Add KMS support for the google_bigquery_connection resource

mmv1/products/bigqueryconnection/Connection.yaml

@@ -125,6 +125,23 @@ examples:
     primary_resource_id: "connection"
     vars:
       connection_id: "my-connection"
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'bigquery_connection_kms'
+    pull_external: true
+    primary_resource_id:
+      'bq-connection-cmek'
+    vars:
+      database_instance_name: 'my-database-instance'
+      username: 'user'
+      deletion_protection: 'true'
+      kms_key_ring: 'bq-connection'
+      kms_key_name: 'bq-key'
+    test_vars_overrides:
+      deletion_protection: 'false'
+    oics_vars_overrides:
+      deletion_protection: 'false'
+    ignore_read_extra:
+      - 'cloud_sql.0.credential'  # password removed
 properties:
   - !ruby/object:Api::Type::String
     name: name
@@ -164,6 +181,12 @@ properties:
     output: true
     description: |
       True if the connection has credential assigned.
+  - !ruby/object:Api::Type::String
+    name: 'kmsKeyName'
+    description: |
+      Optional. The Cloud KMS key that is used for encryption.
+
+      Example: projects/[kms_project_id]/locations/[region]/keyRings/[key_region]/cryptoKeys/[key]
   - !ruby/object:Api::Type::NestedObject
     name: 'cloudSql'
     description: Connection properties specific to the Cloud SQL.

mmv1/templates/terraform/examples/bigquery_connection_kms.tf.erb

@@ -0,0 +1,61 @@
+resource "google_sql_database_instance" "instance" {
+    name             = "<%= ctx[:vars]['database_instance_name'] %>"
+    database_version = "POSTGRES_11"
+    region           = "us-central1"
+    settings {
+		tier = "db-f1-micro"
+	}
+
+    deletion_protection  = "<%= ctx[:vars]['deletion_protection'] %>"
+}
+
+resource "google_sql_database" "db" {
+    instance = google_sql_database_instance.instance.name
+    name     = "db"
+}
+
+resource "random_password" "pwd" {
+    length = 16
+    special = false
+}
+
+resource "google_sql_user" "user" {
+    name = "<%= ctx[:vars]['username'] %>"
+    instance = google_sql_database_instance.instance.name
+    password = random_password.pwd.result
+}
+
+resource "google_bigquery_connection" "<%= ctx[:primary_resource_id] %>" {
+    friendly_name = "👋"
+    description   = "a riveting description"
+    location      = "US"
+    kms_key_name  = google_kms_crypto_key.default.id
+    cloud_sql {
+        instance_id = google_sql_database_instance.instance.connection_name
+        database    = google_sql_database.db.name
+        type        = "POSTGRES"
+        credential {
+          username = google_sql_user.user.name
+          password = google_sql_user.user.password
+        }
+    }
+}
+
+resource "google_kms_key_ring" "default" {
+    name     = "<%= ctx[:vars]['kms_key_ring'] %>"
+    location = "us"
+}
+
+resource "google_kms_crypto_key" "default" {
+    name     = "<%= ctx[:vars]['kms_key_name'] %>"
+    key_ring = google_kms_key_ring.default.id
+}
+
+data "google_project" "project" {
+}
+
+resource "google_kms_crypto_key_iam_member" "default" {
+    crypto_key_id = google_kms_crypto_key.default.id
+    member        = "serviceAccount:bq-${data.google_project.project.number}@bigquery-encryption.iam.gserviceaccount.com"
+    role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+}