Validate on deleted IAM members

Signed-off-by: Modular Magician <[email protected]>
hashicorp · Nov 21, 2019 · 1fdf9d8 · 1fdf9d8
1 parent bac54ae
commit 1fdf9d8
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 5 deletions.
diff --git a/google/data_source_google_iam_policy.go b/google/data_source_google_iam_policy.go
@@ -2,11 +2,13 @@ package google
 
 import (
 	"encoding/json"
+	"regexp"
 	"sort"
 	"strconv"
 
 	"github.com/hashicorp/terraform-plugin-sdk/helper/hashcode"
 	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/validation"
 	"google.golang.org/api/cloudresourcemanager/v1"
 )
 
@@ -38,8 +40,11 @@ func dataSourceGoogleIamPolicy() *schema.Resource {
 						"members": {
 							Type:     schema.TypeSet,
 							Required: true,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-							Set:      schema.HashString,
+							Elem: &schema.Schema{
+								Type:         schema.TypeString,
+								ValidateFunc: validation.StringDoesNotMatch(regexp.MustCompile("^deleted:"), "Terraform does not support IAM policies for deleted principals"),
+							},
+							Set: schema.HashString,
 						},
 					},
 				},

diff --git a/google/resource_iam_binding.go b/google/resource_iam_binding.go
@@ -4,9 +4,11 @@ import (
 	"errors"
 	"fmt"
 	"log"
+	"regexp"
 	"strings"
 
 	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/validation"
 	"google.golang.org/api/cloudresourcemanager/v1"
 )
 
@@ -22,6 +24,7 @@ var iamBindingSchema = map[string]*schema.Schema{
 		Elem: &schema.Schema{
 			Type:             schema.TypeString,
 			DiffSuppressFunc: caseDiffSuppress,
+			ValidateFunc:     validation.StringDoesNotMatch(regexp.MustCompile("^deleted:"), "Terraform does not support IAM bindings for deleted principals"),
 		},
 		Set: func(v interface{}) int {
 			return schema.HashString(strings.ToLower(v.(string)))

diff --git a/google/resource_iam_member.go b/google/resource_iam_member.go
@@ -4,9 +4,11 @@ import (
 	"errors"
 	"fmt"
 	"log"
+	"regexp"
 	"strings"
 
 	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/validation"
 	"google.golang.org/api/cloudresourcemanager/v1"
 )
 
@@ -21,6 +23,7 @@ var IamMemberBaseSchema = map[string]*schema.Schema{
 		Required:         true,
 		ForceNew:         true,
 		DiffSuppressFunc: caseDiffSuppress,
+		ValidateFunc:     validation.StringDoesNotMatch(regexp.MustCompile("^deleted:"), "Terraform does not support IAM members for deleted principals"),
 	},
 	"etag": {
 		Type:     schema.TypeString,

diff --git a/website/docs/r/bigtable_gc_policy.html.markdown b/website/docs/r/bigtable_gc_policy.html.markdown
@@ -48,7 +48,6 @@ resource "google_bigtable_gc_policy" "policy" {
 ```
 
 Multiple conditions is also supported. `UNION` when any of its sub-policies apply (OR). `INTERSECTION` when all its sub-policies apply (AND)
-
 ```hcl
 resource "google_bigtable_gc_policy" "policy" {
   instance_name = google_bigtable_instance.instance.name
@@ -71,11 +70,11 @@ resource "google_bigtable_gc_policy" "policy" {
 
 The following arguments are supported:
 
-* `table` - (Required) The name of the table.
+* `name` - (Required) The name of the table.
 
 * `instance_name` - (Required) The name of the Bigtable instance.
 
-* `column_family` - (Required) The name of the column family.
+* `family` - (Required) The name of the column family.
 
 * `project` - (Optional) The ID of the project in which the resource belongs. If it is not provided, the provider project is used.