[Spanner IAM] Add condition support for google_spanner_database_iam resources

[dtest]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

Cloud Spanner Fine Grained Access Control (FGAC) requires an IAM condition to be able to enable using role-based authentication.

The google_spanner_database_iam_* resources should allow for a condition argument to be able to configure FGAC using Terraform.

The google_project_iam_* resources allow for a condition argument like this:

resource "google_project_iam_binding" "project" {
  project = "your-project-id"
  role    = "roles/container.admin"

  members = [
    "user:[email protected]",
  ]

  condition {
    title       = "expires_after_2019_12_31"
    description = "Expiring at midnight of 2019-12-31"
    expression  = "request.time < timestamp(\"2020-01-01T00:00:00Z\")"
  }
}

New or Affected Resource(s)

• google_spanner_database_iam_member
• google_spanner_database_iam_policy
• google_spanner_database_iam_binding

Potential Terraform Configuration

# Propose what you think the configuration to take advantage of this feature should look like.
# We may not use it verbatim, but it's helpful in understanding your intent.

# Example for google_spanner_database_iam_binding. Others would be similar
resource "google_spanner_database_iam_binding" "role_iam" {
  instance = "spanner-instance"
  database = "spanner-database"
  project = var.project_id
  role     = "roles/spanner.databaseRoleUser"

  members = [
    "serviceAccount:${google_service_account.serviceaccount.email}"
  ]

  condition {
    title       = "My Role"
    description = "Grant permissions on my_role"
    expression  = "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))"
  }
}

References

• google_spanner_database_iam_member do not support conditions argument #13791 was opened previously but was closed for inactivity.
• Spanner RBAC blog
• Spanner FGAC doc
• google_project_iam condition examples

[trodge]

b/280103323

[rahul2393]

@dtest google_spanner_database_iam_member supports setting the condition already, and we do have tests to validate it https://github.com/hashicorp/terraform-provider-google/blob/main/google/services/spanner/iam_spanner_database_test.go#L211-L223

[melinath]

leaving open since the docs aren't updated & the PR above will close this once merged.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.