From 9359be5b619802edabba63911f399699ffa9c7e2 Mon Sep 17 00:00:00 2001 From: Modular Magician Date: Mon, 20 Mar 2023 21:37:53 +0000 Subject: [PATCH] Enable Log Analytics for logging_project_bucket_config resource (#7419) Signed-off-by: Modular Magician --- .changelog/7419.txt | 3 + google/resource_logging_bucket_config_test.go | 52 ++++ .../resource_logging_project_bucket_config.go | 289 +++++++++++++++++- ...ogging_project_bucket_config.html.markdown | 14 + 4 files changed, 357 insertions(+), 1 deletion(-) create mode 100644 .changelog/7419.txt diff --git a/.changelog/7419.txt b/.changelog/7419.txt new file mode 100644 index 00000000000..1f2c1efcb94 --- /dev/null +++ b/.changelog/7419.txt @@ -0,0 +1,3 @@ +```release-note:enhancement +logging: added `enable_analytics` field to `google_logging_project_bucket_config` +``` diff --git a/google/resource_logging_bucket_config_test.go b/google/resource_logging_bucket_config_test.go index a4c6cef644d..b0835738ada 100644 --- a/google/resource_logging_bucket_config_test.go +++ b/google/resource_logging_bucket_config_test.go @@ -86,6 +86,41 @@ func TestAccLoggingBucketConfigProject_basic(t *testing.T) { }) } +func TestAccLoggingBucketConfigProject_analyticsEnabled(t *testing.T) { + t.Parallel() + + context := map[string]interface{}{ + "random_suffix": RandString(t, 10), + "project_name": "tf-test-" + RandString(t, 10), + "org_id": GetTestOrgFromEnv(t), + } + + VcrTest(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: TestAccProviders, + Steps: []resource.TestStep{ + { + Config: testAccLoggingBucketConfigProject_analyticsEnabled(context, true), + }, + { + ResourceName: "google_logging_project_bucket_config.basic", + ImportState: true, + ImportStateVerify: true, + ImportStateVerifyIgnore: []string{"project"}, + }, + { + Config: testAccLoggingBucketConfigProject_analyticsEnabled(context, false), + }, + { + ResourceName: "google_logging_project_bucket_config.basic", + ImportState: true, + ImportStateVerify: true, + ImportStateVerifyIgnore: []string{"project"}, + }, + }, + }) +} + func TestAccLoggingBucketConfigProject_cmekSettings(t *testing.T) { t.Parallel() @@ -230,6 +265,23 @@ resource "google_logging_project_bucket_config" "basic" { `, context), retention, retention) } +func testAccLoggingBucketConfigProject_analyticsEnabled(context map[string]interface{}, analytics bool) string { + return fmt.Sprintf(Nprintf(` +resource "google_project" "default" { + project_id = "%{project_name}" + name = "%{project_name}" + org_id = "%{org_id}" +} + +resource "google_logging_project_bucket_config" "basic" { + project = google_project.default.name + location = "global" + enable_analytics = %t + bucket_id = "_Default" +} +`, context), analytics) +} + func testAccLoggingBucketConfigProject_preCmekSettings(context map[string]interface{}, keyRingName, cryptoKeyName, cryptoKeyNameUpdate string) string { return fmt.Sprintf(Nprintf(` resource "google_project" "default" { diff --git a/google/resource_logging_project_bucket_config.go b/google/resource_logging_project_bucket_config.go index d3bc3a1cbeb..84dbd74de95 100644 --- a/google/resource_logging_project_bucket_config.go +++ b/google/resource_logging_project_bucket_config.go @@ -2,6 +2,8 @@ package google import ( "fmt" + "log" + "strconv" "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" @@ -14,6 +16,88 @@ var loggingProjectBucketConfigSchema = map[string]*schema.Schema{ ForceNew: true, Description: `The parent project that contains the logging bucket.`, }, + "name": { + Type: schema.TypeString, + Computed: true, + Description: `The resource name of the bucket`, + }, + "location": { + Type: schema.TypeString, + Required: true, + ForceNew: true, + Description: `The location of the bucket.`, + }, + "bucket_id": { + Type: schema.TypeString, + Required: true, + ForceNew: true, + Description: `The name of the logging bucket. Logging automatically creates two log buckets: _Required and _Default.`, + }, + "description": { + Type: schema.TypeString, + Optional: true, + Computed: true, + Description: `An optional description for this bucket.`, + }, + "retention_days": { + Type: schema.TypeInt, + Optional: true, + Default: 30, + Description: `Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used.`, + }, + "enable_analytics": { + Type: schema.TypeBool, + Optional: true, + Description: `Enable log analytics for the bucket. Cannot be disabled once enabled.`, + DiffSuppressFunc: enableAnalyticsBackwardsChangeDiffSuppress, + }, + "lifecycle_state": { + Type: schema.TypeString, + Computed: true, + Description: `The bucket's lifecycle such as active or deleted.`, + }, + "cmek_settings": { + Type: schema.TypeList, + MaxItems: 1, + Optional: true, + Description: `The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed.`, + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + "name": { + Type: schema.TypeString, + Computed: true, + Description: `The resource name of the CMEK settings.`, + }, + "kms_key_name": { + Type: schema.TypeString, + Required: true, + Description: `The resource name for the configured Cloud KMS key. +KMS key name format: +"projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]" +To enable CMEK for the bucket, set this field to a valid kmsKeyName for which the associated service account has the required cloudkms.cryptoKeyEncrypterDecrypter roles assigned for the key. +The Cloud KMS key used by the bucket can be updated by changing the kmsKeyName to a new valid key name. Encryption operations that are in progress will be completed with the key that was in use when they started. Decryption operations will be completed using the key that was used at the time of encryption unless access to that key has been revoked. +See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/routing/managed-encryption-storage) for more information.`, + }, + "kms_key_version_name": { + Type: schema.TypeString, + Computed: true, + Description: `The CryptoKeyVersion resource name for the configured Cloud KMS key. +KMS key name format: +"projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]/cryptoKeyVersions/[VERSION]" +For example: +"projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key/cryptoKeyVersions/1" +This is a read-only field used to convey the specific configured CryptoKeyVersion of kms_key that has been configured. It will be populated in cases where the CMEK settings are bound to a single key version.`, + }, + "service_account_id": { + Type: schema.TypeString, + Computed: true, + Description: `The service account associated with a project for which CMEK will apply. +Before enabling CMEK for a logging bucket, you must first assign the cloudkms.cryptoKeyEncrypterDecrypter role to the service account associated with the project for which CMEK will apply. Use [v2.getCmekSettings](https://cloud.google.com/logging/docs/reference/v2/rest/v2/TopLevel/getCmekSettings#google.logging.v2.ConfigServiceV2.GetCmekSettings) to obtain the service account ID. +See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/routing/managed-encryption-storage) for more information.`, + }, + }, + }, + }, } func projectBucketConfigID(d *schema.ResourceData, config *Config) (string, error) { @@ -31,5 +115,208 @@ func projectBucketConfigID(d *schema.ResourceData, config *Config) (string, erro // Create Logging Bucket config func ResourceLoggingProjectBucketConfig() *schema.Resource { - return ResourceLoggingBucketConfig("project", loggingProjectBucketConfigSchema, projectBucketConfigID) + return &schema.Resource{ + Create: resourceLoggingProjectBucketConfigAcquireOrCreate("project", projectBucketConfigID), + Read: resourceLoggingProjectBucketConfigRead, + Update: resourceLoggingProjectBucketConfigUpdate, + Delete: resourceLoggingBucketConfigDelete, + Importer: &schema.ResourceImporter{ + State: resourceLoggingBucketConfigImportState("project"), + }, + Schema: loggingProjectBucketConfigSchema, + UseJSONNumber: true, + } +} + +func resourceLoggingProjectBucketConfigAcquireOrCreate(parentType string, iDFunc loggingBucketConfigIDFunc) func(*schema.ResourceData, interface{}) error { + return func(d *schema.ResourceData, meta interface{}) error { + config := meta.(*Config) + userAgent, err := generateUserAgentString(d, config.UserAgent) + if err != nil { + return err + } + + id, err := iDFunc(d, config) + if err != nil { + return err + } + + if parentType == "project" { + //logging bucket can be created only at the project level, in future api may allow for folder, org and other parent resources + + log.Printf("[DEBUG] Fetching logging bucket config: %#v", id) + url, err := replaceVars(d, config, fmt.Sprintf("{{LoggingBasePath}}%s", id)) + if err != nil { + return err + } + + res, _ := SendRequest(config, "GET", "", url, userAgent, nil) + if res == nil { + log.Printf("[DEGUG] Loggin Bucket not exist %s", id) + // we need to pass the id in here because we don't want to set it in state + // until we know there won't be any errors on create + return resourceLoggingProjectBucketConfigCreate(d, meta, id) + } + } + + d.SetId(id) + + return resourceLoggingProjectBucketConfigUpdate(d, meta) + } +} + +func resourceLoggingProjectBucketConfigCreate(d *schema.ResourceData, meta interface{}, id string) error { + config := meta.(*Config) + userAgent, err := generateUserAgentString(d, config.UserAgent) + if err != nil { + return err + } + + obj := make(map[string]interface{}) + obj["name"] = d.Get("name") + obj["description"] = d.Get("description") + obj["retentionDays"] = d.Get("retention_days") + obj["analyticsEnabled"] = d.Get("enable_analytics") + obj["locked"] = d.Get("locked") + obj["cmekSettings"] = expandCmekSettings(d.Get("cmek_settings")) + + url, err := replaceVars(d, config, "{{LoggingBasePath}}projects/{{project}}/locations/{{location}}/buckets?bucketId={{bucket_id}}") + if err != nil { + return err + } + + log.Printf("[DEBUG] Creating new Bucket: %#v", obj) + billingProject := "" + + project, err := getProject(d, config) + if err != nil { + return err + } + billingProject = project + + // err == nil indicates that the billing_project value was found + if bp, err := getBillingProject(d, config); err == nil { + billingProject = bp + } + + res, err := SendRequestWithTimeout(config, "POST", billingProject, url, userAgent, obj, d.Timeout(schema.TimeoutCreate)) + if err != nil { + return fmt.Errorf("Error creating Bucket: %s", err) + } + + d.SetId(id) + + log.Printf("[DEBUG] Finished creating Bucket %q: %#v", d.Id(), res) + + return resourceLoggingProjectBucketConfigRead(d, meta) +} + +func resourceLoggingProjectBucketConfigRead(d *schema.ResourceData, meta interface{}) error { + config := meta.(*Config) + userAgent, err := generateUserAgentString(d, config.UserAgent) + if err != nil { + return err + } + + log.Printf("[DEBUG] Fetching logging bucket config: %#v", d.Id()) + + url, err := replaceVars(d, config, fmt.Sprintf("{{LoggingBasePath}}%s", d.Id())) + if err != nil { + return err + } + + res, err := SendRequest(config, "GET", "", url, userAgent, nil) + if err != nil { + log.Printf("[WARN] Unable to acquire logging bucket config at %s", d.Id()) + + d.SetId("") + return err + } + + if err := d.Set("name", res["name"]); err != nil { + return fmt.Errorf("Error setting name: %s", err) + } + if err := d.Set("description", res["description"]); err != nil { + return fmt.Errorf("Error setting description: %s", err) + } + if err := d.Set("lifecycle_state", res["lifecycleState"]); err != nil { + return fmt.Errorf("Error setting lifecycle_state: %s", err) + } + if err := d.Set("retention_days", res["retentionDays"]); err != nil { + return fmt.Errorf("Error setting retention_days: %s", err) + } + if err := d.Set("enable_analytics", res["analyticsEnabled"]); err != nil { + return fmt.Errorf("Error setting enable_analytics: %s", err) + } + + if err := d.Set("cmek_settings", flattenCmekSettings(res["cmekSettings"])); err != nil { + return fmt.Errorf("Error setting cmek_settings: %s", err) + } + + return nil +} + +func resourceLoggingProjectBucketConfigUpdate(d *schema.ResourceData, meta interface{}) error { + config := meta.(*Config) + userAgent, err := generateUserAgentString(d, config.UserAgent) + if err != nil { + return err + } + + obj := make(map[string]interface{}) + + url, err := replaceVars(d, config, fmt.Sprintf("{{LoggingBasePath}}%s", d.Id())) + if err != nil { + return err + } + + updateMaskAnalytics := []string{} + // Check if analytics is being enabled. Analytics enablement is an atomic operation and can not be performed while other fields + // are being updated, so we enable analytics before updating the rest of the fields. + if d.HasChange("enable_analytics") { + obj["analyticsEnabled"] = d.Get("enable_analytics") + updateMaskAnalytics = append(updateMaskAnalytics, "analyticsEnabled") + url, err = addQueryParams(url, map[string]string{"updateMask": strings.Join(updateMaskAnalytics, ",")}) + if err != nil { + return err + } + _, err = SendRequestWithTimeout(config, "PATCH", "", url, userAgent, obj, d.Timeout(schema.TimeoutUpdate)) + if err != nil { + return fmt.Errorf("Error updating Logging Bucket Config %q: %s", d.Id(), err) + } + } + + obj["retentionDays"] = d.Get("retention_days") + obj["description"] = d.Get("description") + obj["cmekSettings"] = expandCmekSettings(d.Get("cmek_settings")) + updateMask := []string{} + if d.HasChange("retention_days") { + updateMask = append(updateMask, "retentionDays") + } + if d.HasChange("description") { + updateMask = append(updateMask, "description") + } + if d.HasChange("cmek_settings") { + updateMask = append(updateMask, "cmekSettings") + } + url, err = addQueryParams(url, map[string]string{"updateMask": strings.Join(updateMask, ",")}) + if err != nil { + return err + } + if len(updateMask) > 0 { + _, err = SendRequestWithTimeout(config, "PATCH", "", url, userAgent, obj, d.Timeout(schema.TimeoutUpdate)) + } + if err != nil { + return fmt.Errorf("Error updating Logging Bucket Config %q: %s", d.Id(), err) + } + + return resourceLoggingProjectBucketConfigRead(d, meta) +} + +func enableAnalyticsBackwardsChangeDiffSuppress(k, old, new string, d *schema.ResourceData) bool { + oldValue, _ := strconv.ParseBool(old) + if oldValue { + return true + } + return false } diff --git a/website/docs/r/logging_project_bucket_config.html.markdown b/website/docs/r/logging_project_bucket_config.html.markdown index 5af7c69d65c..33018c3e595 100644 --- a/website/docs/r/logging_project_bucket_config.html.markdown +++ b/website/docs/r/logging_project_bucket_config.html.markdown @@ -40,6 +40,18 @@ resource "google_logging_project_bucket_config" "basic" { } ``` +Create logging bucket with Log Analytics enabled + +```hcl +resource "google_logging_project_bucket_config" "analytics-enabled-bucket" { + project = "project_id" + location = "global" + retention_days = 30 + enable_analytics = true + bucket_id = "custom-bucket" +} +``` + Create logging bucket with customId and cmekSettings ```hcl @@ -95,6 +107,8 @@ The following arguments are supported: * `retention_days` - (Optional) Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. +* `enable_analytics` - (Optional) Whether or not Log Analytics is enabled. Logs for buckets with Log Analytics enabled can be queried in the **Log Analytics** page using SQL queries. Cannot be disabled once enabled. + * `cmek_settings` - (Optional) The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. Structure is [documented below](#nested_cmek_settings).