Add Authz Extension and Authz Policy resources

.changelog/12379.txt

@@ -0,0 +1,6 @@
+```release-note:new-resource
+networksecurity: Added new resource `google_network_security_authz_policy`
+```
+```release-note:new-resource
+networkservices: Added new resource `google_network_services_authz_extension`
+```

google-beta/provider/provider_mmv1_resources.go

@@ -509,9 +509,9 @@ var handwrittenIAMDatasources = map[string]*schema.Resource{
 }
 
 // Resources
-// Generated resources: 564
+// Generated resources: 566
 // Generated IAM resources: 294
-// Total generated resources: 858
+// Total generated resources: 860
 var generatedResources = map[string]*schema.Resource{
 	"google_folder_access_approval_settings":                                     accessapproval.ResourceAccessApprovalFolderSettings(),
 	"google_organization_access_approval_settings":                               accessapproval.ResourceAccessApprovalOrganizationSettings(),
@@ -1137,6 +1137,7 @@ var generatedResources = map[string]*schema.Resource{
 	"google_network_management_vpc_flow_logs_config":                             networkmanagement.ResourceNetworkManagementVpcFlowLogsConfig(),
 	"google_network_security_address_group":                                      networksecurity.ResourceNetworkSecurityAddressGroup(),
 	"google_network_security_authorization_policy":                               networksecurity.ResourceNetworkSecurityAuthorizationPolicy(),
+	"google_network_security_authz_policy":                                       networksecurity.ResourceNetworkSecurityAuthzPolicy(),
 	"google_network_security_client_tls_policy":                                  networksecurity.ResourceNetworkSecurityClientTlsPolicy(),
 	"google_network_security_firewall_endpoint":                                  networksecurity.ResourceNetworkSecurityFirewallEndpoint(),
 	"google_network_security_firewall_endpoint_association":                      networksecurity.ResourceNetworkSecurityFirewallEndpointAssociation(),
@@ -1154,6 +1155,7 @@ var generatedResources = map[string]*schema.Resource{
 	"google_network_security_server_tls_policy":                                  networksecurity.ResourceNetworkSecurityServerTlsPolicy(),
 	"google_network_security_tls_inspection_policy":                              networksecurity.ResourceNetworkSecurityTlsInspectionPolicy(),
 	"google_network_security_url_lists":                                          networksecurity.ResourceNetworkSecurityUrlLists(),
+	"google_network_services_authz_extension":                                    networkservices.ResourceNetworkServicesAuthzExtension(),
 	"google_network_services_edge_cache_keyset":                                  networkservices.ResourceNetworkServicesEdgeCacheKeyset(),
 	"google_network_services_edge_cache_origin":                                  networkservices.ResourceNetworkServicesEdgeCacheOrigin(),
 	"google_network_services_edge_cache_service":                                 networkservices.ResourceNetworkServicesEdgeCacheService(),

google-beta/services/networksecurity/resource_network_security_authz_policy_generated_meta.yaml

@@ -0,0 +1,5 @@
+resource: 'google_network_security_authz_policy'
+generation_type: 'mmv1'
+api_service_name: 'networksecurity.googleapis.com'
+api_version: 'v1beta1'
+api_resource_type_kind: 'AuthzPolicy'

google-beta/services/networksecurity/resource_network_security_authz_policy_generated_test.go

@@ -0,0 +1,225 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// ----------------------------------------------------------------------------
+//
+//     ***     AUTO GENERATED CODE    ***    Type: MMv1     ***
+//
+// ----------------------------------------------------------------------------
+//
+//     This file is automatically generated by Magic Modules and manual
+//     changes will be clobbered when the file is regenerated.
+//
+//     Please read more about how to change this file in
+//     .github/CONTRIBUTING.md.
+//
+// ----------------------------------------------------------------------------
+
+package networksecurity_test
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+
+	"github.com/hashicorp/terraform-provider-google-beta/google-beta/acctest"
+	"github.com/hashicorp/terraform-provider-google-beta/google-beta/envvar"
+	"github.com/hashicorp/terraform-provider-google-beta/google-beta/tpgresource"
+	transport_tpg "github.com/hashicorp/terraform-provider-google-beta/google-beta/transport"
+)
+
+func TestAccNetworkSecurityAuthzPolicy_networkServicesAuthzPolicyAdvancedExample(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"project":       envvar.GetTestProjectFromEnv(),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckNetworkSecurityAuthzPolicyDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccNetworkSecurityAuthzPolicy_networkServicesAuthzPolicyAdvancedExample(context),
+			},
+			{
+				ResourceName:            "google_network_security_authz_policy.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "location", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccNetworkSecurityAuthzPolicy_networkServicesAuthzPolicyAdvancedExample(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_compute_network" "default" {
+  name                    = "tf-test-lb-network%{random_suffix}"
+  project                 = "%{project}"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "default" {
+  name          = "tf-test-backend-subnet%{random_suffix}"
+  project       = "%{project}"
+  region        = "us-west1"
+  ip_cidr_range = "10.1.2.0/24"
+  network       = google_compute_network.default.id
+}
+
+resource "google_compute_subnetwork" "proxy_only" {
+  name          = "tf-test-proxy-only-subnet%{random_suffix}"
+  project       = "%{project}"
+  region        = "us-west1"
+  ip_cidr_range = "10.129.0.0/23"
+  purpose       = "REGIONAL_MANAGED_PROXY"
+  role          = "ACTIVE"
+  network       = google_compute_network.default.id
+}
+
+resource "google_compute_address" "default" {
+  name         = "tf-test-l7-ilb-ip-address%{random_suffix}"
+  project      = "%{project}"
+  region       = "us-west1"
+  subnetwork   = google_compute_subnetwork.default.id
+  address_type = "INTERNAL"
+  purpose      = "GCE_ENDPOINT"
+}
+
+resource "google_compute_region_health_check" "default" {
+  name    = "tf-test-l7-ilb-basic-check%{random_suffix}"
+  project = "%{project}"
+  region  = "us-west1"
+
+  http_health_check {
+    port_specification = "USE_SERVING_PORT"
+  }
+}
+
+resource "google_compute_region_backend_service" "url_map" {
+  name                  = "tf-test-l7-ilb-backend-service%{random_suffix}"
+  project               = "%{project}"
+  region                = "us-west1"
+  load_balancing_scheme = "INTERNAL_MANAGED"
+
+  health_checks = [google_compute_region_health_check.default.id]
+}
+
+resource "google_compute_region_url_map" "default" {
+  name            = "tf-test-l7-ilb-map%{random_suffix}"
+  project         = "%{project}"
+  region          = "us-west1"
+  default_service = google_compute_region_backend_service.url_map.id
+}
+
+resource "google_compute_region_target_http_proxy" "default" {
+  name    = "tf-test-l7-ilb-proxy%{random_suffix}"
+  project = "%{project}"
+  region  = "us-west1"
+  url_map = google_compute_region_url_map.default.id
+}
+
+resource "google_compute_forwarding_rule" "default" {
+  name                  = "tf-test-l7-ilb-forwarding-rule%{random_suffix}"
+  project               = "%{project}"
+  region                = "us-west1"
+  load_balancing_scheme = "INTERNAL_MANAGED"
+  network               = google_compute_network.default.id
+  subnetwork            = google_compute_subnetwork.default.id
+  ip_protocol           = "TCP"
+  port_range            = "80"
+  target                = google_compute_region_target_http_proxy.default.id
+  ip_address            = google_compute_address.default.id
+
+  depends_on = [google_compute_subnetwork.proxy_only]
+}
+
+resource "google_compute_region_backend_service" "authz_extension" {
+  name    = "tf-test-authz-service%{random_suffix}"
+  project = "%{project}"
+  region  = "us-west1"
+
+  protocol              = "HTTP2"
+  load_balancing_scheme = "INTERNAL_MANAGED"
+  port_name             = "grpc"
+}
+
+resource "google_network_services_authz_extension" "default" {
+  name     = "tf-test-my-authz-ext%{random_suffix}"
+  project  = "%{project}"
+  location = "us-west1"
+
+  description           = "my description"
+  load_balancing_scheme = "INTERNAL_MANAGED"
+  authority             = "ext11.com"
+  service               = google_compute_region_backend_service.authz_extension.self_link
+  timeout               = "0.1s"
+  fail_open             = false
+  forward_headers       = ["Authorization"]
+}
+
+resource "google_network_security_authz_policy" "default" {
+  name        = "tf-test-my-authz-policy%{random_suffix}"
+  project     = "%{project}"
+  location    = "us-west1"
+  description = "my description"
+
+  target {
+    load_balancing_scheme = "INTERNAL_MANAGED"
+    resources = [ google_compute_forwarding_rule.default.self_link ]
+  }
+
+  action = "CUSTOM"
+  custom_provider {
+    authz_extension {
+      resources = [ google_network_services_authz_extension.default.id ]
+    }
+  }
+}
+`, context)
+}
+
+func testAccCheckNetworkSecurityAuthzPolicyDestroyProducer(t *testing.T) func(s *terraform.State) error {
+	return func(s *terraform.State) error {
+		for name, rs := range s.RootModule().Resources {
+			if rs.Type != "google_network_security_authz_policy" {
+				continue
+			}
+			if strings.HasPrefix(name, "data.") {
+				continue
+			}
+
+			config := acctest.GoogleProviderConfig(t)
+
+			url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{NetworkSecurityBasePath}}projects/{{project}}/locations/{{location}}/authzPolicies/{{name}}")
+			if err != nil {
+				return err
+			}
+
+			billingProject := ""
+
+			if config.BillingProject != "" {
+				billingProject = config.BillingProject
+			}
+
+			_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+				Config:    config,
+				Method:    "GET",
+				Project:   billingProject,
+				RawURL:    url,
+				UserAgent: config.UserAgent,
+			})
+			if err == nil {
+				return fmt.Errorf("NetworkSecurityAuthzPolicy still exists at %s", url)
+			}
+		}
+
+		return nil
+	}
+}