Add deletion_protection field to CloudAD domain resource

.changelog/11256.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+activeDirectory: added `deletion_protection` field to `google_active_directory_domain` to make deleting them require an explicit intent. `google_active_directory_domain` resources now cannot be destroyed unless `deletion_protection = false` is set for the resource.
+```

google/services/activedirectory/resource_active_directory_domain.go

@@ -131,6 +131,17 @@ Similar to what would be chosen for an Active Directory set up on an internal ne
  and default labels configured on the provider.`,
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
+			"deletion_protection": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  true,
+				Description: `Whether Terraform will be prevented from destroying the domain. Defaults to true.
+When a'terraform destroy' or 'terraform apply' would delete the domain,
+the command will fail if this field is not set to false in Terraform state.
+When the field is set to true or unset in Terraform state, a 'terraform apply'
+or 'terraform destroy' that would delete the domain will fail.
+When the field is set to false, deleting the domain is allowed.`,
+			},
 			"project": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -291,6 +302,12 @@ func resourceActiveDirectoryDomainRead(d *schema.ResourceData, meta interface{})
 		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("ActiveDirectoryDomain %q", d.Id()))
 	}
 
+	// Explicitly set virtual fields to default values if unset
+	if _, ok := d.GetOkExists("deletion_protection"); !ok {
+		if err := d.Set("deletion_protection", true); err != nil {
+			return fmt.Errorf("Error setting deletion_protection: %s", err)
+		}
+	}
 	if err := d.Set("project", project); err != nil {
 		return fmt.Errorf("Error reading Domain: %s", err)
 	}
@@ -453,6 +470,9 @@ func resourceActiveDirectoryDomainDelete(d *schema.ResourceData, meta interface{
 	}
 
 	headers := make(http.Header)
+	if d.Get("deletion_protection").(bool) {
+		return fmt.Errorf("cannot destroy domain without setting deletion_protection=false and running `terraform apply`")
+	}
 
 	log.Printf("[DEBUG] Deleting Domain %q", d.Id())
 	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{

google/services/activedirectory/resource_active_directory_domain_trust_test.go

@@ -40,7 +40,7 @@ func TestAccActiveDirectoryDomainTrust_activeDirectoryDomainTrustBasicExample(t
 				ResourceName:            "google_active_directory_domain_trust.ad-domain-trust",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"trust_handshake_secret", "domain"},
+				ImportStateVerifyIgnore: []string{"trust_handshake_secret", "domain", "deletion_protection"},
 			},
 			{
 				Config: testAccActiveDirectoryDomainTrust_activeDirectoryDomainTrustUpdate(context),
@@ -49,7 +49,7 @@ func TestAccActiveDirectoryDomainTrust_activeDirectoryDomainTrustBasicExample(t
 				ResourceName:            "google_active_directory_domain_trust.ad-domain-trust",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"trust_handshake_secret", "domain"},
+				ImportStateVerifyIgnore: []string{"trust_handshake_secret", "domain", "deletion_protection"},
 			},
 		},
 	})
@@ -58,12 +58,13 @@ func TestAccActiveDirectoryDomainTrust_activeDirectoryDomainTrustBasicExample(t
 func testAccActiveDirectoryDomainTrust_activeDirectoryDomainTrustBasicExample(context map[string]interface{}) string {
 	return acctest.Nprintf(`
 resource "google_active_directory_domain_trust" "ad-domain-trust" {
-    domain     = "ci-managed-ad.com"
+domain     = "ci-managed-ad.com"
     target_domain_name = "example-gcp.com"
     target_dns_ip_addresses = ["10.1.0.100"]
     trust_direction         = "OUTBOUND"
     trust_type              = "FOREST"
     trust_handshake_secret  = "Testing1!"
+    deletion_protection = false
 }
 `, context)
 }
@@ -77,6 +78,7 @@ resource "google_active_directory_domain_trust" "ad-domain-trust" {
     trust_direction         = "OUTBOUND"
     trust_type              = "FOREST"
     trust_handshake_secret  = "Testing1!"
+    deletion_protection = false
 }
 `, context)
 }

google/services/activedirectory/resource_active_directory_domain_update_test.go

@@ -41,7 +41,7 @@ func TestAccActiveDirectoryDomain_update(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"domain_name", "labels", "terraform_labels"},
+				ImportStateVerifyIgnore: []string{"domain_name", "labels", "terraform_labels", "deletion_protection"},
 			},
 			{
 				Config: testAccADDomainUpdate(context),
@@ -50,7 +50,7 @@ func TestAccActiveDirectoryDomain_update(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"domain_name", "labels", "terraform_labels"},
+				ImportStateVerifyIgnore: []string{"domain_name", "labels", "terraform_labels", "deletion_protection"},
 			},
 			{
 				Config: testAccADDomainBasic(context),
@@ -59,7 +59,7 @@ func TestAccActiveDirectoryDomain_update(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"domain_name", "labels", "terraform_labels"},
+				ImportStateVerifyIgnore: []string{"domain_name", "labels", "terraform_labels", "deletion_protection"},
 			},
 		},
 	})
@@ -72,6 +72,7 @@ func testAccADDomainBasic(context map[string]interface{}) string {
 	  domain_name       = "%{domain}"
 	  locations         = ["us-central1"]
 	  reserved_ip_range = "192.168.255.0/24" 
+	  deletion_protection = false
 	}
 	`, context)
 }
@@ -82,6 +83,7 @@ func testAccADDomainUpdate(context map[string]interface{}) string {
 	  domain_name       = "%{domain}"	
 	  locations         = ["us-central1", "us-west1"]
 	  reserved_ip_range = "192.168.255.0/24" 
+	  deletion_protection = false
 	  labels = {
 		  env = "test"
 	  }

website/docs/guides/version_6_upgrade.html.markdown

@@ -120,6 +120,19 @@ Removed in favor of field `settings.ip_configuration.ssl_mode`.
 
 An empty value means the setting should be cleared.
 
+## Resource: `google_domain`
+
+### Domain deletion now prevented by default with `deletion_protection`
+
+The field `deletion_protection` has been added with a default value of `true`. This field prevents
+Terraform from destroying or recreating the Domain. In 6.0.0, existing domains will have 
+`deletion_protection` set to `true` during the next refresh unless otherwise set in configuration.
+
+**`deletion_protection` does NOT prevent deletion outside of Terraform.**
+
+To disable deletion protection, explicitly set this field to `false` in configuration
+and then run `terraform apply` to apply the change.
+
 ## Resource: `google_cloud_run_v2_job`
 
 ### retyped `containers.env` to SET from ARRAY

website/docs/r/active_directory_domain.html.markdown

@@ -36,6 +36,7 @@ resource "google_active_directory_domain" "ad-domain" {
   domain_name       = "tfgen.org.com"
   locations         = ["us-central1"]
   reserved_ip_range = "192.168.255.0/24" 
+  deletion_protection = false
 }
 ```
 
@@ -82,6 +83,13 @@ The following arguments are supported:
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
+* `deletion_protection` - (Optional) Whether Terraform will be prevented from destroying the domain. Defaults to true.
+When a`terraform destroy` or `terraform apply` would delete the domain,
+the command will fail if this field is not set to false in Terraform state.
+When the field is set to true or unset in Terraform state, a `terraform apply`
+or `terraform destroy` that would delete the domain will fail.
+When the field is set to false, deleting the domain is allowed.
+
 
 ## Attributes Reference
 

website/docs/r/active_directory_domain_trust.html.markdown

@@ -43,6 +43,7 @@ resource "google_active_directory_domain_trust" "ad-domain-trust" {
     trust_direction         = "OUTBOUND"
     trust_type              = "FOREST"
     trust_handshake_secret  = "Testing1!"
+    deletion_protection = false
 }
 ```
 

website/docs/r/active_directory_peering.html.markdown

@@ -39,6 +39,7 @@ resource "google_active_directory_peering" "ad-domain-peering" {
     domain_resource    = google_active_directory_domain.ad-domain.name
     peering_id         = "ad-domain-peering"
     authorized_network = google_compute_network.peered-network.id
+    deletion_protection = false
     labels             = {
         foo = "bar"
     }
@@ -50,6 +51,7 @@ resource "google_active_directory_domain" "ad-domain" {
     locations           = ["us-central1"]
     reserved_ip_range   = "192.168.255.0/24"
     authorized_networks = [google_compute_network.source-network.id]
+    deletion_protection = false
 }
 
 resource "google_compute_network" "peered-network" {