Add support for is_secret_data_base64 in secret_version and secret_…

…version_access datasources for global and regional stacks (GoogleCloudPlatform#11877)
BBBmau · Oct 23, 2024 · 91c34d3 · 91c34d3
1 parent 94719e4
commit 91c34d3
Show file tree

Hide file tree

Showing 12 changed files with 338 additions and 40 deletions.
diff --git a/...third_party/terraform/services/secretmanager/data_source_secret_manager_secret_version.go b/...third_party/terraform/services/secretmanager/data_source_secret_manager_secret_version.go
@@ -52,6 +52,11 @@ func DataSourceSecretManagerSecretVersion() *schema.Resource {
 				Computed:  true,
 				Sensitive: true,
 			},
+			"is_secret_data_base64": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
 		},
 	}
 }
@@ -147,11 +152,17 @@ func dataSourceSecretManagerSecretVersionRead(d *schema.ResourceData, meta inter
 	}
 
 	data := resp["payload"].(map[string]interface{})
-	secretData, err := base64.StdEncoding.DecodeString(data["data"].(string))
-	if err != nil {
-		return fmt.Errorf("Error decoding secret manager secret version data: %s", err.Error())
+	var secretData string
+	if d.Get("is_secret_data_base64").(bool) {
+		secretData = data["data"].(string)
+	} else {
+		payloadData, err := base64.StdEncoding.DecodeString(data["data"].(string))
+		if err != nil {
+			return fmt.Errorf("error decoding secret manager secret version data: %s", err.Error())
+		}
+		secretData = string(payloadData)
 	}
-	if err := d.Set("secret_data", string(secretData)); err != nil {
+	if err := d.Set("secret_data", secretData); err != nil {
 		return fmt.Errorf("Error setting secret_data: %s", err)
 	}
 

diff --git a/...arty/terraform/services/secretmanager/data_source_secret_manager_secret_version_access.go b/...arty/terraform/services/secretmanager/data_source_secret_manager_secret_version_access.go
@@ -40,6 +40,11 @@ func DataSourceSecretManagerSecretVersionAccess() *schema.Resource {
 				Computed:  true,
 				Sensitive: true,
 			},
+			"is_secret_data_base64": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
 		},
 	}
 }
@@ -112,11 +117,17 @@ func dataSourceSecretManagerSecretVersionAccessRead(d *schema.ResourceData, meta
 	}
 
 	data := resp["payload"].(map[string]interface{})
-	secretData, err := base64.StdEncoding.DecodeString(data["data"].(string))
-	if err != nil {
-		return fmt.Errorf("Error decoding secret manager secret version data: %s", err.Error())
+	var secretData string
+	if d.Get("is_secret_data_base64").(bool) {
+		secretData = data["data"].(string)
+	} else {
+		payloadData, err := base64.StdEncoding.DecodeString(data["data"].(string))
+		if err != nil {
+			return fmt.Errorf("error decoding secret manager secret version data: %s", err.Error())
+		}
+		secretData = string(payloadData)
 	}
-	if err := d.Set("secret_data", string(secretData)); err != nil {
+	if err := d.Set("secret_data", secretData); err != nil {
 		return fmt.Errorf("Error setting secret_data: %s", err)
 	}
 

diff --git a/...terraform/services/secretmanager/data_source_secret_manager_secret_version_access_test.go b/...terraform/services/secretmanager/data_source_secret_manager_secret_version_access_test.go
@@ -1,14 +1,12 @@
 package secretmanager_test
 
 import (
-	"errors"
 	"fmt"
 	"testing"
 
 	"github.com/hashicorp/terraform-provider-google/google/acctest"
 
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
-	"github.com/hashicorp/terraform-plugin-testing/terraform"
 )
 
 func TestAccDatasourceSecretManagerSecretVersionAccess_basic(t *testing.T) {
@@ -24,7 +22,8 @@ func TestAccDatasourceSecretManagerSecretVersionAccess_basic(t *testing.T) {
 			{
 				Config: testAccDatasourceSecretManagerSecretVersionAccess_basic(randomString),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckDatasourceSecretManagerSecretVersionAccess("data.google_secret_manager_secret_version_access.basic", "1"),
+					testAccCheckDatasourceSecretManagerSecretVersion("data.google_secret_manager_secret_version_access.basic", "1"),
+					testAccCheckSecretManagerSecretVersionSecretDataDatasourceMatchesResource("data.google_secret_manager_secret_version_access.basic", "google_secret_manager_secret_version.secret-version-basic"),
 				),
 			},
 		},
@@ -44,34 +43,34 @@ func TestAccDatasourceSecretManagerSecretVersionAccess_latest(t *testing.T) {
 			{
 				Config: testAccDatasourceSecretManagerSecretVersionAccess_latest(randomString),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckDatasourceSecretManagerSecretVersionAccess("data.google_secret_manager_secret_version_access.latest", "2"),
+					testAccCheckDatasourceSecretManagerSecretVersion("data.google_secret_manager_secret_version_access.latest", "2"),
+					testAccCheckSecretManagerSecretVersionSecretDataDatasourceMatchesResource("data.google_secret_manager_secret_version_access.latest", "google_secret_manager_secret_version.secret-version-basic-2"),
 				),
 			},
 		},
 	})
 }
 
-func testAccCheckDatasourceSecretManagerSecretVersionAccess(n, expected string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[n]
-		if !ok {
-			return fmt.Errorf("Can't find Secret Version data source: %s", n)
-		}
-
-		if rs.Primary.ID == "" {
-			return errors.New("data source ID not set.")
-		}
+func TestAccDatasourceSecretManagerSecretVersionAccess_withBase64SecretData(t *testing.T) {
+	t.Parallel()
 
-		version, ok := rs.Primary.Attributes["version"]
-		if !ok {
-			return errors.New("can't find 'version' attribute")
-		}
+	randomString := acctest.RandString(t, 10)
+	data := "./test-fixtures/binary-file.pfx"
 
-		if version != expected {
-			return fmt.Errorf("expected %s, got %s, version not found", expected, version)
-		}
-		return nil
-	}
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckSecretManagerSecretVersionDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDatasourceSecretManagerSecretVersionAccess_withBase64SecretData(randomString, data),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDatasourceSecretManagerSecretVersion("data.google_secret_manager_secret_version_access.basic-base64", "1"),
+					testAccCheckSecretManagerSecretVersionSecretDataDatasourceMatchesResource("data.google_secret_manager_secret_version_access.basic-base64", "google_secret_manager_secret_version.secret-version-basic-base64"),
+				),
+			},
+		},
+	})
 }
 
 func testAccDatasourceSecretManagerSecretVersionAccess_latest(randomString string) string {
@@ -127,3 +126,28 @@ data "google_secret_manager_secret_version_access" "basic" {
 }
 `, randomString, randomString)
 }
+
+func testAccDatasourceSecretManagerSecretVersionAccess_withBase64SecretData(randomString, data string) string {
+	return fmt.Sprintf(`
+resource "google_secret_manager_secret" "secret-basic-base64" {
+  secret_id = "tf-test-secret-version-%s"
+  labels = {
+    label = "my-label"
+  }
+  replication {
+    auto {}
+  }
+}
+
+resource "google_secret_manager_secret_version" "secret-version-basic-base64" {
+  secret = google_secret_manager_secret.secret-basic-base64.name
+  is_secret_data_base64 = true
+  secret_data = filebase64("%s")
+}
+
+data "google_secret_manager_secret_version_access" "basic-base64" {
+  secret = google_secret_manager_secret_version.secret-version-basic-base64.secret
+  is_secret_data_base64 = true
+}
+`, randomString, data)
+}
diff --git a/..._party/terraform/services/secretmanager/data_source_secret_manager_secret_version_test.go b/..._party/terraform/services/secretmanager/data_source_secret_manager_secret_version_test.go
@@ -25,6 +25,7 @@ func TestAccDatasourceSecretManagerSecretVersion_basic(t *testing.T) {
 				Config: testAccDatasourceSecretManagerSecretVersion_basic(randomString),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDatasourceSecretManagerSecretVersion("data.google_secret_manager_secret_version.basic", "1"),
+					testAccCheckSecretManagerSecretVersionSecretDataDatasourceMatchesResource("data.google_secret_manager_secret_version.basic", "google_secret_manager_secret_version.secret-version-basic"),
 				),
 			},
 		},
@@ -45,6 +46,29 @@ func TestAccDatasourceSecretManagerSecretVersion_latest(t *testing.T) {
 				Config: testAccDatasourceSecretManagerSecretVersion_latest(randomString),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDatasourceSecretManagerSecretVersion("data.google_secret_manager_secret_version.latest", "2"),
+					testAccCheckSecretManagerSecretVersionSecretDataDatasourceMatchesResource("data.google_secret_manager_secret_version.latest", "google_secret_manager_secret_version.secret-version-basic-2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccDatasourceSecretManagerSecretVersion_withBase64SecretData(t *testing.T) {
+	t.Parallel()
+
+	randomString := acctest.RandString(t, 10)
+	data := "./test-fixtures/binary-file.pfx"
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckSecretManagerSecretVersionDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDatasourceSecretManagerSecretVersion_withBase64SecretData(randomString, data),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDatasourceSecretManagerSecretVersion("data.google_secret_manager_secret_version.basic-base64", "1"),
+					testAccCheckSecretManagerSecretVersionSecretDataDatasourceMatchesResource("data.google_secret_manager_secret_version.basic-base64", "google_secret_manager_secret_version.secret-version-basic-base64"),
 				),
 			},
 		},
@@ -74,6 +98,43 @@ func testAccCheckDatasourceSecretManagerSecretVersion(n, expected string) resour
 	}
 }
 
+func testAccCheckSecretManagerSecretVersionSecretDataDatasourceMatchesResource(datasource, resource string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[resource]
+		if !ok {
+			return fmt.Errorf("can't find Secret Version resource: %s", resource)
+		}
+
+		ds, ok := s.RootModule().Resources[datasource]
+		if !ok {
+			return fmt.Errorf("can't find Secret Version data source: %s", datasource)
+		}
+
+		if rs.Primary.ID == "" {
+			return errors.New("resource ID not set.")
+		}
+
+		if ds.Primary.ID == "" {
+			return errors.New("data source ID not set.")
+		}
+
+		resourceSecretData, ok := rs.Primary.Attributes["secret_data"]
+		if !ok {
+			return errors.New("can't find 'secret_data' attribute in Secret Version resource")
+		}
+
+		datasourceSecretData, ok := ds.Primary.Attributes["secret_data"]
+		if !ok {
+			return errors.New("can't find 'secret_data' attribute in Secret Version data source")
+		}
+
+		if resourceSecretData != datasourceSecretData {
+			return fmt.Errorf("expected %s, got %s, secret_data doesn't match", resourceSecretData, datasourceSecretData)
+		}
+		return nil
+	}
+}
+
 func testAccDatasourceSecretManagerSecretVersion_latest(randomString string) string {
 	return fmt.Sprintf(`
 resource "google_secret_manager_secret" "secret-basic" {
@@ -127,3 +188,28 @@ data "google_secret_manager_secret_version" "basic" {
 }
 `, randomString, randomString)
 }
+
+func testAccDatasourceSecretManagerSecretVersion_withBase64SecretData(randomString, data string) string {
+	return fmt.Sprintf(`
+resource "google_secret_manager_secret" "secret-basic-base64" {
+  secret_id = "tf-test-secret-version-%s"
+  labels = {
+    label = "my-label"
+  }
+  replication {
+    auto {}
+  }
+}
+
+resource "google_secret_manager_secret_version" "secret-version-basic-base64" {
+  secret = google_secret_manager_secret.secret-basic-base64.name
+  is_secret_data_base64 = true
+  secret_data = filebase64("%s")
+}
+
+data "google_secret_manager_secret_version" "basic-base64" {
+  secret = google_secret_manager_secret_version.secret-version-basic-base64.secret
+  is_secret_data_base64 = true
+}
+`, randomString, data)
+}
diff --git a/...form/services/secretmanagerregional/data_source_secret_manager_regional_secret_version.go b/...form/services/secretmanagerregional/data_source_secret_manager_regional_secret_version.go
@@ -69,6 +69,11 @@ func DataSourceSecretManagerRegionalRegionalSecretVersion() *schema.Resource {
 					},
 				},
 			},
+			"is_secret_data_base64": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
 		},
 	}
 }
@@ -193,12 +198,17 @@ func dataSourceSecretManagerRegionalRegionalSecretVersionRead(d *schema.Resource
 	}
 
 	data := resp["payload"].(map[string]interface{})
-	secretData, err := base64.StdEncoding.DecodeString(data["data"].(string))
-	if err != nil {
-		return fmt.Errorf("Error decoding secret manager regional secret version data: %s", err.Error())
+	var secretData string
+	if d.Get("is_secret_data_base64").(bool) {
+		secretData = data["data"].(string)
+	} else {
+		payloadData, err := base64.StdEncoding.DecodeString(data["data"].(string))
+		if err != nil {
+			return fmt.Errorf("error decoding secret manager regional secret version data: %s", err.Error())
+		}
+		secretData = string(payloadData)
 	}
-
-	if err := d.Set("secret_data", string(secretData)); err != nil {
+	if err := d.Set("secret_data", secretData); err != nil {
 		return fmt.Errorf("Error setting secret_data: %s", err)
 	}
 

diff --git a/...rvices/secretmanagerregional/data_source_secret_manager_regional_secret_version_access.go b/...rvices/secretmanagerregional/data_source_secret_manager_regional_secret_version_access.go
@@ -45,6 +45,11 @@ func DataSourceSecretManagerRegionalRegionalSecretVersionAccess() *schema.Resour
 				Computed:  true,
 				Sensitive: true,
 			},
+			"is_secret_data_base64": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
 		},
 	}
 }
@@ -148,11 +153,17 @@ func dataSourceSecretManagerRegionalRegionalSecretVersionAccessRead(d *schema.Re
 	}
 
 	data := resp["payload"].(map[string]interface{})
-	secretData, err := base64.StdEncoding.DecodeString(data["data"].(string))
-	if err != nil {
-		return fmt.Errorf("error decoding secret manager regional secret version data: %s", err.Error())
+	var secretData string
+	if d.Get("is_secret_data_base64").(bool) {
+		secretData = data["data"].(string)
+	} else {
+		payloadData, err := base64.StdEncoding.DecodeString(data["data"].(string))
+		if err != nil {
+			return fmt.Errorf("error decoding secret manager regional secret version data: %s", err.Error())
+		}
+		secretData = string(payloadData)
 	}
-	if err := d.Set("secret_data", string(secretData)); err != nil {
+	if err := d.Set("secret_data", secretData); err != nil {
 		return fmt.Errorf("error setting secret_data: %s", err)
 	}