mirror of
https://github.com/letic/terraform-provider-google.git
synced 2024-10-02 00:31:04 +00:00
Add IAM resources for pubsub subscriptions (#1156)
* Add IAM resources for pubsub subscription * Add documentation * Refactored topic and subscription computed methods * Add project field to documentation * Addressed Dana's comments
This commit is contained in:
parent
ae0d6d6992
commit
91c9e0851c
92
google/iam_pubsub_subscription.go
Normal file
92
google/iam_pubsub_subscription.go
Normal file
@ -0,0 +1,92 @@
|
|||||||
|
package google
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"github.com/hashicorp/errwrap"
|
||||||
|
"github.com/hashicorp/terraform/helper/schema"
|
||||||
|
"google.golang.org/api/cloudresourcemanager/v1"
|
||||||
|
"google.golang.org/api/pubsub/v1"
|
||||||
|
)
|
||||||
|
|
||||||
|
var IamPubsubSubscriptionSchema = map[string]*schema.Schema{
|
||||||
|
"subscription": &schema.Schema{
|
||||||
|
Type: schema.TypeString,
|
||||||
|
Required: true,
|
||||||
|
ForceNew: true,
|
||||||
|
DiffSuppressFunc: compareSelfLinkOrResourceName,
|
||||||
|
},
|
||||||
|
"project": &schema.Schema{
|
||||||
|
Type: schema.TypeString,
|
||||||
|
Optional: true,
|
||||||
|
Computed: true,
|
||||||
|
ForceNew: true,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
type PubsubSubscriptionIamUpdater struct {
|
||||||
|
subscription string
|
||||||
|
Config *Config
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewPubsubSubscriptionIamUpdater(d *schema.ResourceData, config *Config) (ResourceIamUpdater, error) {
|
||||||
|
project, err := getProject(d, config)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
subscription := getComputedSubscriptionName(project, d.Get("subscription").(string))
|
||||||
|
|
||||||
|
return &PubsubSubscriptionIamUpdater{
|
||||||
|
subscription: subscription,
|
||||||
|
Config: config,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func PubsubSubscriptionIdParseFunc(d *schema.ResourceData, _ *Config) error {
|
||||||
|
d.Set("subscription", d.Id())
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (u *PubsubSubscriptionIamUpdater) GetResourceIamPolicy() (*cloudresourcemanager.Policy, error) {
|
||||||
|
p, err := u.Config.clientPubsub.Projects.Subscriptions.GetIamPolicy(u.subscription).Do()
|
||||||
|
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("Error retrieving IAM policy for %s: %s", u.DescribeResource(), err)
|
||||||
|
}
|
||||||
|
|
||||||
|
v1Policy, err := pubsubToResourceManagerPolicy(p)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
return v1Policy, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (u *PubsubSubscriptionIamUpdater) SetResourceIamPolicy(policy *cloudresourcemanager.Policy) error {
|
||||||
|
pubsubPolicy, err := resourceManagerToPubsubPolicy(policy)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
_, err = u.Config.clientPubsub.Projects.Subscriptions.SetIamPolicy(u.subscription, &pubsub.SetIamPolicyRequest{
|
||||||
|
Policy: pubsubPolicy,
|
||||||
|
}).Do()
|
||||||
|
|
||||||
|
if err != nil {
|
||||||
|
return errwrap.Wrap(fmt.Errorf("Error setting IAM policy for %s.", u.DescribeResource()), err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (u *PubsubSubscriptionIamUpdater) GetResourceId() string {
|
||||||
|
return u.subscription
|
||||||
|
}
|
||||||
|
|
||||||
|
func (u *PubsubSubscriptionIamUpdater) GetMutexKey() string {
|
||||||
|
return fmt.Sprintf("iam-pubsub-subscription-%s", u.subscription)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (u *PubsubSubscriptionIamUpdater) DescribeResource() string {
|
||||||
|
return fmt.Sprintf("pubsub subscription %q", u.subscription)
|
||||||
|
}
|
@ -183,6 +183,9 @@ func Provider() terraform.ResourceProvider {
|
|||||||
"google_pubsub_topic_iam_member": ResourceIamMemberWithImport(IamPubsubTopicSchema, NewPubsubTopicIamUpdater, PubsubTopicIdParseFunc),
|
"google_pubsub_topic_iam_member": ResourceIamMemberWithImport(IamPubsubTopicSchema, NewPubsubTopicIamUpdater, PubsubTopicIdParseFunc),
|
||||||
"google_pubsub_topic_iam_policy": ResourceIamPolicyWithImport(IamPubsubTopicSchema, NewPubsubTopicIamUpdater, PubsubTopicIdParseFunc),
|
"google_pubsub_topic_iam_policy": ResourceIamPolicyWithImport(IamPubsubTopicSchema, NewPubsubTopicIamUpdater, PubsubTopicIdParseFunc),
|
||||||
"google_pubsub_subscription": resourcePubsubSubscription(),
|
"google_pubsub_subscription": resourcePubsubSubscription(),
|
||||||
|
"google_pubsub_subscription_iam_binding": ResourceIamBindingWithImport(IamPubsubSubscriptionSchema, NewPubsubSubscriptionIamUpdater, PubsubSubscriptionIdParseFunc),
|
||||||
|
"google_pubsub_subscription_iam_member": ResourceIamMemberWithImport(IamPubsubSubscriptionSchema, NewPubsubSubscriptionIamUpdater, PubsubSubscriptionIdParseFunc),
|
||||||
|
"google_pubsub_subscription_iam_policy": ResourceIamPolicyWithImport(IamPubsubSubscriptionSchema, NewPubsubSubscriptionIamUpdater, PubsubSubscriptionIdParseFunc),
|
||||||
"google_runtimeconfig_config": resourceRuntimeconfigConfig(),
|
"google_runtimeconfig_config": resourceRuntimeconfigConfig(),
|
||||||
"google_runtimeconfig_variable": resourceRuntimeconfigVariable(),
|
"google_runtimeconfig_variable": resourceRuntimeconfigVariable(),
|
||||||
"google_service_account": resourceGoogleServiceAccount(),
|
"google_service_account": resourceGoogleServiceAccount(),
|
||||||
|
@ -83,7 +83,7 @@ func resourcePubsubSubscriptionCreate(d *schema.ResourceData, meta interface{})
|
|||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
name := fmt.Sprintf("projects/%s/subscriptions/%s", project, d.Get("name").(string))
|
name := getComputedSubscriptionName(project, d.Get("name").(string))
|
||||||
computed_topic_name := getComputedTopicName(project, d.Get("topic").(string))
|
computed_topic_name := getComputedTopicName(project, d.Get("topic").(string))
|
||||||
|
|
||||||
// process optional parameters
|
// process optional parameters
|
||||||
@ -110,15 +110,20 @@ func resourcePubsubSubscriptionCreate(d *schema.ResourceData, meta interface{})
|
|||||||
return resourcePubsubSubscriptionRead(d, meta)
|
return resourcePubsubSubscriptionRead(d, meta)
|
||||||
}
|
}
|
||||||
|
|
||||||
func getComputedTopicName(project string, topic string) string {
|
func getComputedTopicName(project, topic string) string {
|
||||||
computed_topic_name := ""
|
|
||||||
match, _ := regexp.MatchString("projects\\/.*\\/topics\\/.*", topic)
|
match, _ := regexp.MatchString("projects\\/.*\\/topics\\/.*", topic)
|
||||||
if match {
|
if match {
|
||||||
computed_topic_name = topic
|
return topic
|
||||||
} else {
|
|
||||||
computed_topic_name = fmt.Sprintf("projects/%s/topics/%s", project, topic)
|
|
||||||
}
|
}
|
||||||
return computed_topic_name
|
return fmt.Sprintf("projects/%s/topics/%s", project, topic)
|
||||||
|
}
|
||||||
|
|
||||||
|
func getComputedSubscriptionName(project, subscription string) string {
|
||||||
|
match, _ := regexp.MatchString("projects\\/.*\\/subscriptions\\/.*", subscription)
|
||||||
|
if match {
|
||||||
|
return subscription
|
||||||
|
}
|
||||||
|
return fmt.Sprintf("projects/%s/subscriptions/%s", project, subscription)
|
||||||
}
|
}
|
||||||
|
|
||||||
func resourcePubsubSubscriptionRead(d *schema.ResourceData, meta interface{}) error {
|
func resourcePubsubSubscriptionRead(d *schema.ResourceData, meta interface{}) error {
|
||||||
@ -156,7 +161,7 @@ func resourcePubsubSubscriptionUpdate(d *schema.ResourceData, meta interface{})
|
|||||||
}).Do()
|
}).Do()
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return fmt.Errorf("Error updating subscription '%s': %s", d.Get("name"), err)
|
return fmt.Errorf("Error updating subscription %q: %s", d.Get("name"), err)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
246
google/resource_pubsub_subscription_iam_test.go
Normal file
246
google/resource_pubsub_subscription_iam_test.go
Normal file
@ -0,0 +1,246 @@
|
|||||||
|
package google
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"github.com/hashicorp/terraform/helper/acctest"
|
||||||
|
"github.com/hashicorp/terraform/helper/resource"
|
||||||
|
"github.com/hashicorp/terraform/terraform"
|
||||||
|
"reflect"
|
||||||
|
"sort"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestAccPubsubSubscriptionIamBinding(t *testing.T) {
|
||||||
|
t.Parallel()
|
||||||
|
|
||||||
|
topic := "test-topic-iam-" + acctest.RandString(10)
|
||||||
|
subscription := "test-subscription-iam-" + acctest.RandString(10)
|
||||||
|
account := "test-iam-" + acctest.RandString(10)
|
||||||
|
|
||||||
|
resource.Test(t, resource.TestCase{
|
||||||
|
PreCheck: func() { testAccPreCheck(t) },
|
||||||
|
Providers: testAccProviders,
|
||||||
|
Steps: []resource.TestStep{
|
||||||
|
{
|
||||||
|
// Test IAM Binding creation
|
||||||
|
Config: testAccPubsubSubscriptionIamBinding_basic(subscription, topic, account),
|
||||||
|
Check: testAccCheckPubsubSubscriptionIam(subscription, "roles/pubsub.subscriber", []string{
|
||||||
|
fmt.Sprintf("serviceAccount:%s-1@%s.iam.gserviceaccount.com", account, getTestProjectFromEnv()),
|
||||||
|
}),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
// Test IAM Binding update
|
||||||
|
Config: testAccPubsubSubscriptionIamBinding_update(subscription, topic, account),
|
||||||
|
Check: testAccCheckPubsubSubscriptionIam(subscription, "roles/pubsub.subscriber", []string{
|
||||||
|
fmt.Sprintf("serviceAccount:%s-1@%s.iam.gserviceaccount.com", account, getTestProjectFromEnv()),
|
||||||
|
fmt.Sprintf("serviceAccount:%s-2@%s.iam.gserviceaccount.com", account, getTestProjectFromEnv()),
|
||||||
|
}),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
ResourceName: "google_pubsub_subscription_iam_binding.foo",
|
||||||
|
ImportStateId: fmt.Sprintf("%s roles/pubsub.subscriber", getComputedSubscriptionName(getTestProjectFromEnv(), subscription)),
|
||||||
|
ImportState: true,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAccPubsubSubscriptionIamMember(t *testing.T) {
|
||||||
|
t.Parallel()
|
||||||
|
|
||||||
|
topic := "test-topic-iam-" + acctest.RandString(10)
|
||||||
|
subscription := "test-subscription-iam-" + acctest.RandString(10)
|
||||||
|
account := "test-iam-" + acctest.RandString(10)
|
||||||
|
accountEmail := fmt.Sprintf("%s@%s.iam.gserviceaccount.com", account, getTestProjectFromEnv())
|
||||||
|
|
||||||
|
resource.Test(t, resource.TestCase{
|
||||||
|
PreCheck: func() { testAccPreCheck(t) },
|
||||||
|
Providers: testAccProviders,
|
||||||
|
Steps: []resource.TestStep{
|
||||||
|
{
|
||||||
|
// Test Iam Member creation (no update for member, no need to test)
|
||||||
|
Config: testAccPubsubSubscriptionIamMember_basic(subscription, topic, account),
|
||||||
|
Check: testAccCheckPubsubSubscriptionIam(subscription, "roles/pubsub.subscriber", []string{
|
||||||
|
fmt.Sprintf("serviceAccount:%s", accountEmail),
|
||||||
|
}),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
ResourceName: "google_pubsub_subscription_iam_member.foo",
|
||||||
|
ImportStateId: fmt.Sprintf("%s roles/pubsub.subscriber serviceAccount:%s", getComputedSubscriptionName(getTestProjectFromEnv(), subscription), accountEmail),
|
||||||
|
ImportState: true,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAccPubsubSubscriptionIamPolicy(t *testing.T) {
|
||||||
|
t.Parallel()
|
||||||
|
|
||||||
|
topic := "test-topic-iam-" + acctest.RandString(10)
|
||||||
|
subscription := "test-subscription-iam-" + acctest.RandString(10)
|
||||||
|
account := "test-iam-" + acctest.RandString(10)
|
||||||
|
|
||||||
|
resource.Test(t, resource.TestCase{
|
||||||
|
PreCheck: func() { testAccPreCheck(t) },
|
||||||
|
Providers: testAccProviders,
|
||||||
|
Steps: []resource.TestStep{
|
||||||
|
{
|
||||||
|
Config: testAccPubsubSubscriptionIamPolicy_basic(subscription, topic, account, "roles/pubsub.subscriber"),
|
||||||
|
Check: testAccCheckPubsubSubscriptionIam(subscription, "roles/pubsub.subscriber", []string{
|
||||||
|
fmt.Sprintf("serviceAccount:%s@%s.iam.gserviceaccount.com", account, getTestProjectFromEnv()),
|
||||||
|
}),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Config: testAccPubsubSubscriptionIamPolicy_basic(subscription, topic, account, "roles/pubsub.viewer"),
|
||||||
|
Check: testAccCheckPubsubSubscriptionIam(subscription, "roles/pubsub.subscriber", []string{
|
||||||
|
fmt.Sprintf("serviceAccount:%s@%s.iam.gserviceaccount.com", account, getTestProjectFromEnv()),
|
||||||
|
}),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
ResourceName: "google_pubsub_subscription_iam_policy.foo",
|
||||||
|
ImportStateId: getComputedSubscriptionName(getTestProjectFromEnv(), subscription),
|
||||||
|
ImportState: true,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func testAccCheckPubsubSubscriptionIam(subscription, role string, members []string) resource.TestCheckFunc {
|
||||||
|
return func(s *terraform.State) error {
|
||||||
|
config := testAccProvider.Meta().(*Config)
|
||||||
|
p, err := config.clientPubsub.Projects.Subscriptions.GetIamPolicy(getComputedSubscriptionName(getTestProjectFromEnv(), subscription)).Do()
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, binding := range p.Bindings {
|
||||||
|
if binding.Role == role {
|
||||||
|
sort.Strings(members)
|
||||||
|
sort.Strings(binding.Members)
|
||||||
|
|
||||||
|
if reflect.DeepEqual(members, binding.Members) {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
return fmt.Errorf("Binding found but expected members is %v, got %v", members, binding.Members)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return fmt.Errorf("No binding for role %q", role)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func testAccPubsubSubscriptionIamBinding_basic(subscription, topic, account string) string {
|
||||||
|
return fmt.Sprintf(`
|
||||||
|
resource "google_pubsub_topic" "topic" {
|
||||||
|
name = "%s"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_pubsub_subscription" "subscription" {
|
||||||
|
name = "%s"
|
||||||
|
topic = "${google_pubsub_topic.topic.id}"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_service_account" "test-account-1" {
|
||||||
|
account_id = "%s-1"
|
||||||
|
display_name = "Iam Testing Account"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_pubsub_subscription_iam_binding" "foo" {
|
||||||
|
subscription = "${google_pubsub_subscription.subscription.id}"
|
||||||
|
role = "roles/pubsub.subscriber"
|
||||||
|
members = [
|
||||||
|
"serviceAccount:${google_service_account.test-account-1.email}",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
`, topic, subscription, account)
|
||||||
|
}
|
||||||
|
|
||||||
|
func testAccPubsubSubscriptionIamBinding_update(subscription, topic, account string) string {
|
||||||
|
return fmt.Sprintf(`
|
||||||
|
resource "google_pubsub_topic" "topic" {
|
||||||
|
name = "%s"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_pubsub_subscription" "subscription" {
|
||||||
|
name = "%s"
|
||||||
|
topic = "${google_pubsub_topic.topic.id}"
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
resource "google_service_account" "test-account-1" {
|
||||||
|
account_id = "%s-1"
|
||||||
|
display_name = "Iam Testing Account"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_service_account" "test-account-2" {
|
||||||
|
account_id = "%s-2"
|
||||||
|
display_name = "Iam Testing Account"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_pubsub_subscription_iam_binding" "foo" {
|
||||||
|
subscription = "${google_pubsub_subscription.subscription.id}"
|
||||||
|
role = "roles/pubsub.subscriber"
|
||||||
|
members = [
|
||||||
|
"serviceAccount:${google_service_account.test-account-1.email}",
|
||||||
|
"serviceAccount:${google_service_account.test-account-2.email}",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
`, topic, subscription, account, account)
|
||||||
|
}
|
||||||
|
|
||||||
|
func testAccPubsubSubscriptionIamMember_basic(subscription, topic, account string) string {
|
||||||
|
return fmt.Sprintf(`
|
||||||
|
resource "google_pubsub_topic" "topic" {
|
||||||
|
name = "%s"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_pubsub_subscription" "subscription" {
|
||||||
|
name = "%s"
|
||||||
|
topic = "${google_pubsub_topic.topic.id}"
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
resource "google_service_account" "test-account" {
|
||||||
|
account_id = "%s"
|
||||||
|
display_name = "Iam Testing Account"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_pubsub_subscription_iam_member" "foo" {
|
||||||
|
subscription = "${google_pubsub_subscription.subscription.id}"
|
||||||
|
role = "roles/pubsub.subscriber"
|
||||||
|
member = "serviceAccount:${google_service_account.test-account.email}"
|
||||||
|
}
|
||||||
|
`, topic, subscription, account)
|
||||||
|
}
|
||||||
|
|
||||||
|
func testAccPubsubSubscriptionIamPolicy_basic(subscription, topic, account, role string) string {
|
||||||
|
return fmt.Sprintf(`
|
||||||
|
resource "google_pubsub_topic" "topic" {
|
||||||
|
name = "%s"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_pubsub_subscription" "subscription" {
|
||||||
|
name = "%s"
|
||||||
|
topic = "${google_pubsub_topic.topic.id}"
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
resource "google_service_account" "test-account" {
|
||||||
|
account_id = "%s"
|
||||||
|
display_name = "Iam Testing Account"
|
||||||
|
}
|
||||||
|
|
||||||
|
data "google_iam_policy" "foo" {
|
||||||
|
binding {
|
||||||
|
role = "%s"
|
||||||
|
members = ["serviceAccount:${google_service_account.test-account.email}"]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_pubsub_subscription_iam_policy" "foo" {
|
||||||
|
subscription = "${google_pubsub_subscription.subscription.id}"
|
||||||
|
policy_data = "${data.google_iam_policy.foo.policy_data}"
|
||||||
|
}
|
||||||
|
`, topic, subscription, account, role)
|
||||||
|
}
|
@ -1,7 +1,7 @@
|
|||||||
---
|
---
|
||||||
layout: "google"
|
layout: "google"
|
||||||
page_title: "Google: google_pubsub_subscription"
|
page_title: "Google: google_pubsub_subscription"
|
||||||
sidebar_current: "docs-google-pubsub-subscription"
|
sidebar_current: "docs-google-pubsub-subscription-x"
|
||||||
description: |-
|
description: |-
|
||||||
Creates a subscription in Google's pubsub queueing system
|
Creates a subscription in Google's pubsub queueing system
|
||||||
---
|
---
|
||||||
|
105
website/docs/r/pubsub_subscription_iam.html.markdown
Normal file
105
website/docs/r/pubsub_subscription_iam.html.markdown
Normal file
@ -0,0 +1,105 @@
|
|||||||
|
---
|
||||||
|
layout: "google"
|
||||||
|
page_title: "Google: google_pubsub_subscription_iam"
|
||||||
|
sidebar_current: "docs-google-pubsub-subscription-iam"
|
||||||
|
description: |-
|
||||||
|
Collection of resources to manage IAM policy for a Pubsub subscription.
|
||||||
|
---
|
||||||
|
|
||||||
|
# IAM policy for Pubsub Subscription
|
||||||
|
|
||||||
|
Three different resources help you manage your IAM policy for pubsub subscription. Each of these resources serves a different use case:
|
||||||
|
|
||||||
|
* `google_pubsub_subscription_iam_policy`: Authoritative. Sets the IAM policy for the subscription and replaces any existing policy already attached.
|
||||||
|
* `google_pubsub_subscription_iam_binding`: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the subscription are preserved.
|
||||||
|
* `google_pubsub_subscription_iam_member`: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the subscription are preserved.
|
||||||
|
|
||||||
|
~> **Note:** `google_pubsub_subscription_iam_policy` **cannot** be used in conjunction with `google_pubsub_subscription_iam_binding` and `google_pubsub_subscription_iam_member` or they will fight over what your policy should be.
|
||||||
|
|
||||||
|
~> **Note:** `google_pubsub_subscription_iam_binding` resources **can be** used in conjunction with `google_pubsub_subscription_iam_member` resources **only if** they do not grant privilege to the same role.
|
||||||
|
|
||||||
|
## google\_pubsub\_subscription\_iam\_policy
|
||||||
|
|
||||||
|
```hcl
|
||||||
|
data "google_iam_policy" "admin" {
|
||||||
|
binding {
|
||||||
|
role = "roles/editor"
|
||||||
|
members = [
|
||||||
|
"user:jane@example.com",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_pubsub_subscription_iam_policy" "editor" {
|
||||||
|
subscription = "your-subscription-name"
|
||||||
|
policy_data = "${data.google_iam_policy.admin.policy_data}"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
## google\_pubsub\_subscription\_iam\_binding
|
||||||
|
|
||||||
|
```hcl
|
||||||
|
resource "google_pubsub_subscription_iam_binding" "editor" {
|
||||||
|
subscription = "your-subscription-name"
|
||||||
|
role = "roles/editor"
|
||||||
|
members = [
|
||||||
|
"user:jane@example.com",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
## google\_pubsub\_subscription\_iam\_member
|
||||||
|
|
||||||
|
```hcl
|
||||||
|
resource "google_pubsub_subscription_iam_member" "editor" {
|
||||||
|
subscription = "your-subscription-name"
|
||||||
|
role = "roles/editor"
|
||||||
|
member = "user:jane@example.com"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
## Argument Reference
|
||||||
|
|
||||||
|
The following arguments are supported:
|
||||||
|
|
||||||
|
* `subscription` - (Required) The subscription name or id to bind to attach IAM policy to.
|
||||||
|
|
||||||
|
* `member/members` - (Required) Identities that will be granted the privilege in `role`.
|
||||||
|
Each entry can have one of the following values:
|
||||||
|
* **allUsers**: A special identifier that represents anyone who is on the internet; with or without a Google account.
|
||||||
|
* **allAuthenticatedUsers**: A special identifier that represents anyone who is authenticated with a Google account or a service account.
|
||||||
|
* **user:{emailid}**: An email address that represents a specific Google account. For example, alice@gmail.com or joe@example.com.
|
||||||
|
* **serviceAccount:{emailid}**: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com.
|
||||||
|
* **group:{emailid}**: An email address that represents a Google group. For example, admins@example.com.
|
||||||
|
* **domain:{domain}**: A Google Apps domain name that represents all the users of that domain. For example, google.com or example.com.
|
||||||
|
|
||||||
|
* `role` - (Required) The role that should be applied. Only one
|
||||||
|
`google_pubsub_subscription_iam_binding` can be used per role. Note that custom roles must be of the format
|
||||||
|
`[projects|organizations]/{parent-name}/roles/{role-name}`.
|
||||||
|
|
||||||
|
* `policy_data` - (Required only by `google_pubsub_subscription_iam_policy`) The policy data generated by
|
||||||
|
a `google_iam_policy` data source.
|
||||||
|
|
||||||
|
- - -
|
||||||
|
|
||||||
|
* `project` - (Optional) The project in which the resource belongs. If it
|
||||||
|
is not provided, the provider project is used.
|
||||||
|
|
||||||
|
## Attributes Reference
|
||||||
|
|
||||||
|
In addition to the arguments listed above, the following computed attributes are
|
||||||
|
exported:
|
||||||
|
|
||||||
|
* `etag` - (Computed) The etag of the subscription's IAM policy.
|
||||||
|
|
||||||
|
## Import
|
||||||
|
|
||||||
|
Pubsub subscription IAM resources can be imported using the project, subscription name, role and member.
|
||||||
|
|
||||||
|
```
|
||||||
|
$ terraform import google_pubsub_subscription_iam_policy.editor projects/{your-project-id}/subscriptions/{your-subscription-name}
|
||||||
|
|
||||||
|
$ terraform import google_pubsub_subscription_iam_binding.editor "projects/{your-project-id}/subscriptions/{your-subscription-name} roles/editor"
|
||||||
|
|
||||||
|
$ terraform import google_pubsub_subscription_iam_member.editor "projects/{your-project-id}/subscriptions/{your-subscription-name} roles/editor jane@example.com"
|
||||||
|
```
|
@ -95,9 +95,9 @@ exported:
|
|||||||
Pubsub topic IAM resources can be imported using the project, topic name, role and member.
|
Pubsub topic IAM resources can be imported using the project, topic name, role and member.
|
||||||
|
|
||||||
```
|
```
|
||||||
$ terraform import google_pubsub_topic_iam_policy.editor projects/{your-project-id}/topic/{your-topic-name}
|
$ terraform import google_pubsub_topic_iam_policy.editor projects/{your-project-id}/topics/{your-topic-name}
|
||||||
|
|
||||||
$ terraform import google_pubsub_topic_iam_binding.editor "projects/{your-project-id}/topic/{your-topic-name} roles/editor"
|
$ terraform import google_pubsub_topic_iam_binding.editor "projects/{your-project-id}/topics/{your-topic-name} roles/editor"
|
||||||
|
|
||||||
$ terraform import google_pubsub_topic_iam_member.editor "projects/{your-project-id}/topic/{your-topic-name} roles/editor jane@example.com"
|
$ terraform import google_pubsub_topic_iam_member.editor "projects/{your-project-id}/topics/{your-topic-name} roles/editor jane@example.com"
|
||||||
```
|
```
|
@ -442,9 +442,18 @@
|
|||||||
<li<%= sidebar_current("docs-google-pubsub-topic-iam") %>>
|
<li<%= sidebar_current("docs-google-pubsub-topic-iam") %>>
|
||||||
<a href="/docs/providers/google/r/pubsub_topic_iam.html">google_pubsub_topic_iam_policy</a>
|
<a href="/docs/providers/google/r/pubsub_topic_iam.html">google_pubsub_topic_iam_policy</a>
|
||||||
</li>
|
</li>
|
||||||
<li<%= sidebar_current("docs-google-pubsub-subscription") %>>
|
<li<%= sidebar_current("docs-google-pubsub-subscription-x") %>>
|
||||||
<a href="/docs/providers/google/r/pubsub_subscription.html">google_pubsub_subscription</a>
|
<a href="/docs/providers/google/r/pubsub_subscription.html">google_pubsub_subscription</a>
|
||||||
</li>
|
</li>
|
||||||
|
<li<%= sidebar_current("docs-google-pubsub-subscription-iam") %>>
|
||||||
|
<a href="/docs/providers/google/r/pubsub_subscription_iam.html">google_pubsub_subscription_iam_binding</a>
|
||||||
|
</li>
|
||||||
|
<li<%= sidebar_current("docs-google-pubsub-subscription-iam") %>>
|
||||||
|
<a href="/docs/providers/google/r/pubsub_subscription_iam.html">google_pubsub_subscription_iam_member</a>
|
||||||
|
</li>
|
||||||
|
<li<%= sidebar_current("docs-google-pubsub-subscription-iam") %>>
|
||||||
|
<a href="/docs/providers/google/r/pubsub_subscription_iam.html">google_pubsub_subscription_iam_policy</a>
|
||||||
|
</li>
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user