remove exactly one policy from organization policies (#2694)

Merged PR #2694.
GoogleCloudPlatform · Nov 15, 2019 · 28be073 · 28be073
1 parent 70a4480
commit 28be073
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 19 deletions.
diff --git a/build/terraform b/build/terraform
diff --git a/build/terraform-beta b/build/terraform-beta
diff --git a/third_party/terraform/resources/resource_google_organization_policy.go b/third_party/terraform/resources/resource_google_organization_policy.go
@@ -10,17 +10,20 @@ import (
 )
 
 var schemaOrganizationPolicy = map[string]*schema.Schema{
+	// Although the API suggests that boolean_policy, list_policy, or restore_policy must be set,
+	// Organization policies can be "inherited from parent" in the UI, and this is the default
+	// state of the resource without any policy set.
+	// See https://github.com/terraform-providers/terraform-provider-google/issues/3607
 	"constraint": {
 		Type:             schema.TypeString,
 		Required:         true,
 		ForceNew:         true,
 		DiffSuppressFunc: compareSelfLinkOrResourceName,
 	},
 	"boolean_policy": {
-		Type:         schema.TypeList,
-		Optional:     true,
-		MaxItems:     1,
-		ExactlyOneOf: []string{"list_policy", "boolean_policy", "restore_policy"},
+		Type:     schema.TypeList,
+		Optional: true,
+		MaxItems: 1,
 		Elem: &schema.Resource{
 			Schema: map[string]*schema.Schema{
 				"enforced": {
@@ -31,10 +34,9 @@ var schemaOrganizationPolicy = map[string]*schema.Schema{
 		},
 	},
 	"list_policy": {
-		Type:         schema.TypeList,
-		Optional:     true,
-		MaxItems:     1,
-		ExactlyOneOf: []string{"list_policy", "boolean_policy", "restore_policy"},
+		Type:     schema.TypeList,
+		Optional: true,
+		MaxItems: 1,
 		Elem: &schema.Resource{
 			Schema: map[string]*schema.Schema{
 				"allow": {
@@ -109,10 +111,9 @@ var schemaOrganizationPolicy = map[string]*schema.Schema{
 		Computed: true,
 	},
 	"restore_policy": {
-		Type:         schema.TypeList,
-		Optional:     true,
-		MaxItems:     1,
-		ExactlyOneOf: []string{"restore_policy", "boolean_policy", "list_policy"},
+		Type:     schema.TypeList,
+		Optional: true,
+		MaxItems: 1,
 		Elem: &schema.Resource{
 			Schema: map[string]*schema.Schema{
 				"default": {

diff --git a/third_party/terraform/website/docs/guides/version_3_upgrade.html.markdown b/third_party/terraform/website/docs/guides/version_3_upgrade.html.markdown
@@ -1358,11 +1358,6 @@ required on the `http_check.auth_info` block.
 
 ## Resource: `google_organization_policy`
 
-### Exactly one of `list_policy`, `boolean_policy`, or `restore_policy` is now required on `google_organization_policy`
-
-In attempt to be more consistent with the API, exactly one of `list_policy`, `boolean_policy`,
-or `restore_policy` is now required on `google_organization_policy`.
-
 ### Exactly one of `allow` or `deny` is now required on `google_organization_policy.list_policy`
 
 In an attempt to avoid allowing empty blocks in config files, exactly one of `allow` or `deny` is now