Add deletion_protection field to Folders resource (#11293) (#7903)

[upstream:a31848e911392a82ae25e89c4bac87c6275541fc]

Signed-off-by: Modular Magician <[email protected]>

.changelog/11293.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+google_folders: added `deletion_protection` field to `folders` to make deleting them require an explicit intent. `folder` resources now cannot be destroyed unless `deletion_protection = false` is set for the resource.
+```

google-beta/services/accessapproval/data_source_access_approval_folder_service_account_test.go

@@ -42,6 +42,7 @@ func testAccDataSourceAccessApprovalFolderServiceAccount_basic(context map[strin
 resource "google_folder" "my_folder" {
   display_name = "tf-test-my-folder%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 
 # Wait after folder creation to limit eventual consistency errors.

google-beta/services/accessapproval/resource_access_approval_folder_settings_test.go

@@ -69,6 +69,7 @@ func testAccAccessApprovalFolderSettings_full(context map[string]interface{}) st
 resource "google_folder" "my_folder" {
   display_name = "tf-test-my-folder%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 
 # Wait after folder creation to limit eventual consistency errors.
@@ -96,6 +97,7 @@ func testAccAccessApprovalFolderSettings_update(context map[string]interface{})
 resource "google_folder" "my_folder" {
   display_name = "tf-test-my-folder%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 
 # Wait after folder creation to limit eventual consistency errors.
@@ -123,6 +125,7 @@ func testAccAccessApprovalFolderSettings_activeKeyVersion(context map[string]int
 resource "google_folder" "my_folder" {
   display_name = "tf-test-my-folder%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 
 # Wait after folder creation to limit eventual consistency errors.

google-beta/services/assuredworkloads/resource_assured_workloads_workload_generated_test.go

@@ -210,6 +210,7 @@ resource "google_assured_workloads_workload" "primary" {
 resource "google_folder" "folder1" {
   display_name = "tf-test-name%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 `, context)
 }
@@ -236,6 +237,7 @@ resource "google_assured_workloads_workload" "primary" {
 resource "google_folder" "folder1" {
   display_name = "tf-test-name%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 `, context)
 }
@@ -258,6 +260,7 @@ resource "google_assured_workloads_workload" "primary" {
 resource "google_folder" "folder1" {
   display_name = "tf-test-name%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 
 `, context)

google-beta/services/cloudasset/resource_cloud_asset_folder_feed_generated_test.go

@@ -99,6 +99,7 @@ resource "google_pubsub_topic" "feed_output" {
 resource "google_folder" "my_folder" {
   display_name = "Networking%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 
 # Find the project number of the project whose identity will be used for sending

google-beta/services/compute/resource_compute_firewall_policy_association_test.go

@@ -42,11 +42,13 @@ func testAccComputeFirewallPolicyAssociation_basic(context map[string]interface{
 resource "google_folder" "folder" {
   display_name = "tf-test-folder-%{random_suffix}"
   parent       = "%{org_name}"
+  deletion_protection = false
 }
 
 resource "google_folder" "target_folder" {
   display_name = "tf-test-target-%{random_suffix}"
   parent       = "%{org_name}"
+  deletion_protection = false
 }
 
 resource "google_compute_firewall_policy" "default" {

google-beta/services/compute/resource_compute_firewall_policy_rule_generated_test.go

@@ -83,6 +83,7 @@ resource "google_network_security_address_group" "basic_global_networksecurity_a
 resource "google_folder" "folder" {
   display_name = "tf-test-policy%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 
 resource "google_compute_firewall_policy" "default" {
@@ -136,6 +137,7 @@ resource "google_network_security_address_group" "basic_global_networksecurity_a
 resource "google_folder" "folder" {
   display_name = "tf-test-policy%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 
 resource "google_compute_firewall_policy" "default" {

google-beta/services/compute/resource_compute_firewall_policy_rule_test.go

@@ -154,6 +154,7 @@ func testAccComputeFirewallPolicyRule_securityProfileGroup_basic(context map[str
 resource "google_folder" "folder" {
   display_name = "tf-test-folder-%{random_suffix}"
   parent       = "%{org_name}"
+  deletion_protection = false
 }
 
 resource "google_network_security_security_profile" "security_profile" {
@@ -203,6 +204,7 @@ func testAccComputeFirewallPolicyRule_securityProfileGroup_update(context map[st
 resource "google_folder" "folder" {
   display_name = "tf-test-folder-%{random_suffix}"
   parent       = "%{org_name}"
+  deletion_protection = false
 }
 
 resource "google_network_security_security_profile" "security_profile" {
@@ -278,6 +280,7 @@ resource "google_compute_network" "network2" {
 resource "google_folder" "folder" {
   display_name = "tf-test-folder-%{random_suffix}"
   parent       = "%{org_name}"
+  deletion_protection = false
 }
 
 resource "google_compute_firewall_policy" "fw_policy" {
@@ -343,6 +346,7 @@ resource "google_compute_network" "network2" {
 resource "google_folder" "folder" {
   display_name = "tf-test-folder-%{random_suffix}"
   parent       = "%{org_name}"
+  deletion_protection = false
 }
 
 resource "google_compute_firewall_policy" "fw_policy" {
@@ -418,6 +422,7 @@ resource "google_compute_network" "network2" {
 resource "google_folder" "folder" {
   display_name = "tf-test-folder-%{random_suffix}"
   parent       = "%{org_name}"
+  deletion_protection = false
 }
 
 resource "google_compute_firewall_policy" "fw_policy" {
@@ -469,6 +474,7 @@ func testAccComputeFirewallPolicyRule_multiple(context map[string]interface{}) s
 resource "google_folder" "folder" {
   display_name = "tf-test-folder-%{random_suffix}"
   parent       = "%{org_name}"
+  deletion_protection = false
 }
 
 resource "google_compute_firewall_policy" "fw_policy" {
@@ -541,6 +547,7 @@ func testAccComputeFirewallPolicyRule_multipleAdd(context map[string]interface{}
 resource "google_folder" "folder" {
   display_name = "tf-test-folder-%{random_suffix}"
   parent       = "%{org_name}"
+  deletion_protection = false
 }
 
 resource "google_compute_firewall_policy" "fw_policy" {
@@ -634,6 +641,7 @@ func testAccComputeFirewallPolicyRule_multipleRemove(context map[string]interfac
 resource "google_folder" "folder" {
   display_name = "tf-test-folder-%{random_suffix}"
   parent       = "%{org_name}"
+  deletion_protection = false
 }
 
 resource "google_compute_firewall_policy" "fw_policy" {

google-beta/services/compute/resource_compute_firewall_policy_test.go

@@ -56,6 +56,7 @@ func testAccComputeFirewallPolicy_basic(org, policyName, folderName string) stri
 resource "google_folder" "folder" {
   display_name = "%s"
   parent       = "%s"
+  deletion_protection = false
 }
 
 resource "google_compute_firewall_policy" "default" {
@@ -71,6 +72,7 @@ func testAccComputeFirewallPolicy_update(org, policyName, folderName string) str
 resource "google_folder" "folder" {
   display_name = "%s"
   parent       = "%s"
+  deletion_protection = false
 }
 
 resource "google_compute_firewall_policy" "default" {

google-beta/services/compute/resource_compute_organization_security_policy_association_generated_test.go

@@ -61,6 +61,7 @@ resource "google_folder" "security_policy_target" {
   provider     = google-beta
   display_name = "tf-test-secpol-%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 
 resource "google_compute_organization_security_policy" "policy" {

google-beta/services/compute/resource_compute_organization_security_policy_rule_test.go

@@ -48,6 +48,7 @@ func testAccComputeOrganizationSecurityPolicyRule_organizationSecurityPolicyRule
 resource "google_folder" "security_policy_target" {
   display_name = "tf-test-secpol-%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 
 resource "google_compute_organization_security_policy" "policy" {
@@ -82,6 +83,7 @@ func testAccComputeOrganizationSecurityPolicyRule_organizationSecurityPolicyRule
 resource "google_folder" "security_policy_target" {
   display_name = "tf-test-secpol-%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 
 resource "google_compute_organization_security_policy" "policy" {

google-beta/services/iam2/resource_iam_deny_policy_test.go

@@ -195,6 +195,7 @@ resource "google_iam_deny_policy" "example" {
 resource "google_folder" "folder" {
   display_name = "tf-test-%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 `, context)
 }
@@ -217,6 +218,7 @@ resource "google_iam_deny_policy" "example" {
 resource "google_folder" "folder" {
   display_name = "tf-test-%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 `, context)
 }

google-beta/services/kms/resource_kms_autokey_config_generated_test.go

@@ -69,6 +69,7 @@ resource "google_folder" "autokms_folder" {
   provider     = google-beta
   display_name = "tf-test-my-folder%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 
 # Create the key project

google-beta/services/kms/resource_kms_key_handle_generated_test.go

@@ -63,6 +63,7 @@ resource "google_folder" "autokms_folder" {
   provider     = google-beta
   display_name = "folder-example"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 
 # Create the key project

google-beta/services/logging/data_source_google_logging_folder_settings_test.go

@@ -39,6 +39,7 @@ func testAccLoggingFolderSettings_datasource(context map[string]interface{}) str
 resource "google_folder" "default" {
 	display_name = "%{folder_name}"
 	parent       = "organizations/%{org_id}"
+	deletion_protection = false
 }
 
 data "google_logging_folder_settings" "settings" {

google-beta/services/logging/resource_logging_bucket_config_test.go

@@ -258,6 +258,7 @@ func testAccLoggingBucketConfigFolder_basic(context map[string]interface{}, rete
 resource "google_folder" "default" {
 	display_name = "%{folder_name}"
 	parent       = "organizations/%{org_id}"
+	deletion_protection = false
 }
 
 resource "google_logging_folder_bucket_config" "basic" {

google-beta/services/logging/resource_logging_folder_exclusion_test.go

@@ -239,6 +239,7 @@ resource "google_logging_folder_exclusion" "basic" {
 resource "google_folder" "my-folder" {
   display_name = "%s"
   parent       = "%s"
+  deletion_protection = false
 }
 `, exclusionName, description, envvar.GetTestProjectFromEnv(), folderName, folderParent)
 }
@@ -255,6 +256,7 @@ resource "google_logging_folder_exclusion" "full-folder" {
 resource "google_folder" "my-folder" {
   display_name = "%s"
   parent       = "%s"
+  deletion_protection = false
 }
 `, exclusionName, description, envvar.GetTestProjectFromEnv(), folderName, folderParent)
 }
@@ -264,6 +266,7 @@ func testAccLoggingFolderExclusion_multipleCfg(folderName, folderParent, exclusi
 resource "google_folder" "my-folder" {
 	display_name = "%s"
 	parent       = "%s"
+	deletion_protection = false
 }
 `, folderName, folderParent)
 

google-beta/services/logging/resource_logging_folder_settings_generated_test.go

@@ -65,6 +65,7 @@ resource "google_logging_folder_settings" "example" {
 resource "google_folder" "my_folder" {
   display_name = "tf-test-folder-name%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 
 data "google_logging_folder_settings" "settings" {

google-beta/services/logging/resource_logging_folder_settings_test.go

@@ -60,6 +60,7 @@ resource "google_logging_folder_settings" "example" {
 resource "google_folder" "my_folder" {
   display_name = "tf-test-folder-%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 
 data "google_logging_folder_settings" "settings" {
@@ -83,6 +84,7 @@ resource "google_logging_folder_settings" "example" {
 resource "google_folder" "my_folder" {
   display_name = "tf-test-folder-%{random_suffix}"
   parent       = "organizations/%{org_id}"
+  deletion_protection = false
 }
 `, context)
 }

google-beta/services/logging/resource_logging_folder_sink_test.go

@@ -402,6 +402,7 @@ resource "google_storage_bucket" "log-bucket" {
 resource "google_folder" "my-folder" {
   display_name = "%s"
   parent       = "%s"
+  deletion_protection = false
 }
 `, sinkName, envvar.GetTestProjectFromEnv(), bucketName, folderName, folderParent)
 }
@@ -425,6 +426,7 @@ resource "google_storage_bucket" "log-bucket" {
 resource "google_folder" "my-folder" {
   display_name = "%s"
   parent       = "%s"
+  deletion_protection = false
 }
 `, sinkName, envvar.GetTestProjectFromEnv(), bucketName, folderName, folderParent)
 }
@@ -448,6 +450,7 @@ resource "google_storage_bucket" "log-bucket" {
 resource "google_folder" "my-folder" {
   display_name = "%s"
   parent       = "%s"
+  deletion_protection = false
 }
 `, sinkName, envvar.GetTestProjectFromEnv(), bucketName, folderName, folderParent)
 }
@@ -468,8 +471,9 @@ resource "google_storage_bucket" "log-bucket" {
 }
 
 resource "google_folder" "my-folder" {
-  display_name = "%s"
-    parent       = "%s"
+	display_name = "%s"
+	parent       = "%s"
+	deletion_protection = false
 }`, sinkName, bucketName, folderName, folderParent)
 }
 
@@ -491,6 +495,7 @@ resource "google_storage_bucket" "log-bucket" {
 resource "google_folder" "my-folder" {
   display_name = "%s"
   parent       = "%s"
+  deletion_protection = false
 }
 `, sinkName, envvar.GetTestProjectFromEnv(), bucketName, folderName, folderParent)
 }
@@ -521,6 +526,7 @@ resource "google_storage_bucket" "log-bucket" {
 resource "google_folder" "my-folder" {
   display_name = "%s"
   parent       = "%s"
+  deletion_protection = false
 }
 `, sinkName, envvar.GetTestProjectFromEnv(), bucketName, folderName, folderParent)
 }
@@ -547,6 +553,7 @@ resource "google_bigquery_dataset" "logging_sink" {
 resource "google_folder" "my-folder" {
   display_name = "%s"
   parent       = "%s"
+  deletion_protection = false
 }`, sinkName, envvar.GetTestProjectFromEnv(), envvar.GetTestProjectFromEnv(), bqDatasetID, folderName, folderParent)
 }
 
@@ -568,6 +575,7 @@ resource "google_bigquery_dataset" "logging_sink" {
 resource "google_folder" "my-folder" {
   display_name = "%s"
   parent       = "%s"
+  deletion_protection = false
 }`, sinkName, envvar.GetTestProjectFromEnv(), envvar.GetTestProjectFromEnv(), bqDatasetID, folderName, folderParent)
 }
 
@@ -585,6 +593,7 @@ resource "google_logging_folder_sink" "intercept_update" {
 resource "google_folder" "intercept_folder" {
   display_name = "%s"
   parent       = "%s"
+  deletion_protection = false
 }
 `, sinkName, envvar.GetTestProjectFromEnv(), envvar.GetTestProjectFromEnv(), intercept_children, folderName, folderParent)
 }

google-beta/services/orgpolicy/resource_org_policy_policy_test.go

@@ -210,6 +210,7 @@ resource "google_org_policy_policy" "primary" {
 resource "google_folder" "basic" {
   parent       = "organizations/%{org_id}"
   display_name = "tf-test-folder%{random_suffix}"
+  deletion_protection = false
 }
 
 
@@ -247,6 +248,7 @@ resource "google_org_policy_policy" "primary" {
 resource "google_folder" "basic" {
   parent       = "organizations/%{org_id}"
   display_name = "tf-test-folder%{random_suffix}"
+  deletion_protection = false
 }