along with provisioning.
 
 * `run_as_service_account` -
-  (Optional)
+  (Optional, Deprecated)
   User input run-as service account, if empty, will bring up a new default service account.
 
+  ~> **Warning:** `run_as_service_account` is deprecated and will be removed in a future major release.
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.