Add ability to bulk edit access manager access levels and service perimeters

products/accesscontextmanager/inspec.yaml

@@ -22,12 +22,16 @@ overrides: !ruby/object:Overrides::ResourceOverrides
         name_from_self_link: true
   AccessLevel: !ruby/object:Overrides::Inspec::ResourceOverride
     exclude: true
+  AccessLevels: !ruby/object:Overrides::Inspec::ResourceOverride
+    exclude: true
   ServicePerimeter: !ruby/object:Overrides::Inspec::ResourceOverride
     base_url: "accessPolicies/{{policy_name}}/servicePerimeters"
     self_link: "accessPolicies/{{policy_name}}/servicePerimeters/{{name}}"
     privileged: true
     properties:
       name: !ruby/object:Overrides::Inspec::PropertyOverride
         name_from_self_link: true
+  ServicePerimeters: !ruby/object:Overrides::Inspec::ResourceOverride
+    exclude: true
   ServicePerimeterResource: !ruby/object:Overrides::Inspec::ResourceOverride
     exclude: true

products/accesscontextmanager/terraform.yaml

@@ -60,6 +60,34 @@ overrides: !ruby/object:Overrides::ResourceOverrides
     custom_code: !ruby/object:Provider::Terraform::CustomCode
       encoder: templates/terraform/encoders/access_level_never_send_parent.go.erb
       custom_import: templates/terraform/custom_import/set_access_policy_parent_from_self_link.go.erb
+  AccessLevels: !ruby/object:Overrides::Terraform::ResourceOverride
+    timeouts: !ruby/object:Api::Timeouts
+      insert_minutes: 6
+      update_minutes: 6
+      delete_minutes: 6
+    autogen_async: true
+    # Skipping the sweeper due to the non-standard base_url
+    skip_sweeper: true
+    id_format: "{{parent}}/accessLevels"
+    import_format: ["{{parent}}/accessLevels"]
+    examples:
+    - !ruby/object:Provider::Terraform::Examples
+      name: "access_context_manager_access_levels_basic"
+      skip_test: true
+      primary_resource_id: "access-levels"
+      vars:
+        access_level_name1: "chromeos_no_lock"
+        access_level_name2: "mac_no_lock"
+    properties:
+      parent: !ruby/object:Overrides::Terraform::PropertyOverride
+        ignore_read: true
+      accessLevels: !ruby/object:Overrides::Terraform::PropertyOverride
+        is_set: true
+      accessLevels.basic.combiningFunction: !ruby/object:Overrides::Terraform::PropertyOverride
+        custom_flatten: templates/terraform/custom_flatten/default_if_empty.erb
+    custom_code: !ruby/object:Provider::Terraform::CustomCode
+      custom_import: templates/terraform/custom_import/set_access_policy_parent_from_access_policy.go.erb
+      custom_delete: templates/terraform/custom_delete/replace_all_access_levels_empty_list.go.erb
   ServicePerimeter: !ruby/object:Overrides::Terraform::ResourceOverride
     timeouts: !ruby/object:Api::Timeouts
       insert_minutes: 6
@@ -98,6 +126,39 @@ overrides: !ruby/object:Overrides::ResourceOverrides
     custom_code: !ruby/object:Provider::Terraform::CustomCode
       encoder: templates/terraform/encoders/access_level_never_send_parent.go.erb
       custom_import: templates/terraform/custom_import/set_access_policy_parent_from_self_link.go.erb
+  ServicePerimeters: !ruby/object:Overrides::Terraform::ResourceOverride
+    timeouts: !ruby/object:Api::Timeouts
+      insert_minutes: 6
+      update_minutes: 6
+      delete_minutes: 6
+    autogen_async: true
+    # Skipping the sweeper due to the non-standard base_url
+    skip_sweeper: true
+    id_format: "{{parent}}/servicePerimeters"
+    import_format: ["{{parent}}/servicePerimeters"]
+    examples:
+      - !ruby/object:Provider::Terraform::Examples
+        name: "access_context_manager_service_perimeters_basic"
+        skip_test: true
+        primary_resource_id: "service-perimeter"
+        vars:
+          access_level_name: "chromeos_no_lock"
+          service_perimeter_name: "restrict_storage"
+    properties:
+      parent: !ruby/object:Overrides::Terraform::PropertyOverride
+        ignore_read: true
+      servicePerimeters: !ruby/object:Overrides::Terraform::PropertyOverride
+        is_set: true
+      servicePerimeters.perimeterType: !ruby/object:Overrides::Terraform::PropertyOverride
+        custom_flatten: templates/terraform/custom_flatten/default_if_empty.erb
+        input: true
+      servicePerimeters.status.restrictedServices: !ruby/object:Overrides::Terraform::PropertyOverride
+        is_set: true
+      servicePerimeters.status.vpcAccessibleServices.allowedServices: !ruby/object:Overrides::Terraform::PropertyOverride
+        is_set: true
+    custom_code: !ruby/object:Provider::Terraform::CustomCode
+      custom_import: templates/terraform/custom_import/set_access_policy_parent_from_access_policy.go.erb
+      custom_delete: templates/terraform/custom_delete/replace_all_service_perimeters_empty_list.go.erb
   ServicePerimeterResource: !ruby/object:Overrides::Terraform::ResourceOverride
     autogen_async: true
     exclude_validator: true

templates/terraform/custom_delete/replace_all_access_levels_empty_list.go.erb

@@ -0,0 +1,28 @@
+config := meta.(*Config)
+
+obj := make(map[string]interface{})
+obj["accessLevels"] = []string{}
+
+url, err := replaceVars(d, config, "{{AccessContextManagerBasePath}}{{parent}}/accessLevels:replaceAll")
+if err != nil {
+	return err
+}
+
+log.Printf("[DEBUG] Deleting AccessLevels %q: %#v", d.Id(), obj)
+res, err := sendRequestWithTimeout(config, "POST", "", url, obj, d.Timeout(schema.TimeoutUpdate))
+
+if err != nil {
+	return fmt.Errorf("Error deleting AccessLevels %q: %s", d.Id(), err)
+} else {
+	log.Printf("[DEBUG] Finished deleting AccessLevels %q: %#v", d.Id(), res)
+}
+
+err = accessContextManagerOperationWaitTime(
+	config, res, "Updating AccessLevels",
+	d.Timeout(schema.TimeoutUpdate))
+
+if err != nil {
+	return err
+}
+
+return nil

templates/terraform/custom_delete/replace_all_service_perimeters_empty_list.go.erb

@@ -0,0 +1,28 @@
+config := meta.(*Config)
+
+obj := make(map[string]interface{})
+obj["servicePerimeters"] = []string{}
+
+url, err := replaceVars(d, config, "{{AccessContextManagerBasePath}}{{parent}}/servicePerimeters:replaceAll")
+if err != nil {
+	return err
+}
+
+log.Printf("[DEBUG] Deleting servicePerimeters %q: %#v", d.Id(), obj)
+res, err := sendRequestWithTimeout(config, "POST", "", url, obj, d.Timeout(schema.TimeoutUpdate))
+
+if err != nil {
+	return fmt.Errorf("Error deleting ServicePerimeters %q: %s", d.Id(), err)
+} else {
+	log.Printf("[DEBUG] Finished deleting ServicePerimeters %q: %#v", d.Id(), res)
+}
+
+err = accessContextManagerOperationWaitTime(
+	config, res, "Updating ServicePerimeters",
+	d.Timeout(schema.TimeoutUpdate))
+
+if err != nil {
+	return err
+}
+
+return nil

templates/terraform/custom_import/set_access_policy_parent_from_access_policy.go.erb

@@ -0,0 +1,24 @@
+<%# The license inside this block applies to this file.
+	# Copyright 2020 Google Inc.
+	# Licensed under the Apache License, Version 2.0 (the "License");
+	# you may not use this file except in compliance with the License.
+	# You may obtain a copy of the License at
+	#
+	#     http://www.apache.org/licenses/LICENSE-2.0
+	#
+	# Unless required by applicable law or agreed to in writing, software
+	# distributed under the License is distributed on an "AS IS" BASIS,
+	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	# See the License for the specific language governing permissions and
+	# limitations under the License.
+-%>
+	config := meta.(*Config)
+
+	// current import_formats can't import fields with forward slashes in their value
+	parts, err := getImportIdQualifiers([]string{"accessPolicies/(?P<accessPolicy>[^/]+)/(.+)"}, d, config, d.Id())
+	if err != nil {
+		return nil, err
+	}
+
+	d.Set("parent", fmt.Sprintf("accessPolicies/%s", parts["accessPolicy"]))
+	return []*schema.ResourceData{d}, nil

templates/terraform/examples/access_context_manager_access_levels_basic.tf.erb

@@ -0,0 +1,47 @@
+resource "google_access_context_manager_access_levels" "<%= ctx[:primary_resource_id] %>" {
+  parent = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}"
+  access_levels {
+    name   = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}/accessLevels/<%= ctx[:vars]['access_level_name1'] %>"
+    title  = "<%= ctx[:vars]['access_level_name1'] %>"
+    basic {
+      conditions {
+        device_policy {
+          require_screen_lock = true
+          os_constraints {
+            os_type = "DESKTOP_CHROME_OS"
+          }
+        }
+        regions = [
+    "CH",
+    "IT",
+    "US",
+        ]
+      }
+    }
+  }
+
+  access_levels {
+    name   = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}/accessLevels/<%= ctx[:vars]['access_level_name2'] %>"
+    title  = "<%= ctx[:vars]['access_level_name2'] %>"
+    basic {
+      conditions {
+        device_policy {
+          require_screen_lock = true
+          os_constraints {
+            os_type = "DESKTOP_MAC"
+          }
+        }
+        regions = [
+    "CH",
+    "IT",
+    "US",
+        ]
+      }
+    }
+  }
+}
+
+resource "google_access_context_manager_access_policy" "access-policy" {
+  parent = "organizations/123456789"
+  title  = "my policy"
+}

templates/terraform/examples/access_context_manager_service_perimeters_basic.tf.erb

@@ -0,0 +1,45 @@
+resource "google_access_context_manager_service_perimeters" "<%= ctx[:primary_resource_id] %>" {
+  parent = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}"
+
+  service_perimeters {
+    name   = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}/servicePerimeters/<%= ctx[:vars]['service_perimeter_name1'] %>"
+    title  = "<%= ctx[:vars]['service_perimeter_name1'] %>"
+    status {
+      restricted_services = ["storage.googleapis.com"]
+    }
+  }
+
+  service_perimeters {
+    name   = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}/servicePerimeters/<%= ctx[:vars]['service_perimeter_name2'] %>"
+    title  = "<%= ctx[:vars]['service_perimeter_name2'] %>"
+    status {
+      restricted_services = ["bigtable.googleapis.com"]
+    }
+  }
+}
+
+resource "google_access_context_manager_access_level" "access-level" {
+  parent = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}"
+  name   = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}/accessLevels/<%= ctx[:vars]['access_level_name'] %>"
+  title  = "<%= ctx[:vars]['access_level_name'] %>"
+  basic {
+    conditions {
+      device_policy {
+        require_screen_lock = false
+        os_constraints {
+          os_type = "DESKTOP_CHROME_OS"
+        }
+      }
+      regions = [
+        "CH",
+        "IT",
+        "US",
+      ]
+    }
+  }
+}
+
+resource "google_access_context_manager_access_policy" "access-policy" {
+  parent = "organizations/123456789"
+  title  = "my policy"
+}