Add Ingress and Egress functionality to VPC Service Controls

[ngodec]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

There is a new feature in VPC Service Controls that allows configuring extra rules for the service perimeters: https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules. This solves a number of immediate needs for everyone who has a more complex setup, and would be great to have it in terraform!

New or Affected Resource(s)

• google_access_context_manager_service_perimeter
• google_access_context_manager_access_level

Or new resources:

• google_access_context_manager_ingress_rule
• google_access_context_manager_egress_rule

Potential Terraform Configuration

resource "google_access_context_manager_egress_rule" "allow-aggregated-logging" {
  parent        = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}"
  perimeter   = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}/perimeters/sensitive1"
  egressto = {
      serviceName = "logging.googleapis.com"
      methodsSelectors = [
        "LoggingServiceV2.WriteLogEntries",
        "LoggingService.WriteLogEntries",
      ]
      resources =  [ "projects/999" ]
  }
  egressFrom = {
    identityType = "ANY_IDENTITY"
  }
}

References

[apereira]

See GoogleCloudPlatform/magic-modules#4509

[ngodec]

Found that this is a duplicate of #8412

[ngodec]

Thanks for that @apereira ! I guess now to wait for #8723 to be released :)

[rileykarson]

Closing as dupe of #8412

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!