Skip to content

[DO NOT MERGE] Support IAM conditional policies on managed zones#16748

Draft
shellyvilenko wants to merge 23 commits intoGoogleCloudPlatform:mainfrom
shellyvilenko:managed-zones-conditions
Draft

[DO NOT MERGE] Support IAM conditional policies on managed zones#16748
shellyvilenko wants to merge 23 commits intoGoogleCloudPlatform:mainfrom
shellyvilenko:managed-zones-conditions

Conversation

@shellyvilenko
Copy link
Contributor

[DO NOT MERGE]
included iam_conditions_request_type: 'QUERY_PARAM_NESTED'

Support Iam conditional policies on dns managed zones

dns: added support for IAM conditions to `google_dns_managed_zone` resource

…Y_PARAM_NESTED'

included iam_conditions_request_type: 'QUERY_PARAM_NESTED' I think that QUERY_PARAM_NESTED is appropriate here because of the GetIamPolicyRequest
add example fort he conditions
Resolve conflicts
add usage of template to managedzone.yaml
add managed zone var to template
randomize dns name in tests
use randomized dns name in tests
The v1beta2 API requires all method paths to begin with dns/<version>/projects/ to maintain compatibility with legacy documentation . However, per-resource IAM methods (like setIamPolicy) require a different path format (dns/<version>/{+resource}) that breaks this requirement.
Add an UpdateMask field to the IamPolicy struct to allow resources to opt-in to sending the mask.
Modify the template to inject "updateMask": "bindings,etag,version" into the request body when UpdateMask is true.
enable update mask
 According to IAM internal documentation, conditional bindings are strictly prohibited for legacy "Basic" roles, which include roles/owner, roles/editor, and roles/viewer
Change the expression in dns_managed_zone_iam_condition.tf.tmpl to a single-line string to avoid newline-related parsing errors
try to use admin@hashicorptest.com instead of made up account
@modular-magician
Copy link
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 5 files changed, 792 insertions(+), 14 deletions(-))
google-beta provider: Diff ( 5 files changed, 792 insertions(+), 14 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 6 insertions(+))

@modular-magician
Copy link
Collaborator

Non-exercised tests

🔴 Tests were added that are skipped in VCR:

  • TestAccDNSManagedZoneIamBindingGenerated_withAndWithoutCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withAndWithoutCondition

Tests analytics

Total tests: 57
Passed tests: 51
Skipped tests: 3
Affected tests: 3

Click here to see the affected service packages
  • dns

Action taken

Found 3 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
  • TestAccDNSManagedZoneIamBindingGenerated
  • TestAccDNSManagedZoneIamMemberGenerated
  • TestAccDNSManagedZoneIamPolicyGenerated

Get to know how VCR tests work

@modular-magician
Copy link
Collaborator

🟢 Tests passed during RECORDING mode:
TestAccDNSManagedZoneIamBindingGenerated [Debug log]
TestAccDNSManagedZoneIamMemberGenerated [Debug log]
TestAccDNSManagedZoneIamPolicyGenerated [Debug log]

🟢 No issues found for passed tests after REPLAYING rerun.


🟢 All tests passed!

View the build log or the debug log for each test

@shellyvilenko shellyvilenko changed the title Support IAM conditional policies on managed zones [DO NOT MERGE] Support IAM conditional policies on managed zones Mar 18, 2026
@slevenick slevenick self-requested a review March 18, 2026 19:12
Copy link
Contributor

@slevenick slevenick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, waiting for API release to merge

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants