Add IAP Client Datasource

.changelog/4429.txt

@@ -0,0 +1,3 @@
+```release-note:new-datasource
+`google_iap_client`
+```

google/data_source_iap_client.go

@@ -0,0 +1,29 @@
+package google
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+func dataSourceGoogleIapClient() *schema.Resource {
+
+	dsSchema := datasourceSchemaFromResourceSchema(resourceIapClient().Schema)
+	addRequiredFieldsToSchema(dsSchema, "brand", "client_id")
+
+	return &schema.Resource{
+		Read:   dataSourceGoogleIapClientRead,
+		Schema: dsSchema,
+	}
+}
+
+func dataSourceGoogleIapClientRead(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+
+	id, err := replaceVars(d, config, "{{brand}}/identityAwareProxyClients/{{client_id}}")
+	if err != nil {
+		return fmt.Errorf("Error constructing id: %s", err)
+	}
+	d.SetId(id)
+	return resourceIapClientRead(d, meta)
+}

google/data_source_iap_client_test.go

@@ -0,0 +1,67 @@
+package google
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+)
+
+func TestAccIapClient_Datasource_basic(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"org_id":        getTestOrgFromEnv(t),
+		"org_domain":    getTestOrgDomainFromEnv(t),
+		"random_suffix": randString(t, 10),
+	}
+
+	vcrTest(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccIapClientDatasourceConfig(context),
+				Check: resource.ComposeTestCheckFunc(
+					checkDataSourceStateMatchesResourceStateWithIgnores(
+						"data.google_iap_client.project_client",
+						"google_iap_client.project_client",
+						map[string]struct{}{
+							"brand": {},
+						},
+					),
+				),
+			},
+		},
+	})
+}
+
+func testAccIapClientDatasourceConfig(context map[string]interface{}) string {
+	return Nprintf(`
+resource "google_project" "project" {
+  project_id = "tf-test%{random_suffix}"
+  name       = "tf-test%{random_suffix}"
+  org_id     = "%{org_id}"
+}
+
+resource "google_project_service" "project_service" {
+  project = google_project.project.project_id
+  service = "iap.googleapis.com"
+}
+
+resource "google_iap_brand" "project_brand" {
+  support_email     = "support@%{org_domain}"
+  application_title = "Cloud IAP protected Application"
+  project           = google_project_service.project_service.project
+}
+
+resource "google_iap_client" "project_client" {
+  display_name = "Test Client"
+  brand        = google_iap_brand.project_brand.name
+}
+
+data "google_iap_client" "project_client" {
+  brand = google_iap_client.project_client.brand
+  client_id = google_iap_client.project_client.client_id
+}
+`, context)
+}

google/provider.go

@@ -668,6 +668,7 @@ func Provider() *schema.Provider {
 			"google_iam_policy":                                   dataSourceGoogleIamPolicy(),
 			"google_iam_role":                                     dataSourceGoogleIamRole(),
 			"google_iam_testable_permissions":                     dataSourceGoogleIamTestablePermissions(),
+			"google_iap_client":                                   dataSourceGoogleIapClient(),
 			"google_kms_crypto_key":                               dataSourceGoogleKmsCryptoKey(),
 			"google_kms_crypto_key_version":                       dataSourceGoogleKmsCryptoKeyVersion(),
 			"google_kms_key_ring":                                 dataSourceGoogleKmsKeyRing(),

website/docs/d/iap_client.html.markdown

@@ -0,0 +1,37 @@
+---
+subcategory: "Identity-Aware Proxy"
+layout: "google"
+page_title: "Google: google_iap_client"
+sidebar_current: "docs-google-datasource-iap-client"
+description: |-
+  Contains the data that describes an Identity Aware Proxy owned client.
+---
+# google_iap_client
+
+Get info about a Google Cloud IAP Client.
+
+## Example Usage
+
+```tf
+data "google_project" "project" {
+  project_id = "foobar"
+}
+
+data "google_iap_client" "project_client" {
+  brand        =  "projects/${data.google_project.project.number}/brands/[BRAND_NUMBER]"
+  client_id    = FOO.apps.googleusercontent.com
+}
+
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `brand` - (Required) The name of the brand.
+
+* `client_id` - (Required) The client_id of the brand.
+
+## Attributes Reference
+
+See [google_iap_client](https://www.terraform.io/docs/providers/google/r/iap_client.html) resource for details of the available attributes.

website/docs/r/iap_client.html.markdown

@@ -24,7 +24,7 @@ description: |-
 
 Contains the data that describes an Identity Aware Proxy owned client.
 
-~> **Note:** Only internal org clients can be created via declarative tools. Other types of clients must be
+~> **Note:** Only internal org clients can be created via declarative tools. External clients must be
 manually created via the GCP console. This restriction is due to the existing APIs and not lack of support
 in this tool.
 

website/google.erb

@@ -2356,6 +2356,16 @@
     <li>
     <a href="#">Identity-Aware Proxy</a>
     <ul class="nav">
+      <li>
+        <a href="#">Data Sources</a>
+        <ul class="nav nav-auto-expand">
+
+          <li>
+          <a href="/docs/providers/google/d/iap_client.html">google_iap_client</a>
+          </li>
+
+        </ul>
+      </li>
       <li>
         <a href="#">Resources</a>
         <ul class="nav nav-auto-expand">