Skip to content

Commit

Permalink
Removed usage of bootstrap PSA role helpers (#12822) (#20983)
Browse files Browse the repository at this point in the history 
[upstream:4e0eecd8ddcc944430e873c449c8b8724d238120]

Signed-off-by: Modular Magician <[email protected]>
  • Loading branch information
@modular-magician
modular-magician authored Jan 21, 2025
1 parent f17d0e2 commit 64a7dfb
Show file tree
Hide file tree
Showing 13 changed files with 133 additions and 59 deletions.
3 changes: 3 additions & 0 deletions .changelog/12822.txt
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:none

```
28 changes: 24 additions & 4 deletions google/services/cloudfunctions2/resource_cloudfunctions2_function_generated_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -205,10 +205,15 @@ resource "google_cloudfunctions2_function" "function" {

func TestAccCloudfunctions2function_cloudfunctions2BasicGcsExample(t *testing.T) {
t.Parallel()
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

context := map[string]interface{}{
"project": envvar.GetTestProjectFromEnv(),
"policyChanged": acctest.BootstrapPSARole(t, "service-", "gcp-sa-pubsub", "roles/cloudkms.cryptoKeyEncrypterDecrypter"),
"primary_resource_id": "terraform-test",
"zip_path": "./test-fixtures/function-source-eventarc-gcs.zip",
"random_suffix": acctest.RandString(t, 10),
Expand Down Expand Up @@ -341,10 +346,15 @@ resource "google_cloudfunctions2_function" "function" {

func TestAccCloudfunctions2function_cloudfunctions2BasicAuditlogsExample(t *testing.T) {
t.Parallel()
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

context := map[string]interface{}{
"project": envvar.GetTestProjectFromEnv(),
"policyChanged": acctest.BootstrapPSARole(t, "service-", "gcp-sa-pubsub", "roles/cloudkms.cryptoKeyEncrypterDecrypter"),
"primary_resource_id": "terraform-test",
"zip_path": "./test-fixtures/function-source-eventarc-gcs.zip",
"random_suffix": acctest.RandString(t, 10),
Expand Down Expand Up @@ -595,11 +605,16 @@ resource "google_cloudfunctions2_function" "function" {

func TestAccCloudfunctions2function_cloudfunctions2SecretEnvExample(t *testing.T) {
t.Parallel()
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

context := map[string]interface{}{
"project": envvar.GetTestProjectFromEnv(),
"location": "us-central1",
"policyChanged": acctest.BootstrapPSARole(t, "service-", "gcp-sa-pubsub", "roles/cloudkms.cryptoKeyEncrypterDecrypter"),
"zip_path": "./test-fixtures/function-source.zip",
"random_suffix": acctest.RandString(t, 10),
}
Expand Down Expand Up @@ -694,11 +709,16 @@ resource "google_secret_manager_secret_version" "secret" {

func TestAccCloudfunctions2function_cloudfunctions2SecretVolumeExample(t *testing.T) {
t.Parallel()
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

context := map[string]interface{}{
"project": envvar.GetTestProjectFromEnv(),
"location": "us-central1",
"policyChanged": acctest.BootstrapPSARole(t, "service-", "gcp-sa-pubsub", "roles/cloudkms.cryptoKeyEncrypterDecrypter"),
"zip_path": "./test-fixtures/function-source.zip",
"random_suffix": acctest.RandString(t, 10),
}
Expand Down
9 changes: 6 additions & 3 deletions google/services/cloudfunctions2/resource_cloudfunctions2_function_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -192,9 +192,12 @@ func TestAccCloudFunctions2Function_fullUpdate(t *testing.T) {
"random_suffix": acctest.RandString(t, 10),
}

if acctest.BootstrapPSARole(t, "service-", "gcp-sa-pubsub", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
t.Fatal("Stopping the test because a binding was added.")
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand Down
9 changes: 6 additions & 3 deletions google/services/compute/resource_compute_disk_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -586,9 +586,12 @@ func TestAccComputeDisk_encryptionKMS(t *testing.T) {
importID := fmt.Sprintf("%s/%s/%s", pid, "us-central1-a", diskName)
var disk compute.Disk

if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
t.Fatal("Stopping the test because a role was added to the policy.")
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@compute-system.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand Down
9 changes: 6 additions & 3 deletions google/services/compute/resource_compute_instance_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -735,9 +735,12 @@ func TestAccComputeInstance_kmsDiskEncryption(t *testing.T) {
},
}

if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
t.Fatal("Stopping the test because a role was added to the policy.")
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@compute-system.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand Down
58 changes: 38 additions & 20 deletions google/services/container/resource_container_cluster_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2228,9 +2228,12 @@ func TestAccContainerCluster_withBootDiskKmsKey(t *testing.T) {
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)

if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
t.Fatal("Stopping the test because a role was added to the policy.")
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@compute-system.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand Down Expand Up @@ -4112,9 +4115,12 @@ func TestAccContainerCluster_nodeAutoprovisioningDefaultsBootDiskKmsKey(t *testi
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)

if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
t.Fatal("Stopping the test because a role was added to the policy.")
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@compute-system.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand Down Expand Up @@ -5114,14 +5120,20 @@ func TestAccContainerCluster_WithCPAFeatures(t *testing.T) {
// *ALL* Cloud KMS keys in the project. A more realistic usage would be to
// grant the service agent the necessary roles only on the individual keys
// we have created.
roles := []string{
"roles/container.cloudKmsKeyUser",
"roles/privateca.certificateManager",
"roles/cloudkms.cryptoKeyEncrypterDecrypter",
}
if acctest.BootstrapPSARoles(t, "service-", "container-engine-robot", roles) {
t.Fatal("Stopping the test because a role was added to the policy.")
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@container-engine-robot.iam.gserviceaccount.com",
Role: "roles/container.cloudKmsKeyUser",
},
{
Member: "serviceAccount:service-{project_number}@container-engine-robot.iam.gserviceaccount.com",
Role: "roles/privateca.certificateManager",
},
{
Member: "serviceAccount:service-{project_number}@container-engine-robot.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

// Find an active cryptoKeyVersion on the signing key.
var signingCryptoKeyVersion *cloudkms.CryptoKeyVersion
Expand Down Expand Up @@ -10527,9 +10539,12 @@ func TestAccContainerCluster_withConfidentialBootDisk(t *testing.T) {
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)

if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
t.Fatal("Stopping the test because a role was added to the policy.")
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@compute-system.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand Down Expand Up @@ -10590,9 +10605,12 @@ func TestAccContainerCluster_withConfidentialBootDiskNodeConfig(t *testing.T) {
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)

if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
t.Fatal("Stopping the test because a role was added to the policy.")
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@compute-system.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand Down
9 changes: 6 additions & 3 deletions google/services/container/resource_container_node_pool_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4085,9 +4085,12 @@ func TestAccContainerNodePool_withConfidentialBootDisk(t *testing.T) {
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)

if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
t.Fatal("Stopping the test because a role was added to the policy.")
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@compute-system.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand Down
17 changes: 10 additions & 7 deletions google/services/dataflow/resource_dataflow_job_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -420,13 +420,16 @@ func TestAccDataflowJob_withKmsKey(t *testing.T) {
job := "tf-test-dataflow-job-" + randStr
zone := "us-east5-b"

if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
t.Fatal("Stopping the test because a role was added to the policy.")
}

if acctest.BootstrapPSARole(t, "service-", "dataflow-service-producer-prod", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
t.Fatal("Stopping the test because a role was added to the policy.")
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@compute-system.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
{
Member: "serviceAccount:service-{project_number}@dataflow-service-producer-prod.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand Down
9 changes: 6 additions & 3 deletions google/services/dataproc/resource_dataproc_cluster_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1054,9 +1054,12 @@ func TestAccDataprocCluster_KMS(t *testing.T) {
subnetworkName := acctest.BootstrapSubnet(t, "dataproc-cluster", networkName)
acctest.BootstrapFirewallForDataprocSharedNetwork(t, "dataproc-cluster", networkName)

if acctest.BootstrapPSARole(t, "service-", "compute-system", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
t.Fatal("Stopping the test because a role was added to the policy.")
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@compute-system.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

var cluster dataproc.Cluster
acctest.VcrTest(t, resource.TestCase{
Expand Down
13 changes: 10 additions & 3 deletions google/services/pubsub/resource_pubsub_subscription_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -243,9 +243,16 @@ func TestAccPubsubSubscriptionBigQuery_serviceAccount(t *testing.T) {
topic := fmt.Sprintf("tf-test-topic-%s", acctest.RandString(t, 10))
subscriptionShort := fmt.Sprintf("tf-test-sub-%s", acctest.RandString(t, 10))

if acctest.BootstrapPSARoles(t, "service-", "gcp-sa-pubsub", []string{"roles/bigquery.dataEditor", "roles/bigquery.metadataViewer"}) {
t.Fatal("Stopping the test because roles were added to IAM policy.")
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com",
Role: "roles/bigquery.dataEditor",
},
{
Member: "serviceAccount:service-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com",
Role: "roles/bigquery.metadataViewer",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand Down
9 changes: 6 additions & 3 deletions google/services/pubsub/resource_pubsub_topic_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -50,9 +50,12 @@ func TestAccPubsubTopic_cmek(t *testing.T) {
kms := acctest.BootstrapKMSKey(t)
topicName := fmt.Sprintf("tf-test-%s", acctest.RandString(t, 10))

if acctest.BootstrapPSARole(t, "service-", "gcp-sa-pubsub", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
t.Fatal("Stopping the test because a role was added to the policy.")
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand Down
10 changes: 6 additions & 4 deletions google/services/spanner/resource_spanner_database_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -522,10 +522,12 @@ resource "google_spanner_database" "database" {
func TestAccSpannerDatabase_cmek(t *testing.T) {
t.Parallel()

// Handle bootstrapping out of band so we don't need beta provider, and for consistency with mrcmek test
if acctest.BootstrapPSARole(t, "service-", "gcp-sa-spanner", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
t.Fatal("Stopping the test because a role was added to the policy.")
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcp-sa-spanner.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

// Make the keys outside of Terraform so that a) the project isn't littered with a key from each run and b) so that VCR
// can work.
Expand Down
9 changes: 6 additions & 3 deletions google/services/workflows/resource_workflows_workflow_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -289,9 +289,12 @@ func TestAccWorkflowsWorkflow_CMEK(t *testing.T) {

workflowName := fmt.Sprintf("tf-test-acc-workflow-%d", acctest.RandInt(t))
kms := acctest.BootstrapKMSKeyInLocation(t, "us-central1")
if acctest.BootstrapPSARole(t, "service-", "gcp-sa-workflows", "roles/cloudkms.cryptoKeyEncrypterDecrypter") {
t.Fatal("Stopping the test because a role was added to the policy.")
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcp-sa-workflows.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand Down

0 comments on commit 64a7dfb

Please sign in to comment.