Add condition and accessPolicyVersion to BQ dataset access

mmv1/products/bigquery/Dataset.yaml

@@ -26,7 +26,8 @@ docs:
     The API does accept both formats but it will always return the legacy format which results in Terraform
     showing permanent diff on each plan and apply operation.
 base_url: 'projects/{{project}}/datasets'
-self_link: 'projects/{{project}}/datasets/{{dataset_id}}'
+id_format: 'projects/{{project}}/datasets/{{dataset_id}}'
+self_link: 'projects/{{project}}/datasets/{{dataset_id}}?accessPolicyVersion=3'
 has_self_link: true
 delete_url: 'projects/{{project}}/datasets/{{dataset_id}}?deleteContents={{delete_contents_on_destroy}}'
 import_format:

mmv1/products/bigquery/DatasetAccess.yaml

@@ -33,7 +33,7 @@ docs:
     The API does accept both formats but it will always return the legacy format which results in Terraform
     showing permanent diff on each plan and apply operation.
 base_url: 'projects/{{project}}/datasets/{{dataset_id}}'
-self_link: 'projects/{{project}}/datasets/{{dataset_id}}'
+self_link: 'projects/{{project}}/datasets/{{dataset_id}}?accessPolicyVersion=3'
 create_verb: 'PATCH'
 delete_verb: 'PATCH'
 immutable: true
@@ -301,3 +301,29 @@ properties:
           A-Z), numbers (0-9), or underscores (_). The maximum length
           is 256 characters.
         required: true
+  - name: 'condition'
+    type: NestedObject
+    description: |
+      Condition for the binding. If CEL expression in this field is true, this
+      access binding will be considered.
+    properties:
+      - name: expression
+        type: String
+        required: true
+        description: |
+          Textual representation of an expression in Common Expression Language syntax.
+      - name: title
+        type: String
+        description: |
+          Title for the expression, i.e. a short string describing its purpose.
+          This can be used e.g. in UIs which allow to enter the expression.
+      - name: description
+        type: String
+        description: |
+          Description of the expression. This is a longer text which describes the expression,
+          e.g. when hovered over it in a UI.
+      - name: location
+        type: String
+        description: |
+          String indicating the location of the expression for error reporting, e.g. a file
+          name and a position in the file.

mmv1/third_party/terraform/services/bigquery/resource_bigquery_dataset_access_test.go

@@ -292,6 +292,40 @@ func TestAccBigQueryDatasetAccess_userByEmailWithMixedCase(t *testing.T) {
 	})
 }
 
+func TestAccBigQueryDatasetAccess_withCondition(t *testing.T) {
+	t.Parallel()
+
+	datasetID := fmt.Sprintf("tf_test_%s", acctest.RandString(t, 10))
+	saID := fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))
+
+	expected := map[string]interface{}{
+		"condition": map[string]interface{}{
+			"description": "Request after midnight of 2019-12-31",
+			"expression":  "request.time > timestamp(\"2020-01-01T00:00:00Z\")",
+			"location":    "any.file.anywhere",
+			"title":       "test-condition",
+		},
+		"role":        "OWNER",
+		"userByEmail": fmt.Sprintf("%s@%s.iam.gserviceaccount.com", saID, envvar.GetTestProjectFromEnv()),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBigQueryDatasetAccess_withCondition(datasetID, saID),
+				Check:  testAccCheckBigQueryDatasetAccessPresent(t, "google_bigquery_dataset.dataset", expected),
+			},
+			{
+				// Destroy step instead of CheckDestroy so we can check the access is removed without deleting the dataset
+				Config: testAccBigQueryDatasetAccess_destroy(datasetID, "dataset"),
+				Check:  testAccCheckBigQueryDatasetAccessAbsent(t, "google_bigquery_dataset.dataset", expected),
+			},
+		},
+	})
+}
+
 func TestAccBigQueryDatasetAccess_groupByEmailWithMixedCase(t *testing.T) {
 	t.Parallel()
 
@@ -575,3 +609,27 @@ resource "google_bigquery_dataset" "dataset" {
 }
 `, accessType, email, datasetID)
 }
+
+func testAccBigQueryDatasetAccess_withCondition(datasetID, saID string) string {
+	return fmt.Sprintf(`
+resource "google_bigquery_dataset_access" "withCondition" {
+  dataset_id    = google_bigquery_dataset.dataset.dataset_id
+  role          = "OWNER"
+  user_by_email = google_service_account.bqowner.email
+  condition {
+    title       = "test-condition"
+    description = "Request after midnight of 2019-12-31"
+    expression  = "request.time > timestamp(\"2020-01-01T00:00:00Z\")"
+    location    = "any.file.anywhere"
+  }
+}
+
+resource "google_bigquery_dataset" "dataset" {
+  dataset_id = "%s"
+}
+
+resource "google_service_account" "bqowner" {
+  account_id = "%s"
+}
+`, datasetID, saID)
+}