Skip to content

Commit 761a854

Browse files
modular-magicianmodular-magician
authored
Add support for name in GcpUserAccessBinding (#14520) (#23638)
[upstream:4ab6c4db0aa1540b58a15a5d88028996507d7f7a] Signed-off-by: Modular Magician <[email protected]>
1 parent 1b3d0a9 commit 761a854

5 files changed

+123
-4
lines changed

‎.changelog/14520.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
accesscontextmanager: added `name` to `google_access_context_manager_gcp_user_access_binding` resource
3+
```

‎google/services/accesscontextmanager/resource_access_context_manager_gcp_user_access_binding.go

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ func ResourceAccessContextManagerGcpUserAccessBinding() *schema.Resource {
171171
"restricted_client_application": {
172172
Type: schema.TypeList,
173173
Optional: true,
174-
Description: `Optional. The application that is subject to this binding's scope.`,
174+
Description: `Optional. The application that is subject to this binding's scope. Only one of clientId or name should be specified.`,
175175
MaxItems: 1,
176176
Elem: &schema.Resource{
177177
Schema: map[string]*schema.Schema{
@@ -180,6 +180,11 @@ func ResourceAccessContextManagerGcpUserAccessBinding() *schema.Resource {
180180
Optional: true,
181181
Description: `The OAuth client ID of the application.`,
182182
},
183+
"name": {
184+
Type: schema.TypeString,
185+
Optional: true,
186+
Description: `The name of the application. Example: "Cloud Console"`,
187+
},
183188
},
184189
},
185190
},
@@ -655,12 +660,18 @@ func flattenAccessContextManagerGcpUserAccessBindingScopedAccessSettingsScopeCli
655660
transformed := make(map[string]interface{})
656661
transformed["client_id"] =
657662
flattenAccessContextManagerGcpUserAccessBindingScopedAccessSettingsScopeClientScopeRestrictedClientApplicationClientId(original["clientId"], d, config)
663+
transformed["name"] =
664+
flattenAccessContextManagerGcpUserAccessBindingScopedAccessSettingsScopeClientScopeRestrictedClientApplicationName(original["name"], d, config)
658665
return []interface{}{transformed}
659666
}
660667
func flattenAccessContextManagerGcpUserAccessBindingScopedAccessSettingsScopeClientScopeRestrictedClientApplicationClientId(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
661668
return v
662669
}
663670

671+
func flattenAccessContextManagerGcpUserAccessBindingScopedAccessSettingsScopeClientScopeRestrictedClientApplicationName(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
672+
return v
673+
}
674+
664675
func flattenAccessContextManagerGcpUserAccessBindingScopedAccessSettingsActiveSettings(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
665676
if v == nil {
666677
return nil
@@ -903,13 +914,24 @@ func expandAccessContextManagerGcpUserAccessBindingScopedAccessSettingsScopeClie
903914
transformed["clientId"] = transformedClientId
904915
}
905916

917+
transformedName, err := expandAccessContextManagerGcpUserAccessBindingScopedAccessSettingsScopeClientScopeRestrictedClientApplicationName(original["name"], d, config)
918+
if err != nil {
919+
return nil, err
920+
} else if val := reflect.ValueOf(transformedName); val.IsValid() && !tpgresource.IsEmptyValue(val) {
921+
transformed["name"] = transformedName
922+
}
923+
906924
return transformed, nil
907925
}
908926

909927
func expandAccessContextManagerGcpUserAccessBindingScopedAccessSettingsScopeClientScopeRestrictedClientApplicationClientId(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
910928
return v, nil
911929
}
912930

931+
func expandAccessContextManagerGcpUserAccessBindingScopedAccessSettingsScopeClientScopeRestrictedClientApplicationName(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
932+
return v, nil
933+
}
934+
913935
func expandAccessContextManagerGcpUserAccessBindingScopedAccessSettingsActiveSettings(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
914936
l := v.([]interface{})
915937
if len(l) == 0 || l[0] == nil {

‎google/services/accesscontextmanager/resource_access_context_manager_gcp_user_access_binding_generated_meta.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ fields:
1818
- field: 'scoped_access_settings.active_settings.session_settings.use_oidc_max_age'
1919
- field: 'scoped_access_settings.dry_run_settings.access_levels'
2020
- field: 'scoped_access_settings.scope.client_scope.restricted_client_application.client_id'
21+
- field: 'scoped_access_settings.scope.client_scope.restricted_client_application.name'
2122
- field: 'session_settings.max_inactivity'
2223
- field: 'session_settings.session_length'
2324
- field: 'session_settings.session_length_enabled'

‎google/services/accesscontextmanager/resource_access_context_manager_gcp_user_access_binding_test.go

Lines changed: 91 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,15 @@ func testAccAccessContextManagerGcpUserAccessBinding_basicTest(t *testing.T) {
5757
ImportStateVerify: true,
5858
ImportStateVerifyIgnore: []string{"organization_id"},
5959
},
60+
{
61+
Config: testAccAccessContextManagerGcpUserAccessBinding_accessContextManagerGcpUserAccessBindingNamedExample(context),
62+
},
63+
{
64+
ResourceName: "google_access_context_manager_gcp_user_access_binding.gcp_user_access_binding",
65+
ImportState: true,
66+
ImportStateVerify: true,
67+
ImportStateVerifyIgnore: []string{"organization_id"},
68+
},
6069
},
6170
})
6271
}
@@ -108,7 +117,6 @@ resource "google_access_context_manager_gcp_user_access_binding" "gcp_user_acces
108117
google_access_context_manager_access_level.tf_test_access_level_id_for_user_access_binding%{random_suffix}.name,
109118
]
110119
session_settings {
111-
max_inactivity = "300s"
112120
session_length = "1800s"
113121
session_length_enabled = true
114122
session_reauth_method = "LOGIN"
@@ -127,7 +135,88 @@ resource "google_access_context_manager_gcp_user_access_binding" "gcp_user_acces
127135
google_access_context_manager_access_level.tf_test_access_level_id_for_user_access_binding%{random_suffix}.name,
128136
]
129137
session_settings {
130-
max_inactivity = "300s"
138+
session_length = "1800s"
139+
session_length_enabled = true
140+
session_reauth_method = "LOGIN"
141+
use_oidc_max_age = false
142+
}
143+
}
144+
dry_run_settings {
145+
access_levels = [
146+
google_access_context_manager_access_level.tf_test_access_level_id_for_user_access_binding%{random_suffix}.name,
147+
]
148+
}
149+
}
150+
}
151+
`, context)
152+
}
153+
154+
func testAccAccessContextManagerGcpUserAccessBinding_accessContextManagerGcpUserAccessBindingNamedExample(context map[string]interface{}) string {
155+
return acctest.Nprintf(`
156+
resource "google_cloud_identity_group" "group" {
157+
display_name = "tf-test-my-identity-group%{random_suffix}"
158+
159+
parent = "customers/%{cust_id}"
160+
161+
group_key {
162+
id = "tf-test-my-identity-group%{random_suffix}@%{org_domain}"
163+
}
164+
165+
labels = {
166+
"cloudidentity.googleapis.com/groups.discussion_forum" = ""
167+
}
168+
}
169+
170+
resource "google_access_context_manager_access_level" "tf_test_access_level_id_for_user_access_binding%{random_suffix}" {
171+
parent = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}"
172+
name = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}/accessLevels/tf_test_chromeos_no_lock%{random_suffix}"
173+
title = "tf_test_chromeos_no_lock%{random_suffix}"
174+
basic {
175+
conditions {
176+
device_policy {
177+
require_screen_lock = true
178+
os_constraints {
179+
os_type = "DESKTOP_CHROME_OS"
180+
}
181+
}
182+
regions = [
183+
"US",
184+
]
185+
}
186+
}
187+
}
188+
189+
resource "google_access_context_manager_access_policy" "access-policy" {
190+
parent = "organizations/%{org_id}"
191+
title = "my policy"
192+
}
193+
194+
resource "google_access_context_manager_gcp_user_access_binding" "gcp_user_access_binding" {
195+
organization_id = "%{org_id}"
196+
group_key = trimprefix(google_cloud_identity_group.group.id, "groups/")
197+
access_levels = [
198+
google_access_context_manager_access_level.tf_test_access_level_id_for_user_access_binding%{random_suffix}.name,
199+
]
200+
session_settings {
201+
session_length = "1800s"
202+
session_length_enabled = true
203+
session_reauth_method = "LOGIN"
204+
use_oidc_max_age = false
205+
}
206+
scoped_access_settings {
207+
scope {
208+
client_scope {
209+
restricted_client_application {
210+
name = "Cloud Console"
211+
}
212+
}
213+
}
214+
active_settings {
215+
access_levels = [
216+
google_access_context_manager_access_level.tf_test_access_level_id_for_user_access_binding%{random_suffix}.name,
217+
]
218+
session_settings {
219+
max_inactivity = "400s"
131220
session_length = "1800s"
132221
session_length_enabled = true
133222
session_reauth_method = "LOGIN"

‎website/docs/r/access_context_manager_gcp_user_access_binding.html.markdown

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ The following arguments are supported:
164164

165165
* `restricted_client_application` -
166166
(Optional)
167-
Optional. The application that is subject to this binding's scope.
167+
Optional. The application that is subject to this binding's scope. Only one of clientId or name should be specified.
168168
Structure is [documented below](#nested_scoped_access_settings_scoped_access_settings_scope_client_scope_restricted_client_application).
169169

170170

@@ -174,6 +174,10 @@ The following arguments are supported:
174174
(Optional)
175175
The OAuth client ID of the application.
176176

177+
* `name` -
178+
(Optional)
179+
The name of the application. Example: "Cloud Console"
180+
177181
<a name="nested_scoped_access_settings_scoped_access_settings_active_settings"></a>The `active_settings` block supports:
178182

179183
* `access_levels` -

0 commit comments

Comments
 (0)