Object lock feature implementation for Storage

mmv1/third_party/terraform/services/storage/resource_storage_bucket.go.erb

@@ -256,6 +256,13 @@ func ResourceStorageBucket() *schema.Resource {
 				Description: `The bucket's Lifecycle Rules configuration.`,
 			},
 
+			"per_object_retention": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `Enables each object in the bucket to have its own retention policy, which prevents deletion until stored for a specific length of time.`,
+			},
+
 			"versioning": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -594,7 +601,11 @@ func resourceStorageBucketCreate(d *schema.ResourceData, meta interface{}) error
 
 	err = transport_tpg.Retry(transport_tpg.RetryOptions{
 		RetryFunc: func() error {
-			res, err = config.NewStorageClient(userAgent).Buckets.Insert(project, sb).Do()
+			insertCall := config.NewStorageClient(userAgent).Buckets.Insert(project, sb)
+			if d.Get("per_object_retention").(bool) {
+				insertCall.EnableObjectRetention(true)
+			}
+			res, err = insertCall.Do()
 			return err
 		},
 	})
@@ -1121,6 +1132,16 @@ func flattenBucketRetentionPolicy(bucketRetentionPolicy *storage.BucketRetention
 	return bucketRetentionPolicies
 }
 
+func flattenBucketObjectRetention(bucketObjectRetention *storage.BucketObjectRetention) bool {
+	if bucketObjectRetention == nil {
+		return false
+	}
+	if bucketObjectRetention.Mode == "Enabled" {
+		return true
+	}
+	return false
+}
+
 func expandBucketVersioning(configured interface{}) *storage.BucketVersioning {
 	versionings := configured.([]interface{})
 	if len(versionings) == 0 {
@@ -1620,6 +1641,9 @@ func setStorageBucket(d *schema.ResourceData, config *transport_tpg.Config, res
 	if err := d.Set("logging", flattenBucketLogging(res.Logging)); err != nil {
 		return fmt.Errorf("Error setting logging: %s", err)
 	}
+	if err := d.Set("per_object_retention", flattenBucketObjectRetention(res.ObjectRetention)); err != nil {
+		return fmt.Errorf("Error setting object retention: %s", err)
+	}
 	if err := d.Set("versioning", flattenBucketVersioning(res.Versioning)); err != nil {
 		return fmt.Errorf("Error setting versioning: %s", err)
 	}

mmv1/third_party/terraform/services/storage/resource_storage_bucket_object.go

@@ -6,12 +6,14 @@ import (
 	"io"
 	"log"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 
 	"crypto/sha256"
 	"encoding/base64"
@@ -207,6 +209,29 @@ func ResourceStorageBucketObject() *schema.Resource {
 				},
 			},
 
+			"retention": {
+				Type:          schema.TypeList,
+				MaxItems:      1,
+				Optional:      true,
+				ConflictsWith: []string{"event_based_hold"},
+				Description:   `Object level retention configuration.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"retain_until": {
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: `Time in RFC 3339 (e.g. 2030-01-01T02:03:04Z) until which object retention protects this object.`,
+						},
+						"mode": {
+							Type:         schema.TypeString,
+							Required:     true,
+							Description:  `The object retention mode. Supported values include: "UNLOCKED", "LOCKED".`,
+							ValidateFunc: validation.StringInSlice([]string{"UNLOCKED", "LOCKED"}, false),
+						},
+					},
+				},
+			},
+
 			"event_based_hold": {
 				Type:        schema.TypeBool,
 				Optional:    true,
@@ -312,6 +337,10 @@ func resourceStorageBucketObjectCreate(d *schema.ResourceData, meta interface{})
 		object.KmsKeyName = v.(string)
 	}
 
+	if v, ok := d.GetOk("retention"); ok {
+		object.Retention = expandObjectRetention(v)
+	}
+
 	if v, ok := d.GetOk("event_based_hold"); ok {
 		object.EventBasedHold = v.(bool)
 	}
@@ -357,6 +386,16 @@ func resourceStorageBucketObjectUpdate(d *schema.ResourceData, meta interface{})
 		return fmt.Errorf("Error retrieving object during update %s: %s", name, err)
 	}
 
+	hasRetentionChanges := d.HasChange("retention")
+	if hasRetentionChanges {
+		if v, ok := d.GetOk("retention"); ok {
+			res.Retention = expandObjectRetention(v)
+		} else {
+			res.Retention = nil
+			res.NullFields = append(res.NullFields, "Retention")
+		}
+	}
+
 	if d.HasChange("event_based_hold") {
 		v := d.Get("event_based_hold")
 		res.EventBasedHold = v.(bool)
@@ -368,6 +407,9 @@ func resourceStorageBucketObjectUpdate(d *schema.ResourceData, meta interface{})
 	}
 
 	updateCall := objectsService.Update(bucket, name, res)
+	if hasRetentionChanges {
+		updateCall.OverrideUnlockedRetention(true)
+	}
 	_, err = updateCall.Do()
 
 	if err != nil {
@@ -443,6 +485,9 @@ func resourceStorageBucketObjectRead(d *schema.ResourceData, meta interface{}) e
 	if err := d.Set("media_link", res.MediaLink); err != nil {
 		return fmt.Errorf("Error setting media_link: %s", err)
 	}
+	if err := d.Set("retention", flattenObjectRetention(res.Retention)); err != nil {
+		return fmt.Errorf("Error setting lifecycle_rule: %s", err)
+	}
 	if err := d.Set("event_based_hold", res.EventBasedHold); err != nil {
 		return fmt.Errorf("Error setting event_based_hold: %s", err)
 	}
@@ -513,3 +558,39 @@ func expandCustomerEncryption(input []interface{}) map[string]string {
 	}
 	return expanded
 }
+
+func expandObjectRetention(configured interface{}) *storage.ObjectRetention {
+	retentions := configured.([]interface{})
+	if len(retentions) == 0 {
+		return nil
+	}
+	retention := retentions[0].(map[string]interface{})
+
+	mode := "Unlocked"
+	if retention["mode"].(string) == "LOCKED" {
+		mode = "Locked"
+	}
+
+	objectRetention := &storage.ObjectRetention{
+		RetainUntilTime: retention["retain_until"].(string),
+		Mode:            mode,
+	}
+
+	return objectRetention
+}
+
+func flattenObjectRetention(objectRetention *storage.ObjectRetention) []map[string]interface{} {
+	retentions := make([]map[string]interface{}, 0, 1)
+
+	if objectRetention == nil {
+		return retentions
+	}
+
+	retention := map[string]interface{}{
+		"mode":         strings.ToUpper(objectRetention.Mode),
+		"retain_until": objectRetention.RetainUntilTime,
+	}
+
+	retentions = append(retentions, retention)
+	return retentions
+}

mmv1/third_party/terraform/services/storage/resource_storage_bucket_object_test.go

@@ -415,6 +415,48 @@ func TestAccStorageObject_holds(t *testing.T) {
 	})
 }
 
+func TestAccStorageObject_retention(t *testing.T) {
+	t.Parallel()
+
+	bucketName := acctest.TestBucketName(t)
+	data := []byte(content)
+	h := md5.New()
+	if _, err := h.Write(data); err != nil {
+		t.Errorf("error calculating md5: %v", err)
+	}
+	dataMd5 := base64.StdEncoding.EncodeToString(h.Sum(nil))
+	testFile := getNewTmpTestFile(t, "tf-test")
+	if err := ioutil.WriteFile(testFile.Name(), data, 0644); err != nil {
+		t.Errorf("error writing file: %v", err)
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccStorageObjectDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testGoogleStorageBucketsObjectRetention(bucketName, "2040-01-01T02:03:04.000Z"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGoogleStorageObject(t, bucketName, objectName, dataMd5),
+				),
+			},
+			{
+				Config: testGoogleStorageBucketsObjectRetention(bucketName, "2040-01-02T02:03:04.000Z"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGoogleStorageObject(t, bucketName, objectName, dataMd5),
+				),
+			},
+			{
+				Config: testGoogleStorageBucketsObjectRetentionDisabled(bucketName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGoogleStorageObject(t, bucketName, objectName, dataMd5),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckGoogleStorageObject(t *testing.T, bucket, object, md5 string) resource.TestCheckFunc {
 	return testAccCheckGoogleStorageObjectWithEncryption(t, bucket, object, md5, "")
 }
@@ -646,6 +688,44 @@ resource "google_storage_bucket_object" "object" {
 `, bucketName, objectName, content, customerEncryptionKey)
 }
 
+func testGoogleStorageBucketsObjectRetention(bucketName string, retainUntil string) string {
+	return fmt.Sprintf(`
+resource "google_storage_bucket" "bucket" {
+  name                 = "%s"
+  location             = "US"
+  force_destroy        = true
+  per_object_retention = true
+}
+
+resource "google_storage_bucket_object" "object" {
+  name      = "%s"
+  bucket    = google_storage_bucket.bucket.name
+  content   = "%s"
+  retention {
+	mode         = "UNLOCKED"
+	retain_until = "%s"
+  }      
+}
+`, bucketName, objectName, content, retainUntil)
+}
+
+func testGoogleStorageBucketsObjectRetentionDisabled(bucketName string) string {
+	return fmt.Sprintf(`
+resource "google_storage_bucket" "bucket" {
+  name                 = "%s"
+  location             = "US"
+  force_destroy        = true
+  per_object_retention = true
+}
+
+resource "google_storage_bucket_object" "object" {
+  name      = "%s"
+  bucket    = google_storage_bucket.bucket.name
+  content   = "%s" 
+}
+`, bucketName, objectName, content)
+}
+
 func testGoogleStorageBucketsObjectHolds(bucketName string, eventBasedHold bool, temporaryHold bool) string {
 	return fmt.Sprintf(`
 resource "google_storage_bucket" "bucket" {