bigquery: support for IAM conditions in all google_bigquery_dataset_iam_* resources (#15337) (#24778)

[upstream:3680ab8c2eb6276bcb09eea8f401032c8d2a5402]

Signed-off-by: Modular Magician <[email protected]>

Author: modular-magician

.changelog/15337.txt

@@ -0,0 +1,55 @@
+```release-note:enhancement
+bigquery: supported for IAM conditions in all `google_bigquery_dataset_iam_*` resources
+```
+
+**Local test execution:**
+```console
+➜ make testacc TEST=./google/services/bigquery TESTARGS='-run=TestAccBigqueryDatasetIam -parallel 3'
+
+sh -c "'/Users/ramon/go/src/github.com/hashicorp/terraform-provider-google/scripts/gofmtcheck.sh'"
+==> Checking that code complies with gofmt requirements...
+go vet
+TF_ACC_REFRESH_AFTER_APPLY=1 TF_ACC=1 TF_SCHEMA_PANIC_ON_ERROR=1 go test ./google/services/bigquery -v -run=TestAccBigqueryDatasetIam -parallel 3 -timeout 240m -ldflags="-X=github.com/hashicorp/terraform-provider-google/version.ProviderVersion=acc"
+=== RUN   TestAccBigqueryDatasetIamMember_afterDatasetCreation
+=== PAUSE TestAccBigqueryDatasetIamMember_afterDatasetCreation
+=== RUN   TestAccBigqueryDatasetIamMember_serviceAccount
+=== PAUSE TestAccBigqueryDatasetIamMember_serviceAccount
+=== RUN   TestAccBigqueryDatasetIamMember_iamMemberWithIAMCondition
+=== PAUSE TestAccBigqueryDatasetIamMember_iamMemberWithIAMCondition
+=== RUN   TestAccBigqueryDatasetIamMember_iamMember
+=== PAUSE TestAccBigqueryDatasetIamMember_iamMember
+=== RUN   TestAccBigqueryDatasetIamMember_withDeletedServiceAccount
+=== PAUSE TestAccBigqueryDatasetIamMember_withDeletedServiceAccount
+=== RUN   TestAccBigqueryDatasetIamBinding
+=== PAUSE TestAccBigqueryDatasetIamBinding
+=== RUN   TestAccBigqueryDatasetIamMember
+=== PAUSE TestAccBigqueryDatasetIamMember
+=== RUN   TestAccBigqueryDatasetIamPolicy
+=== PAUSE TestAccBigqueryDatasetIamPolicy
+=== RUN   TestAccBigqueryDatasetIamBindingWithIAMCondition
+=== PAUSE TestAccBigqueryDatasetIamBindingWithIAMCondition
+=== RUN   TestAccBigqueryDatasetIamPolicyWithIAMCondition
+=== PAUSE TestAccBigqueryDatasetIamPolicyWithIAMCondition
+=== CONT  TestAccBigqueryDatasetIamMember_afterDatasetCreation
+=== CONT  TestAccBigqueryDatasetIamBinding
+=== CONT  TestAccBigqueryDatasetIamMember_iamMember
+--- PASS: TestAccBigqueryDatasetIamMember_afterDatasetCreation (45.90s)
+=== CONT  TestAccBigqueryDatasetIamMember_withDeletedServiceAccount
+--- PASS: TestAccBigqueryDatasetIamBinding (49.72s)
+=== CONT  TestAccBigqueryDatasetIamBindingWithIAMCondition
+--- PASS: TestAccBigqueryDatasetIamMember_iamMember (53.58s)
+=== CONT  TestAccBigqueryDatasetIamPolicyWithIAMCondition
+--- PASS: TestAccBigqueryDatasetIamPolicyWithIAMCondition (27.04s)
+=== CONT  TestAccBigqueryDatasetIamMember_iamMemberWithIAMCondition
+--- PASS: TestAccBigqueryDatasetIamMember_withDeletedServiceAccount (36.13s)
+=== CONT  TestAccBigqueryDatasetIamMember_serviceAccount
+--- PASS: TestAccBigqueryDatasetIamBindingWithIAMCondition (63.05s)
+=== CONT  TestAccBigqueryDatasetIamPolicy
+--- PASS: TestAccBigqueryDatasetIamPolicy (30.21s)
+=== CONT  TestAccBigqueryDatasetIamMember
+--- PASS: TestAccBigqueryDatasetIamMember (28.03s)
+--- PASS: TestAccBigqueryDatasetIamMember_serviceAccount (94.86s)
+--- PASS: TestAccBigqueryDatasetIamMember_iamMemberWithIAMCondition (106.98s)
+PASS
+ok      github.com/hashicorp/terraform-provider-google/google/services/bigquery 188.391s
+```

google/services/bigquery/iam_bigquery_dataset.go

@@ -30,6 +30,24 @@ import (
 	"google.golang.org/api/cloudresourcemanager/v1"
 )
 
+type conditionKey struct {
+	Description string
+	Expression  string
+	Title       string
+}
+
+type iamBindingKey struct {
+	Role      string
+	Condition conditionKey
+}
+
+func conditionKeyFromCondition(condition *cloudresourcemanager.Expr) conditionKey {
+	if condition == nil {
+		return conditionKey{}
+	}
+	return conditionKey{Description: condition.Description, Expression: condition.Expression, Title: condition.Title}
+}
+
 var IamBigqueryDatasetSchema = map[string]*schema.Schema{
 	"dataset_id": {
 		Type:     schema.TypeString,
@@ -93,8 +111,12 @@ func BigqueryDatasetIdParseFunc(d *schema.ResourceData, config *transport_tpg.Co
 	return nil
 }
 
+func (u *BigqueryDatasetIamUpdater) policyURL() string {
+	return fmt.Sprintf("%s%s?accessPolicyVersion=3", u.Config.BigQueryBasePath, u.GetResourceId())
+}
+
 func (u *BigqueryDatasetIamUpdater) GetResourceIamPolicy() (*cloudresourcemanager.Policy, error) {
-	url := fmt.Sprintf("%s%s", u.Config.BigQueryBasePath, u.GetResourceId())
+	url := u.policyURL()
 
 	userAgent, err := tpgresource.GenerateUserAgentString(u.d, u.Config.UserAgent)
 	if err != nil {
@@ -120,7 +142,7 @@ func (u *BigqueryDatasetIamUpdater) GetResourceIamPolicy() (*cloudresourcemanage
 }
 
 func (u *BigqueryDatasetIamUpdater) SetResourceIamPolicy(policy *cloudresourcemanager.Policy) error {
-	url := fmt.Sprintf("%s%s", u.Config.BigQueryBasePath, u.GetResourceId())
+	url := u.policyURL()
 
 	access, err := policyToAccess(policy)
 	if err != nil {
@@ -154,7 +176,7 @@ func accessToPolicy(access interface{}) (*cloudresourcemanager.Policy, error) {
 	if access == nil {
 		return nil, nil
 	}
-	roleToBinding := make(map[string]*cloudresourcemanager.Binding)
+	roleToBinding := make(map[iamBindingKey]*cloudresourcemanager.Binding)
 
 	accessArr := access.([]interface{})
 	for _, v := range accessArr {
@@ -174,20 +196,32 @@ func accessToPolicy(access interface{}) (*cloudresourcemanager.Policy, error) {
 		if err != nil {
 			return nil, err
 		}
-		// We have to combine bindings manually
-		binding, ok := roleToBinding[role]
+
+		var condition *cloudresourcemanager.Expr
+		if rawCondition, ok := memberRole["condition"]; ok {
+			conditionMap := rawCondition.(map[string]interface{})
+			expr := conditionMap["expression"].(string)
+			condition = &cloudresourcemanager.Expr{Expression: expr}
+			if title, ok := conditionMap["title"].(string); ok {
+				condition.Title = title
+			}
+			if desc, ok := conditionMap["description"].(string); ok {
+				condition.Description = desc
+			}
+		}
+
+		key := iamBindingKey{Role: role, Condition: conditionKeyFromCondition(condition)}
+		binding, ok := roleToBinding[key]
 		if !ok {
-			binding = &cloudresourcemanager.Binding{Role: role, Members: []string{}}
+			binding = &cloudresourcemanager.Binding{Role: role, Members: []string{}, Condition: condition}
 		}
 		binding.Members = append(binding.Members, member)
-
-		roleToBinding[role] = binding
+		roleToBinding[key] = binding
 	}
-	bindings := make([]*cloudresourcemanager.Binding, 0)
+	bindings := make([]*cloudresourcemanager.Binding, 0, len(roleToBinding))
 	for _, v := range roleToBinding {
 		bindings = append(bindings, v)
 	}
-
 	return &cloudresourcemanager.Policy{Bindings: bindings}, nil
 }
 
@@ -197,9 +231,6 @@ func policyToAccess(policy *cloudresourcemanager.Policy) ([]map[string]interface
 		return nil, errors.New("Access policies not allowed on BigQuery Dataset IAM policies")
 	}
 	for _, binding := range policy.Bindings {
-		if binding.Condition != nil {
-			return nil, errors.New("IAM conditions not allowed on BigQuery Dataset IAM")
-		}
 		if fullRole, ok := bigqueryAccessPrimitiveToRoleMap[binding.Role]; ok {
 			return nil, fmt.Errorf("BigQuery Dataset legacy role %s is not allowed when using google_bigquery_dataset_iam resources. Please use the full form: %s", binding.Role, fullRole)
 		}
@@ -211,6 +242,9 @@ func policyToAccess(policy *cloudresourcemanager.Policy) ([]map[string]interface
 			access := map[string]interface{}{
 				"role": binding.Role,
 			}
+			if binding.Condition != nil {
+				access["condition"] = binding.Condition
+			}
 			memberType, member, err := iamMemberToAccess(member)
 			if err != nil {
 				return nil, err
@@ -279,11 +313,14 @@ func accessToIamMember(access map[string]interface{}) (string, error) {
 		return "", fmt.Errorf("Failed to convert BigQuery Dataset access to IAM member. To use views with a dataset, please use dataset_access")
 	}
 	if member, ok := access["userByEmail"]; ok {
-		// service accounts have "gservice" in their email. This is best guess due to lost information
-		if strings.Contains(member.(string), "gserviceaccount") {
-			return fmt.Sprintf("serviceAccount:%s", member.(string)), nil
+		ms := member.(string)
+		if strings.HasPrefix(ms, "deleted:serviceAccount:") {
+			return ms, nil
+		}
+		if strings.Contains(ms, "gserviceaccount") {
+			return fmt.Sprintf("serviceAccount:%s", ms), nil
 		}
-		return fmt.Sprintf("user:%s", member.(string)), nil
+		return fmt.Sprintf("user:%s", ms), nil
 	}
 	return "", fmt.Errorf("Failed to identify IAM member from BigQuery Dataset access: %v", access)
 }

google/services/bigquery/iam_bigquery_member_dataset.go

@@ -81,8 +81,12 @@ func NewBigqueryDatasetIamMemberUpdater(d tpgresource.TerraformResourceData, con
 	}, nil
 }
 
+func (u *BigqueryDatasetIamMemberUpdater) policyURL() string {
+	return fmt.Sprintf("%s%s?accessPolicyVersion=3", u.Config.BigQueryBasePath, u.GetResourceId())
+}
+
 func (u *BigqueryDatasetIamMemberUpdater) GetResourceIamPolicy() (*cloudresourcemanager.Policy, error) {
-	url := fmt.Sprintf("%s%s", u.Config.BigQueryBasePath, u.GetResourceId())
+	url := u.policyURL()
 
 	userAgent, err := tpgresource.GenerateUserAgentString(u.d, u.Config.UserAgent)
 	if err != nil {
@@ -108,7 +112,7 @@ func (u *BigqueryDatasetIamMemberUpdater) GetResourceIamPolicy() (*cloudresource
 }
 
 func GetCurrentResourceAccess(u *BigqueryDatasetIamMemberUpdater) ([]interface{}, error) {
-	url := fmt.Sprintf("%s%s", u.Config.BigQueryBasePath, u.GetResourceId())
+	url := u.policyURL()
 
 	userAgent, err := tpgresource.GenerateUserAgentString(u.d, u.Config.UserAgent)
 	if err != nil {
@@ -157,7 +161,7 @@ func mergeAccess(newAccess []map[string]interface{}, currAccess []interface{}) [
 }
 
 func (u *BigqueryDatasetIamMemberUpdater) SetResourceIamPolicy(policy *cloudresourcemanager.Policy) error {
-	url := fmt.Sprintf("%s%s", u.Config.BigQueryBasePath, u.GetResourceId())
+	url := u.policyURL()
 
 	newAccess, err := policyToAccessForIamMember(policy)
 	if err != nil {
@@ -199,7 +203,7 @@ func accessToPolicyForIamMember(access interface{}) (*cloudresourcemanager.Polic
 	if access == nil {
 		return nil, nil
 	}
-	roleToBinding := make(map[string]*cloudresourcemanager.Binding)
+	roleToBinding := make(map[iamBindingKey]*cloudresourcemanager.Binding)
 
 	accessArr := access.([]interface{})
 	for _, v := range accessArr {
@@ -219,16 +223,29 @@ func accessToPolicyForIamMember(access interface{}) (*cloudresourcemanager.Polic
 		if err != nil {
 			return nil, err
 		}
-		// We have to combine bindings manually
-		binding, ok := roleToBinding[role]
+
+		var condition *cloudresourcemanager.Expr
+		if rawCondition, ok := memberRole["condition"]; ok {
+			conditionMap := rawCondition.(map[string]interface{})
+			expr := conditionMap["expression"].(string)
+			condition = &cloudresourcemanager.Expr{Expression: expr}
+			if title, ok := conditionMap["title"].(string); ok {
+				condition.Title = title
+			}
+			if desc, ok := conditionMap["description"].(string); ok {
+				condition.Description = desc
+			}
+		}
+
+		key := iamBindingKey{Role: role, Condition: conditionKeyFromCondition(condition)}
+		binding, ok := roleToBinding[key]
 		if !ok {
-			binding = &cloudresourcemanager.Binding{Role: role, Members: []string{}}
+			binding = &cloudresourcemanager.Binding{Role: role, Members: []string{}, Condition: condition}
 		}
 		binding.Members = append(binding.Members, member)
-
-		roleToBinding[role] = binding
+		roleToBinding[key] = binding
 	}
-	bindings := make([]*cloudresourcemanager.Binding, 0)
+	bindings := make([]*cloudresourcemanager.Binding, 0, len(roleToBinding))
 	for _, v := range roleToBinding {
 		bindings = append(bindings, v)
 	}
@@ -242,9 +259,6 @@ func policyToAccessForIamMember(policy *cloudresourcemanager.Policy) ([]map[stri
 		return nil, errors.New("Access policies not allowed on BigQuery Dataset IAM policies")
 	}
 	for _, binding := range policy.Bindings {
-		if binding.Condition != nil {
-			return nil, errors.New("IAM conditions not allowed on BigQuery Dataset IAM")
-		}
 		if fullRole, ok := bigqueryIamMemberAccessPrimitiveToRoleMap[binding.Role]; ok {
 			return nil, fmt.Errorf("BigQuery Dataset legacy role %s is not allowed when using google_bigquery_dataset_iam resources. Please use the full form: %s", binding.Role, fullRole)
 		}
@@ -256,6 +270,9 @@ func policyToAccessForIamMember(policy *cloudresourcemanager.Policy) ([]map[stri
 			access := map[string]interface{}{
 				"role": binding.Role,
 			}
+			if binding.Condition != nil {
+				access["condition"] = binding.Condition
+			}
 			memberType, member, err := iamMemberToAccessForIamMember(member)
 			if err != nil {
 				return nil, err
@@ -324,11 +341,14 @@ func accessToIamMemberForIamMember(access map[string]interface{}) (string, error
 		return "", fmt.Errorf("Failed to convert BigQuery Dataset access to IAM member. To use views with a dataset, please use dataset_access")
 	}
 	if member, ok := access["userByEmail"]; ok {
-		// service accounts have "gservice" in their email. This is best guess due to lost information
-		if strings.Contains(member.(string), "gserviceaccount") {
-			return fmt.Sprintf("serviceAccount:%s", member.(string)), nil
+		ms := member.(string)
+		if strings.HasPrefix(ms, "deleted:") || strings.Contains(ms, "?uid=") {
+			return ms, nil
+		}
+		if strings.Contains(ms, "gserviceaccount") {
+			return fmt.Sprintf("serviceAccount:%s", ms), nil
 		}
-		return fmt.Sprintf("user:%s", member.(string)), nil
+		return fmt.Sprintf("user:%s", ms), nil
 	}
 	return "", fmt.Errorf("Failed to identify IAM member from BigQuery Dataset access: %v", access)
 }