| // Copyright (c) HashiCorp, Inc. |
| // SPDX-License-Identifier: MPL-2.0 |
| package accessapproval_test |
| |
| import ( |
| "log" |
| "strings" |
| "testing" |
| |
| "github.com/hashicorp/terraform-provider-google-beta/google-beta/acctest" |
| "github.com/hashicorp/terraform-provider-google-beta/google-beta/envvar" |
| |
| "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" |
| "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" |
| ) |
| |
| // Since access approval settings are hierarchical, and only one can exist per folder/project/org, |
| // and all refer to the same organization, they need to be run serially |
| // See AccessApprovalOrganizationSettings for the test runner. |
| func testAccAccessApprovalFolderSettings(t *testing.T) { |
| context := map[string]interface{}{ |
| "project": envvar.GetTestProjectFromEnv(), |
| "org_id": envvar.GetTestOrgFromEnv(t), |
| "location": envvar.GetTestRegionFromEnv(), |
| "random_suffix": acctest.RandString(t, 10), |
| } |
| |
| acctest.VcrTest(t, resource.TestCase{ |
| PreCheck: func() { acctest.AccTestPreCheck(t) }, |
| ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t), |
| ExternalProviders: map[string]resource.ExternalProvider{ |
| "time": {}, |
| }, |
| CheckDestroy: testAccCheckAccessApprovalFolderSettingsDestroyProducer(t), |
| Steps: []resource.TestStep{ |
| { |
| Config: testAccAccessApprovalFolderSettings_full(context), |
| }, |
| { |
| ResourceName: "google_folder_access_approval_settings.folder_access_approval", |
| ImportState: true, |
| ImportStateVerify: true, |
| ImportStateVerifyIgnore: []string{"folder_id"}, |
| }, |
| { |
| Config: testAccAccessApprovalFolderSettings_update(context), |
| }, |
| { |
| ResourceName: "google_folder_access_approval_settings.folder_access_approval", |
| ImportState: true, |
| ImportStateVerify: true, |
| ImportStateVerifyIgnore: []string{"folder_id"}, |
| }, |
| { |
| Config: testAccAccessApprovalFolderSettings_activeKeyVersion(context), |
| }, |
| { |
| ResourceName: "google_folder_access_approval_settings.folder_access_approval", |
| ImportState: true, |
| ImportStateVerify: true, |
| ImportStateVerifyIgnore: []string{"folder_id"}, |
| }, |
| }, |
| }) |
| } |
| |
| func testAccAccessApprovalFolderSettings_full(context map[string]interface{}) string { |
| return acctest.Nprintf(` |
| resource "google_folder" "my_folder" { |
| display_name = "tf-test-my-folder%{random_suffix}" |
| parent = "organizations/%{org_id}" |
| } |
| |
| # Wait after folder creation to limit eventual consistency errors. |
| resource "time_sleep" "wait_120_seconds" { |
| depends_on = [google_folder.my_folder] |
| |
| create_duration = "120s" |
| } |
| |
| resource "google_folder_access_approval_settings" "folder_access_approval" { |
| folder_id = google_folder.my_folder.folder_id |
| notification_emails = ["testuser@example.com"] |
| |
| enrolled_services { |
| cloud_product = "all" |
| } |
| |
| depends_on = [time_sleep.wait_120_seconds] |
| } |
| `, context) |
| } |
| |
| func testAccAccessApprovalFolderSettings_update(context map[string]interface{}) string { |
| return acctest.Nprintf(` |
| resource "google_folder" "my_folder" { |
| display_name = "tf-test-my-folder%{random_suffix}" |
| parent = "organizations/%{org_id}" |
| } |
| |
| # Wait after folder creation to limit eventual consistency errors. |
| resource "time_sleep" "wait_120_seconds" { |
| depends_on = [google_folder.my_folder] |
| |
| create_duration = "120s" |
| } |
| |
| resource "google_folder_access_approval_settings" "folder_access_approval" { |
| folder_id = google_folder.my_folder.folder_id |
| notification_emails = ["testuser@example.com", "example.user@example.com"] |
| |
| enrolled_services { |
| cloud_product = "all" |
| } |
| |
| depends_on = [time_sleep.wait_120_seconds] |
| } |
| `, context) |
| } |
| |
| func testAccAccessApprovalFolderSettings_activeKeyVersion(context map[string]interface{}) string { |
| return acctest.Nprintf(` |
| resource "google_folder" "my_folder" { |
| display_name = "tf-test-my-folder%{random_suffix}" |
| parent = "organizations/%{org_id}" |
| } |
| |
| # Wait after folder creation to limit eventual consistency errors. |
| resource "time_sleep" "wait_120_seconds" { |
| depends_on = [google_folder.my_folder] |
| |
| create_duration = "120s" |
| } |
| |
| resource "google_kms_key_ring" "key_ring" { |
| name = "tf-test-%{random_suffix}" |
| project = "%{project}" |
| location = "%{location}" |
| } |
| |
| resource "google_kms_crypto_key" "crypto_key" { |
| name = "tf-test-%{random_suffix}" |
| key_ring = google_kms_key_ring.key_ring.id |
| purpose = "ASYMMETRIC_SIGN" |
| |
| version_template { |
| algorithm = "EC_SIGN_P384_SHA384" |
| } |
| } |
| |
| data "google_access_approval_folder_service_account" "aa_account" { |
| folder_id = google_folder.my_folder.folder_id |
| |
| depends_on = [time_sleep.wait_120_seconds] |
| } |
| |
| resource "google_kms_crypto_key_iam_member" "iam" { |
| crypto_key_id = google_kms_crypto_key.crypto_key.id |
| role = "roles/cloudkms.signerVerifier" |
| member = "serviceAccount:${data.google_access_approval_folder_service_account.aa_account.account_email}" |
| } |
| |
| data "google_kms_crypto_key_version" "crypto_key_version" { |
| crypto_key = google_kms_crypto_key.crypto_key.id |
| } |
| |
| resource "google_folder_access_approval_settings" "folder_access_approval" { |
| folder_id = google_folder.my_folder.folder_id |
| |
| enrolled_services { |
| cloud_product = "all" |
| } |
| |
| active_key_version = data.google_kms_crypto_key_version.crypto_key_version.name |
| |
| depends_on = [google_kms_crypto_key_iam_member.iam] |
| } |
| `, context) |
| } |
| |
| func testAccCheckAccessApprovalFolderSettingsDestroyProducer(t *testing.T) func(s *terraform.State) error { |
| return func(s *terraform.State) error { |
| for name, rs := range s.RootModule().Resources { |
| if rs.Type != "google_folder_access_approval_settings" { |
| continue |
| } |
| if strings.HasPrefix(name, "data.") { |
| continue |
| } |
| |
| log.Printf("[DEBUG] Ignoring destroy during test") |
| } |
| |
| return nil |
| } |
| } |