Added deletion_policy field in `google_secret_manager_secret_versio…

…n` resource (#8922) (#15818) * Added deletion_policy field in google_secret_manager_secret_version resource * added extra line at the end of secret_version custom import Signed-off-by: Modular Magician <[email protected]>
hashicorp · Sep 12, 2023 · 4e75ffb · 4e75ffb
1 parent eec6891
commit 4e75ffb
Show file tree

Hide file tree

Showing 4 changed files with 195 additions and 0 deletions.
diff --git a/.changelog/8922.txt b/.changelog/8922.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+secretmanager: added `deletion_policy` field to `google_secret_manager_secret_version` resource
+```
diff --git a/google/services/secretmanager/resource_secret_manager_secret_version.go b/google/services/secretmanager/resource_secret_manager_secret_version.go
@@ -105,6 +105,17 @@ func ResourceSecretManagerSecretVersion() *schema.Resource {
 				Computed:    true,
 				Description: `The version of the Secret.`,
 			},
+			"deletion_policy": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Default:  "DELETE",
+				Description: `The deletion policy for the secret version. Setting 'ABANDON' allows the resource
+to be abandoned rather than deleted. Setting 'DISABLE' allows the resource to be
+disabled rather than deleted. Default is 'DELETE'. Possible values are:
+  * DELETE
+  * DISABLE
+  * ABANDON`,
+			},
 		},
 		UseJSONNumber: true,
 	}
@@ -229,6 +240,13 @@ func resourceSecretManagerSecretVersionRead(d *schema.ResourceData, meta interfa
 		return nil
 	}
 
+	// Explicitly set virtual fields to default values if unset
+	if _, ok := d.GetOkExists("deletion_policy"); !ok {
+		if err := d.Set("deletion_policy", "DELETE"); err != nil {
+			return fmt.Errorf("Error setting deletion_policy: %s", err)
+		}
+	}
+
 	if err := d.Set("enabled", flattenSecretManagerSecretVersionEnabled(res["state"], d, config)); err != nil {
 		return fmt.Errorf("Error reading SecretVersion: %s", err)
 	}
@@ -278,6 +296,16 @@ func resourceSecretManagerSecretVersionDelete(d *schema.ResourceData, meta inter
 	}
 
 	var obj map[string]interface{}
+	deletionPolicy := d.Get("deletion_policy")
+
+	if deletionPolicy == "ABANDON" {
+		return nil
+	} else if deletionPolicy == "DISABLE" {
+		url, err = tpgresource.ReplaceVars(d, config, "{{SecretManagerBasePath}}{{name}}:disable")
+		if err != nil {
+			return err
+		}
+	}
 	log.Printf("[DEBUG] Deleting SecretVersion %q", d.Id())
 
 	// err == nil indicates that the billing_project value was found
@@ -328,6 +356,11 @@ func resourceSecretManagerSecretVersionImport(d *schema.ResourceData, meta inter
 		return nil, fmt.Errorf("Error setting version: %s", err)
 	}
 
+	// Explicitly set virtual fields to default values on import
+	if err := d.Set("deletion_policy", "DELETE"); err != nil {
+		return nil, fmt.Errorf("Error setting version: %s", err)
+	}
+
 	return []*schema.ResourceData{d}, nil
 }
 

diff --git a/google/services/secretmanager/resource_secret_manager_secret_version_generated_test.go b/google/services/secretmanager/resource_secret_manager_secret_version_generated_test.go
@@ -78,6 +78,102 @@ resource "google_secret_manager_secret_version" "secret-version-basic" {
 `, context)
 }
 
+func TestAccSecretManagerSecretVersion_secretVersionDeletionPolicyAbandonExample(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckSecretManagerSecretVersionDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecretManagerSecretVersion_secretVersionDeletionPolicyAbandonExample(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret_version.secret-version-deletion-policy",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"secret", "deletion_policy"},
+			},
+		},
+	})
+}
+
+func testAccSecretManagerSecretVersion_secretVersionDeletionPolicyAbandonExample(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "tf-test-secret-version%{random_suffix}"
+
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+}
+
+resource "google_secret_manager_secret_version" "secret-version-deletion-policy" {
+  secret = google_secret_manager_secret.secret-basic.id
+
+  secret_data = "tf-test-secret-data%{random_suffix}"
+  deletion_policy = "ABANDON"
+}
+`, context)
+}
+
+func TestAccSecretManagerSecretVersion_secretVersionDeletionPolicyDisableExample(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckSecretManagerSecretVersionDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecretManagerSecretVersion_secretVersionDeletionPolicyDisableExample(context),
+			},
+			{
+				ResourceName:            "google_secret_manager_secret_version.secret-version-deletion-policy",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"secret", "deletion_policy"},
+			},
+		},
+	})
+}
+
+func testAccSecretManagerSecretVersion_secretVersionDeletionPolicyDisableExample(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "tf-test-secret-version%{random_suffix}"
+
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+}
+
+resource "google_secret_manager_secret_version" "secret-version-deletion-policy" {
+  secret = google_secret_manager_secret.secret-basic.id
+
+  secret_data = "tf-test-secret-data%{random_suffix}"
+  deletion_policy = "DISABLE"
+}
+`, context)
+}
+
 func testAccCheckSecretManagerSecretVersionDestroyProducer(t *testing.T) func(s *terraform.State) error {
 	return func(s *terraform.State) error {
 		for name, rs := range s.RootModule().Resources {

diff --git a/website/docs/r/secret_manager_secret_version.html.markdown b/website/docs/r/secret_manager_secret_version.html.markdown
@@ -55,6 +55,62 @@ resource "google_secret_manager_secret_version" "secret-version-basic" {
   secret_data = "secret-data"
 }
 ```
+<div class = "oics-button" style="float: right; margin: 0 0 -15px">
+  <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=secret_version_deletion_policy_abandon&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
+    <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
+  </a>
+</div>
+## Example Usage - Secret Version Deletion Policy Abandon
+
+
+```hcl
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "secret-version"
+
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+}
+
+resource "google_secret_manager_secret_version" "secret-version-deletion-policy" {
+  secret = google_secret_manager_secret.secret-basic.id
+
+  secret_data = "secret-data"
+  deletion_policy = "ABANDON"
+}
+```
+<div class = "oics-button" style="float: right; margin: 0 0 -15px">
+  <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=secret_version_deletion_policy_disable&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
+    <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
+  </a>
+</div>
+## Example Usage - Secret Version Deletion Policy Disable
+
+
+```hcl
+resource "google_secret_manager_secret" "secret-basic" {
+  secret_id = "secret-version"
+
+  replication {
+    user_managed {
+      replicas {
+        location = "us-central1"
+      }
+    }
+  }
+}
+
+resource "google_secret_manager_secret_version" "secret-version-deletion-policy" {
+  secret = google_secret_manager_secret.secret-basic.id
+
+  secret_data = "secret-data"
+  deletion_policy = "DISABLE"
+}
+```
 
 ## Argument Reference
 
@@ -78,6 +134,13 @@ The following arguments are supported:
   (Optional)
   The current state of the SecretVersion.
 
+* `deletion_policy` - (Optional) The deletion policy for the secret version. Setting `ABANDON` allows the resource
+to be abandoned rather than deleted. Setting `DISABLE` allows the resource to be
+disabled rather than deleted. Default is `DELETE`. Possible values are:
+  * DELETE
+  * DISABLE
+  * ABANDON
+
 
 ## Attributes Reference