Add support for Cloud IAP IAM bindings

[shosti]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

It would be useful to be able to manage IAM for Cloud IAP resources through Terraform. (IIUC, it's currently possible to manage IAM for IAP at the project level, but not at other resource levels.) The APIs in question are described at https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api .

New or Affected Resource(s)

• google_iap_web_iam_binding
• google_iap_web_iam_policy
• google_iap_web_iam_member
• google_iap_web_type_iam_binding
• google_iap_web_type_iam_policy
• google_iap_web_type_iam_member
• google_iap_web_service_iam_binding
• google_iap_web_service_iam_policy
• google_iap_web_service_iam_member
• google_iap_web_service_version_iam_binding
• google_iap_web_service_version_iam_policy
• google_iap_web_service_version_iam_member

Potential Terraform Configuration

# Propose what you think the configuration to take advantage of this feature should look like.
# We may not use it verbatim, but it's helpful in understanding your intent.

resource "google_iap_web_iam_member" "bob" {
  member  = "user:bob@example.com"
  project = "test-project"
}

References

• Feature Request: Support for Cloud Identity Aware Proxy in Compute Engine #444

[slevenick]

Most of these will be available in the next release!

https://github.com/terraform-providers/terraform-provider-google/blob/master/google/iam_iap_web_type_compute.go
https://github.com/terraform-providers/terraform-provider-google/blob/master/google/iam_iap_web.go
https://github.com/terraform-providers/terraform-provider-google/blob/master/google/iam_iap_web_backend_service.go
https://github.com/terraform-providers/terraform-provider-google/blob/master/google/iam_iap_web_type_app_engine.go

I ended up splitting out compute vs appengine IAP policies to support import and the different options.

Appengine version and service will come later, they need support for the base resources in Terraform so that we can have integration tests

[slevenick]

The other ones will be available in the next release. Via #4566

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!