Add taxonomy and policy_tag resources to data_catalog product

.changelog/4076.txt

@@ -0,0 +1,10 @@
+```release-note:new-resource
+`google_data_catalog_taxonomy`
+`google_data_catalog_policy_tag`
+`google_data_catalog_taxonomy_iam_binding`
+`google_data_catalog_taxonomy_iam_member`
+`google_data_catalog_taxonomy_iam_policy`
+`google_data_catalog_policy_tag_iam_binding`
+`google_data_catalog_policy_tag_iam_member`
+`google_data_catalog_policy_tag_iam_policy`
+```

website/docs/r/data_catalog_policy_tag.html.markdown

@@ -0,0 +1,164 @@
+---
+# ----------------------------------------------------------------------------
+#
+#     ***     AUTO GENERATED CODE    ***    AUTO GENERATED CODE     ***
+#
+# ----------------------------------------------------------------------------
+#
+#     This file is automatically generated by Magic Modules and manual
+#     changes will be clobbered when the file is regenerated.
+#
+#     Please read more about how to change this file in
+#     .github/CONTRIBUTING.md.
+#
+# ----------------------------------------------------------------------------
+subcategory: "Data catalog"
+layout: "google"
+page_title: "Google: google_data_catalog_policy_tag"
+sidebar_current: "docs-google-data-catalog-policy-tag"
+description: |-
+  Denotes one policy tag in a taxonomy.
+---
+
+# google\_data\_catalog\_policy\_tag
+
+Denotes one policy tag in a taxonomy.
+
+~> **Warning:** This resource is in beta, and should be used with the terraform-provider-google-beta provider.
+See [Provider Versions](https://terraform.io/docs/providers/google/guides/provider_versions.html) for more details on beta resources.
+
+To get more information about PolicyTag, see:
+
+* [API documentation](https://cloud.google.com/data-catalog/docs/reference/rest/v1beta1/projects.locations.taxonomies.policyTags)
+* How-to Guides
+    * [Official Documentation](https://cloud.google.com/data-catalog/docs)
+
+<div class = "oics-button" style="float: right; margin: 0 0 -15px">
+  <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=data_catalog_taxonomies_policy_tag_basic&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
+    <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
+  </a>
+</div>
+## Example Usage - Data Catalog Taxonomies Policy Tag Basic
+
+
+```hcl
+resource "google_data_catalog_policy_tag" "basic_policy_tag" {
+  provider = google-beta
+  taxonomy = google_data_catalog_taxonomy.my_taxonomy.id
+  display_name = "Low security"
+  description = "A policy tag normally associated with low security items"
+}
+
+resource "google_data_catalog_taxonomy" "my_taxonomy" {
+  provider = google-beta
+  region = "us"
+  display_name =  "taxonomy_display_name"
+  description = "A collection of policy tags"
+  activated_policy_types = ["FINE_GRAINED_ACCESS_CONTROL"]
+}
+```
+<div class = "oics-button" style="float: right; margin: 0 0 -15px">
+  <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=data_catalog_taxonomies_policy_tag_child_policies&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
+    <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
+  </a>
+</div>
+## Example Usage - Data Catalog Taxonomies Policy Tag Child Policies
+
+
+```hcl
+resource "google_data_catalog_policy_tag" "parent_policy" {
+  provider = google-beta
+  taxonomy = google_data_catalog_taxonomy.my_taxonomy.id
+  display_name = "High"
+  description = "A policy tag category used for high security access"
+}
+
+resource "google_data_catalog_policy_tag" "child_policy" {
+  provider = google-beta
+  taxonomy = google_data_catalog_taxonomy.my_taxonomy.id
+  display_name = "ssn"
+  description = "A hash of the users ssn"
+  parent_policy_tag = google_data_catalog_policy_tag.parent_policy.id
+}
+
+resource "google_data_catalog_policy_tag" "child_policy2" {
+  provider = google-beta
+  taxonomy = google_data_catalog_taxonomy.my_taxonomy.id
+  display_name = "dob"
+  description = "The users date of birth"
+  parent_policy_tag = google_data_catalog_policy_tag.parent_policy.id
+}
+
+resource "google_data_catalog_taxonomy" "my_taxonomy" {
+  provider = google-beta
+  region = "us"
+  display_name =  "taxonomy_display_name"
+  description = "A collection of policy tags"
+  activated_policy_types = ["FINE_GRAINED_ACCESS_CONTROL"]
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+
+* `display_name` -
+  (Required)
+  User defined name of this policy tag. It must: be unique within the parent
+  taxonomy; contain only unicode letters, numbers, underscores, dashes and spaces;
+  not start or end with spaces; and be at most 200 bytes long when encoded in UTF-8.
+
+* `taxonomy` -
+  (Required)
+  Taxonomy the policy tag is associated with
+
+
+- - -
+
+
+* `description` -
+  (Optional)
+  Description of this policy tag. It must: contain only unicode characters, tabs,
+  newlines, carriage returns and page breaks; and be at most 2000 bytes long when
+  encoded in UTF-8. If not set, defaults to an empty description.
+  If not set, defaults to an empty description.
+
+* `parent_policy_tag` -
+  (Optional)
+  Resource name of this policy tag's parent policy tag.
+  If empty, it means this policy tag is a top level policy tag.
+  If not set, defaults to an empty string.
+
+
+## Attributes Reference
+
+In addition to the arguments listed above, the following computed attributes are exported:
+
+* `id` - an identifier for the resource with format `{{name}}`
+
+* `name` -
+  Resource name of this policy tag, whose format is:
+  "projects/{project}/locations/{region}/taxonomies/{taxonomy}/policyTags/{policytag}"
+
+* `child_policy_tags` -
+  Resource names of child policy tags of this policy tag.
+
+
+## Timeouts
+
+This resource provides the following
+[Timeouts](/docs/configuration/resources.html#timeouts) configuration options:
+
+- `create` - Default is 4 minutes.
+- `update` - Default is 4 minutes.
+- `delete` - Default is 4 minutes.
+
+## Import
+
+
+PolicyTag can be imported using any of these accepted formats:
+
+```
+$ terraform import google_data_catalog_policy_tag.default {{name}}
+```

website/docs/r/data_catalog_policy_tag_iam.html.markdown

@@ -0,0 +1,133 @@
+---
+# ----------------------------------------------------------------------------
+#
+#     ***     AUTO GENERATED CODE    ***    AUTO GENERATED CODE     ***
+#
+# ----------------------------------------------------------------------------
+#
+#     This file is automatically generated by Magic Modules and manual
+#     changes will be clobbered when the file is regenerated.
+#
+#     Please read more about how to change this file in
+#     .github/CONTRIBUTING.md.
+#
+# ----------------------------------------------------------------------------
+subcategory: "Data catalog"
+layout: "google"
+page_title: "Google: google_data_catalog_policy_tag_iam"
+sidebar_current: "docs-google-data-catalog-policy-tag-iam"
+description: |-
+  Collection of resources to manage IAM policy for Data catalog PolicyTag
+---
+
+# IAM policy for Data catalog PolicyTag
+Three different resources help you manage your IAM policy for Data catalog PolicyTag. Each of these resources serves a different use case:
+
+* `google_data_catalog_policy_tag_iam_policy`: Authoritative. Sets the IAM policy for the policytag and replaces any existing policy already attached.
+* `google_data_catalog_policy_tag_iam_binding`: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the policytag are preserved.
+* `google_data_catalog_policy_tag_iam_member`: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the policytag are preserved.
+
+~> **Note:** `google_data_catalog_policy_tag_iam_policy` **cannot** be used in conjunction with `google_data_catalog_policy_tag_iam_binding` and `google_data_catalog_policy_tag_iam_member` or they will fight over what your policy should be.
+
+~> **Note:** `google_data_catalog_policy_tag_iam_binding` resources **can be** used in conjunction with `google_data_catalog_policy_tag_iam_member` resources **only if** they do not grant privilege to the same role.
+
+~> **Warning:** This resource is in beta, and should be used with the terraform-provider-google-beta provider.
+See [Provider Versions](https://terraform.io/docs/providers/google/guides/provider_versions.html) for more details on beta resources.
+
+
+## google\_data\_catalog\_policy\_tag\_iam\_policy
+
+```hcl
+data "google_iam_policy" "admin" {
+  binding {
+    role = "roles/viewer"
+    members = [
+      "user:[email protected]",
+    ]
+  }
+}
+
+resource "google_data_catalog_policy_tag_iam_policy" "policy" {
+  policy_tag = google_data_catalog_policy_tag.basic_policy_tag.name
+  policy_data = data.google_iam_policy.admin.policy_data
+}
+```
+
+## google\_data\_catalog\_policy\_tag\_iam\_binding
+
+```hcl
+resource "google_data_catalog_policy_tag_iam_binding" "binding" {
+  policy_tag = google_data_catalog_policy_tag.basic_policy_tag.name
+  role = "roles/viewer"
+  members = [
+    "user:[email protected]",
+  ]
+}
+```
+
+## google\_data\_catalog\_policy\_tag\_iam\_member
+
+```hcl
+resource "google_data_catalog_policy_tag_iam_member" "member" {
+  policy_tag = google_data_catalog_policy_tag.basic_policy_tag.name
+  role = "roles/viewer"
+  member = "user:[email protected]"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `policy_tag` - (Required) Used to find the parent resource to bind the IAM policy to
+
+* `member/members` - (Required) Identities that will be granted the privilege in `role`.
+  Each entry can have one of the following values:
+  * **allUsers**: A special identifier that represents anyone who is on the internet; with or without a Google account.
+  * **allAuthenticatedUsers**: A special identifier that represents anyone who is authenticated with a Google account or a service account.
+  * **user:{emailid}**: An email address that represents a specific Google account. For example, [email protected] or [email protected].
+  * **serviceAccount:{emailid}**: An email address that represents a service account. For example, [email protected].
+  * **group:{emailid}**: An email address that represents a Google group. For example, [email protected].
+  * **domain:{domain}**: A G Suite domain (primary, instead of alias) name that represents all the users of that domain. For example, google.com or example.com.
+
+* `role` - (Required) The role that should be applied. Only one
+    `google_data_catalog_policy_tag_iam_binding` can be used per role. Note that custom roles must be of the format
+    `[projects|organizations]/{parent-name}/roles/{role-name}`.
+
+* `policy_data` - (Required only by `google_data_catalog_policy_tag_iam_policy`) The policy data generated by
+  a `google_iam_policy` data source.
+
+## Attributes Reference
+
+In addition to the arguments listed above, the following computed attributes are
+exported:
+
+* `etag` - (Computed) The etag of the IAM policy.
+
+## Import
+
+For all import syntaxes, the "resource in question" can take any of the following forms:
+
+* {{policy_tag}}
+
+Any variables not passed in the import command will be taken from the provider configuration.
+
+Data catalog policytag IAM resources can be imported using the resource identifiers, role, and member.
+
+IAM member imports use space-delimited identifiers: the resource in question, the role, and the member identity, e.g.
+```
+$ terraform import google_data_catalog_policy_tag_iam_member.editor "{{policy_tag}} roles/viewer user:[email protected]"
+```
+
+IAM binding imports use space-delimited identifiers: the resource in question and the role, e.g.
+```
+$ terraform import google_data_catalog_policy_tag_iam_binding.editor "{{policy_tag}} roles/viewer"
+```
+
+IAM policy imports use the identifier of the resource in question, e.g.
+```
+$ terraform import google_data_catalog_policy_tag_iam_policy.editor {{policy_tag}}
+```
+
+-> **Custom Roles**: If you're importing a IAM resource with a custom role, make sure to use the
+ full name of the custom role, e.g. `[projects/my-project|organizations/my-org]/roles/my-custom-role`.