Add IAM resources for pubsub subscriptions (#1156)

* Add IAM resources for pubsub subscription

* Add documentation

* Refactored topic and subscription computed methods

* Add project field to documentation

* Addressed Dana's comments

google/iam_pubsub_subscription.go

@@ -0,0 +1,92 @@
+package google
+
+import (
+	"fmt"
+	"github.com/hashicorp/errwrap"
+	"github.com/hashicorp/terraform/helper/schema"
+	"google.golang.org/api/cloudresourcemanager/v1"
+	"google.golang.org/api/pubsub/v1"
+)
+
+var IamPubsubSubscriptionSchema = map[string]*schema.Schema{
+	"subscription": &schema.Schema{
+		Type:             schema.TypeString,
+		Required:         true,
+		ForceNew:         true,
+		DiffSuppressFunc: compareSelfLinkOrResourceName,
+	},
+	"project": &schema.Schema{
+		Type:     schema.TypeString,
+		Optional: true,
+		Computed: true,
+		ForceNew: true,
+	},
+}
+
+type PubsubSubscriptionIamUpdater struct {
+	subscription string
+	Config       *Config
+}
+
+func NewPubsubSubscriptionIamUpdater(d *schema.ResourceData, config *Config) (ResourceIamUpdater, error) {
+	project, err := getProject(d, config)
+	if err != nil {
+		return nil, err
+	}
+
+	subscription := getComputedSubscriptionName(project, d.Get("subscription").(string))
+
+	return &PubsubSubscriptionIamUpdater{
+		subscription: subscription,
+		Config:       config,
+	}, nil
+}
+
+func PubsubSubscriptionIdParseFunc(d *schema.ResourceData, _ *Config) error {
+	d.Set("subscription", d.Id())
+	return nil
+}
+
+func (u *PubsubSubscriptionIamUpdater) GetResourceIamPolicy() (*cloudresourcemanager.Policy, error) {
+	p, err := u.Config.clientPubsub.Projects.Subscriptions.GetIamPolicy(u.subscription).Do()
+
+	if err != nil {
+		return nil, fmt.Errorf("Error retrieving IAM policy for %s: %s", u.DescribeResource(), err)
+	}
+
+	v1Policy, err := pubsubToResourceManagerPolicy(p)
+	if err != nil {
+		return nil, err
+	}
+
+	return v1Policy, nil
+}
+
+func (u *PubsubSubscriptionIamUpdater) SetResourceIamPolicy(policy *cloudresourcemanager.Policy) error {
+	pubsubPolicy, err := resourceManagerToPubsubPolicy(policy)
+	if err != nil {
+		return err
+	}
+
+	_, err = u.Config.clientPubsub.Projects.Subscriptions.SetIamPolicy(u.subscription, &pubsub.SetIamPolicyRequest{
+		Policy: pubsubPolicy,
+	}).Do()
+
+	if err != nil {
+		return errwrap.Wrap(fmt.Errorf("Error setting IAM policy for %s.", u.DescribeResource()), err)
+	}
+
+	return nil
+}
+
+func (u *PubsubSubscriptionIamUpdater) GetResourceId() string {
+	return u.subscription
+}
+
+func (u *PubsubSubscriptionIamUpdater) GetMutexKey() string {
+	return fmt.Sprintf("iam-pubsub-subscription-%s", u.subscription)
+}
+
+func (u *PubsubSubscriptionIamUpdater) DescribeResource() string {
+	return fmt.Sprintf("pubsub subscription %q", u.subscription)
+}

google/provider.go

@@ -183,6 +183,9 @@ func Provider() terraform.ResourceProvider {
 			"google_pubsub_topic_iam_member":               ResourceIamMemberWithImport(IamPubsubTopicSchema, NewPubsubTopicIamUpdater, PubsubTopicIdParseFunc),
 			"google_pubsub_topic_iam_policy":               ResourceIamPolicyWithImport(IamPubsubTopicSchema, NewPubsubTopicIamUpdater, PubsubTopicIdParseFunc),
 			"google_pubsub_subscription":                   resourcePubsubSubscription(),
+			"google_pubsub_subscription_iam_binding":       ResourceIamBindingWithImport(IamPubsubSubscriptionSchema, NewPubsubSubscriptionIamUpdater, PubsubSubscriptionIdParseFunc),
+			"google_pubsub_subscription_iam_member":        ResourceIamMemberWithImport(IamPubsubSubscriptionSchema, NewPubsubSubscriptionIamUpdater, PubsubSubscriptionIdParseFunc),
+			"google_pubsub_subscription_iam_policy":        ResourceIamPolicyWithImport(IamPubsubSubscriptionSchema, NewPubsubSubscriptionIamUpdater, PubsubSubscriptionIdParseFunc),
 			"google_runtimeconfig_config":                  resourceRuntimeconfigConfig(),
 			"google_runtimeconfig_variable":                resourceRuntimeconfigVariable(),
 			"google_service_account":                       resourceGoogleServiceAccount(),

google/resource_pubsub_subscription.go

@@ -83,7 +83,7 @@ func resourcePubsubSubscriptionCreate(d *schema.ResourceData, meta interface{})
 		return err
 	}
 
-	name := fmt.Sprintf("projects/%s/subscriptions/%s", project, d.Get("name").(string))
+	name := getComputedSubscriptionName(project, d.Get("name").(string))
 	computed_topic_name := getComputedTopicName(project, d.Get("topic").(string))
 
 	//  process optional parameters
@@ -110,15 +110,20 @@ func resourcePubsubSubscriptionCreate(d *schema.ResourceData, meta interface{})
 	return resourcePubsubSubscriptionRead(d, meta)
 }
 
-func getComputedTopicName(project string, topic string) string {
+func getComputedTopicName(project, topic string) string {
-	computed_topic_name := ""
 	match, _ := regexp.MatchString("projects\\/.*\\/topics\\/.*", topic)
 	if match {
-		computed_topic_name = topic
+		return topic
-	} else {
-		computed_topic_name = fmt.Sprintf("projects/%s/topics/%s", project, topic)
 	}
-	return computed_topic_name
+	return fmt.Sprintf("projects/%s/topics/%s", project, topic)
+}
+
+func getComputedSubscriptionName(project, subscription string) string {
+	match, _ := regexp.MatchString("projects\\/.*\\/subscriptions\\/.*", subscription)
+	if match {
+		return subscription
+	}
+	return fmt.Sprintf("projects/%s/subscriptions/%s", project, subscription)
 }
 
 func resourcePubsubSubscriptionRead(d *schema.ResourceData, meta interface{}) error {
@@ -156,7 +161,7 @@ func resourcePubsubSubscriptionUpdate(d *schema.ResourceData, meta interface{})
 		}).Do()
 
 		if err != nil {
-			return fmt.Errorf("Error updating subscription '%s': %s", d.Get("name"), err)
+			return fmt.Errorf("Error updating subscription %q: %s", d.Get("name"), err)
 		}
 	}
 

google/resource_pubsub_subscription_iam_test.go

@@ -0,0 +1,246 @@
+package google
+
+import (
+	"fmt"
+	"github.com/hashicorp/terraform/helper/acctest"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+	"reflect"
+	"sort"
+	"testing"
+)
+
+func TestAccPubsubSubscriptionIamBinding(t *testing.T) {
+	t.Parallel()
+
+	topic := "test-topic-iam-" + acctest.RandString(10)
+	subscription := "test-subscription-iam-" + acctest.RandString(10)
+	account := "test-iam-" + acctest.RandString(10)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				// Test IAM Binding creation
+				Config: testAccPubsubSubscriptionIamBinding_basic(subscription, topic, account),
+				Check: testAccCheckPubsubSubscriptionIam(subscription, "roles/pubsub.subscriber", []string{
+					fmt.Sprintf("serviceAccount:%s-1@%s.iam.gserviceaccount.com", account, getTestProjectFromEnv()),
+				}),
+			},
+			{
+				// Test IAM Binding update
+				Config: testAccPubsubSubscriptionIamBinding_update(subscription, topic, account),
+				Check: testAccCheckPubsubSubscriptionIam(subscription, "roles/pubsub.subscriber", []string{
+					fmt.Sprintf("serviceAccount:%s-1@%s.iam.gserviceaccount.com", account, getTestProjectFromEnv()),
+					fmt.Sprintf("serviceAccount:%s-2@%s.iam.gserviceaccount.com", account, getTestProjectFromEnv()),
+				}),
+			},
+			{
+				ResourceName:  "google_pubsub_subscription_iam_binding.foo",
+				ImportStateId: fmt.Sprintf("%s roles/pubsub.subscriber", getComputedSubscriptionName(getTestProjectFromEnv(), subscription)),
+				ImportState:   true,
+			},
+		},
+	})
+}
+
+func TestAccPubsubSubscriptionIamMember(t *testing.T) {
+	t.Parallel()
+
+	topic := "test-topic-iam-" + acctest.RandString(10)
+	subscription := "test-subscription-iam-" + acctest.RandString(10)
+	account := "test-iam-" + acctest.RandString(10)
+	accountEmail := fmt.Sprintf("%s@%s.iam.gserviceaccount.com", account, getTestProjectFromEnv())
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				// Test Iam Member creation (no update for member, no need to test)
+				Config: testAccPubsubSubscriptionIamMember_basic(subscription, topic, account),
+				Check: testAccCheckPubsubSubscriptionIam(subscription, "roles/pubsub.subscriber", []string{
+					fmt.Sprintf("serviceAccount:%s", accountEmail),
+				}),
+			},
+			{
+				ResourceName:  "google_pubsub_subscription_iam_member.foo",
+				ImportStateId: fmt.Sprintf("%s roles/pubsub.subscriber serviceAccount:%s", getComputedSubscriptionName(getTestProjectFromEnv(), subscription), accountEmail),
+				ImportState:   true,
+			},
+		},
+	})
+}
+
+func TestAccPubsubSubscriptionIamPolicy(t *testing.T) {
+	t.Parallel()
+
+	topic := "test-topic-iam-" + acctest.RandString(10)
+	subscription := "test-subscription-iam-" + acctest.RandString(10)
+	account := "test-iam-" + acctest.RandString(10)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPubsubSubscriptionIamPolicy_basic(subscription, topic, account, "roles/pubsub.subscriber"),
+				Check: testAccCheckPubsubSubscriptionIam(subscription, "roles/pubsub.subscriber", []string{
+					fmt.Sprintf("serviceAccount:%s@%s.iam.gserviceaccount.com", account, getTestProjectFromEnv()),
+				}),
+			},
+			{
+				Config: testAccPubsubSubscriptionIamPolicy_basic(subscription, topic, account, "roles/pubsub.viewer"),
+				Check: testAccCheckPubsubSubscriptionIam(subscription, "roles/pubsub.subscriber", []string{
+					fmt.Sprintf("serviceAccount:%s@%s.iam.gserviceaccount.com", account, getTestProjectFromEnv()),
+				}),
+			},
+			{
+				ResourceName:  "google_pubsub_subscription_iam_policy.foo",
+				ImportStateId: getComputedSubscriptionName(getTestProjectFromEnv(), subscription),
+				ImportState:   true,
+			},
+		},
+	})
+}
+
+func testAccCheckPubsubSubscriptionIam(subscription, role string, members []string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		config := testAccProvider.Meta().(*Config)
+		p, err := config.clientPubsub.Projects.Subscriptions.GetIamPolicy(getComputedSubscriptionName(getTestProjectFromEnv(), subscription)).Do()
+		if err != nil {
+			return err
+		}
+
+		for _, binding := range p.Bindings {
+			if binding.Role == role {
+				sort.Strings(members)
+				sort.Strings(binding.Members)
+
+				if reflect.DeepEqual(members, binding.Members) {
+					return nil
+				}
+
+				return fmt.Errorf("Binding found but expected members is %v, got %v", members, binding.Members)
+			}
+		}
+
+		return fmt.Errorf("No binding for role %q", role)
+	}
+}
+
+func testAccPubsubSubscriptionIamBinding_basic(subscription, topic, account string) string {
+	return fmt.Sprintf(`
+resource "google_pubsub_topic" "topic" {
+  name = "%s"
+}
+
+resource "google_pubsub_subscription" "subscription" {
+  name  = "%s"
+  topic = "${google_pubsub_topic.topic.id}"
+}
+
+resource "google_service_account" "test-account-1" {
+  account_id   = "%s-1"
+  display_name = "Iam Testing Account"
+}
+
+resource "google_pubsub_subscription_iam_binding" "foo" {
+  subscription = "${google_pubsub_subscription.subscription.id}"
+  role         = "roles/pubsub.subscriber"
+  members      = [
+    "serviceAccount:${google_service_account.test-account-1.email}",
+  ]
+}
+`, topic, subscription, account)
+}
+
+func testAccPubsubSubscriptionIamBinding_update(subscription, topic, account string) string {
+	return fmt.Sprintf(`
+resource "google_pubsub_topic" "topic" {
+  name = "%s"
+}
+
+resource "google_pubsub_subscription" "subscription" {
+  name  = "%s"
+  topic = "${google_pubsub_topic.topic.id}"
+}
+
+
+resource "google_service_account" "test-account-1" {
+  account_id   = "%s-1"
+  display_name = "Iam Testing Account"
+}
+
+resource "google_service_account" "test-account-2" {
+  account_id   = "%s-2"
+  display_name = "Iam Testing Account"
+}
+
+resource "google_pubsub_subscription_iam_binding" "foo" {
+  subscription = "${google_pubsub_subscription.subscription.id}"
+  role         = "roles/pubsub.subscriber"
+  members      = [
+    "serviceAccount:${google_service_account.test-account-1.email}",
+    "serviceAccount:${google_service_account.test-account-2.email}",
+  ]
+}
+`, topic, subscription, account, account)
+}
+
+func testAccPubsubSubscriptionIamMember_basic(subscription, topic, account string) string {
+	return fmt.Sprintf(`
+resource "google_pubsub_topic" "topic" {
+  name = "%s"
+}
+
+resource "google_pubsub_subscription" "subscription" {
+  name  = "%s"
+  topic = "${google_pubsub_topic.topic.id}"
+}
+
+
+resource "google_service_account" "test-account" {
+  account_id   = "%s"
+  display_name = "Iam Testing Account"
+}
+
+resource "google_pubsub_subscription_iam_member" "foo" {
+  subscription = "${google_pubsub_subscription.subscription.id}"
+  role         = "roles/pubsub.subscriber"
+  member       = "serviceAccount:${google_service_account.test-account.email}"
+}
+`, topic, subscription, account)
+}
+
+func testAccPubsubSubscriptionIamPolicy_basic(subscription, topic, account, role string) string {
+	return fmt.Sprintf(`
+resource "google_pubsub_topic" "topic" {
+  name = "%s"
+}
+
+resource "google_pubsub_subscription" "subscription" {
+  name  = "%s"
+  topic = "${google_pubsub_topic.topic.id}"
+}
+
+
+resource "google_service_account" "test-account" {
+  account_id   = "%s"
+  display_name = "Iam Testing Account"
+}
+
+data "google_iam_policy" "foo" {
+	binding {
+		role    = "%s"
+		members = ["serviceAccount:${google_service_account.test-account.email}"]
+	}
+}
+
+resource "google_pubsub_subscription_iam_policy" "foo" {
+  subscription = "${google_pubsub_subscription.subscription.id}"
+  policy_data  = "${data.google_iam_policy.foo.policy_data}"
+}
+`, topic, subscription, account, role)
+}

website/docs/r/pubsub_subscription.html.markdown

@@ -1,7 +1,7 @@
 ---
 layout: "google"
 page_title: "Google: google_pubsub_subscription"
-sidebar_current: "docs-google-pubsub-subscription"
+sidebar_current: "docs-google-pubsub-subscription-x"
 description: |-
   Creates a subscription in Google's pubsub  queueing system
 ---

website/docs/r/pubsub_subscription_iam.html.markdown

@@ -0,0 +1,105 @@
+---
+layout: "google"
+page_title: "Google: google_pubsub_subscription_iam"
+sidebar_current: "docs-google-pubsub-subscription-iam"
+description: |-
+ Collection of resources to manage IAM policy for a Pubsub subscription.
+---
+
+# IAM policy for Pubsub Subscription
+
+Three different resources help you manage your IAM policy for pubsub subscription. Each of these resources serves a different use case:
+
+* `google_pubsub_subscription_iam_policy`: Authoritative. Sets the IAM policy for the subscription and replaces any existing policy already attached.
+* `google_pubsub_subscription_iam_binding`: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the subscription are preserved.
+* `google_pubsub_subscription_iam_member`: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the subscription are preserved.
+
+~> **Note:** `google_pubsub_subscription_iam_policy` **cannot** be used in conjunction with `google_pubsub_subscription_iam_binding` and `google_pubsub_subscription_iam_member` or they will fight over what your policy should be.
+
+~> **Note:** `google_pubsub_subscription_iam_binding` resources **can be** used in conjunction with `google_pubsub_subscription_iam_member` resources **only if** they do not grant privilege to the same role.
+
+## google\_pubsub\_subscription\_iam\_policy
+
+```hcl
+data "google_iam_policy" "admin" {
+  binding {
+    role    = "roles/editor"
+    members = [
+      "user:jane@example.com",
+    ]
+  }
+}
+
+resource "google_pubsub_subscription_iam_policy" "editor" {
+  subscription = "your-subscription-name"
+  policy_data  = "${data.google_iam_policy.admin.policy_data}"
+}
+```
+
+## google\_pubsub\_subscription\_iam\_binding
+
+```hcl
+resource "google_pubsub_subscription_iam_binding" "editor" {
+  subscription = "your-subscription-name"
+  role         = "roles/editor"
+  members      = [
+    "user:jane@example.com",
+  ]
+}
+```
+
+## google\_pubsub\_subscription\_iam\_member
+
+```hcl
+resource "google_pubsub_subscription_iam_member" "editor" {
+  subscription = "your-subscription-name"
+  role         = "roles/editor"
+  member       = "user:jane@example.com"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `subscription` - (Required) The subscription name or id to bind to attach IAM policy to.
+
+* `member/members` - (Required) Identities that will be granted the privilege in `role`.
+  Each entry can have one of the following values:
+  * **allUsers**: A special identifier that represents anyone who is on the internet; with or without a Google account.
+  * **allAuthenticatedUsers**: A special identifier that represents anyone who is authenticated with a Google account or a service account.
+  * **user:{emailid}**: An email address that represents a specific Google account. For example, alice@gmail.com or joe@example.com.
+  * **serviceAccount:{emailid}**: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com.
+  * **group:{emailid}**: An email address that represents a Google group. For example, admins@example.com.
+  * **domain:{domain}**: A Google Apps domain name that represents all the users of that domain. For example, google.com or example.com.
+
+* `role` - (Required) The role that should be applied. Only one
+    `google_pubsub_subscription_iam_binding` can be used per role. Note that custom roles must be of the format
+    `[projects|organizations]/{parent-name}/roles/{role-name}`.
+
+* `policy_data` - (Required only by `google_pubsub_subscription_iam_policy`) The policy data generated by
+  a `google_iam_policy` data source.
+
+- - -
+
+* `project` - (Optional) The project in which the resource belongs. If it
+    is not provided, the provider project is used.
+
+## Attributes Reference
+
+In addition to the arguments listed above, the following computed attributes are
+exported:
+
+* `etag` - (Computed) The etag of the subscription's IAM policy.
+
+## Import
+
+Pubsub subscription IAM resources can be imported using the project, subscription name, role and member.
+
+```
+$ terraform import google_pubsub_subscription_iam_policy.editor projects/{your-project-id}/subscriptions/{your-subscription-name}
+
+$ terraform import google_pubsub_subscription_iam_binding.editor "projects/{your-project-id}/subscriptions/{your-subscription-name} roles/editor"
+
+$ terraform import google_pubsub_subscription_iam_member.editor "projects/{your-project-id}/subscriptions/{your-subscription-name} roles/editor jane@example.com"
+```

website/docs/r/pubsub_topic_iam.html.markdown

@@ -95,9 +95,9 @@ exported:
 Pubsub topic IAM resources can be imported using the project, topic name, role and member.
 
 ```
-$ terraform import google_pubsub_topic_iam_policy.editor projects/{your-project-id}/topic/{your-topic-name}
+$ terraform import google_pubsub_topic_iam_policy.editor projects/{your-project-id}/topics/{your-topic-name}
 
-$ terraform import google_pubsub_topic_iam_binding.editor "projects/{your-project-id}/topic/{your-topic-name} roles/editor"
+$ terraform import google_pubsub_topic_iam_binding.editor "projects/{your-project-id}/topics/{your-topic-name} roles/editor"
 
-$ terraform import google_pubsub_topic_iam_member.editor "projects/{your-project-id}/topic/{your-topic-name} roles/editor jane@example.com"
+$ terraform import google_pubsub_topic_iam_member.editor "projects/{your-project-id}/topics/{your-topic-name} roles/editor jane@example.com"
 ```

website/google.erb

@@ -442,9 +442,18 @@
       <li<%= sidebar_current("docs-google-pubsub-topic-iam") %>>
         <a href="/docs/providers/google/r/pubsub_topic_iam.html">google_pubsub_topic_iam_policy</a>
       </li>
-      <li<%= sidebar_current("docs-google-pubsub-subscription") %>>
+      <li<%= sidebar_current("docs-google-pubsub-subscription-x") %>>
       <a href="/docs/providers/google/r/pubsub_subscription.html">google_pubsub_subscription</a>
       </li>
+      <li<%= sidebar_current("docs-google-pubsub-subscription-iam") %>>
+        <a href="/docs/providers/google/r/pubsub_subscription_iam.html">google_pubsub_subscription_iam_binding</a>
+      </li>
+      <li<%= sidebar_current("docs-google-pubsub-subscription-iam") %>>
+        <a href="/docs/providers/google/r/pubsub_subscription_iam.html">google_pubsub_subscription_iam_member</a>
+      </li>
+      <li<%= sidebar_current("docs-google-pubsub-subscription-iam") %>>
+        <a href="/docs/providers/google/r/pubsub_subscription_iam.html">google_pubsub_subscription_iam_policy</a>
+      </li>
     </ul>
     </li>