Skip to content

Commit

Permalink
Object lock feature implementation for Storage (GoogleCloudPlatform#9363
Browse files Browse the repository at this point in the history 
)

* Early implementation of bucket object lock setting.

* Complete implementation of object lock for buckets.

* Compelete implementation, waiting for allowlist.

* Tests pass against test environment.

* Fixes bug in object test.

* Update mmv1/third_party/terraform/services/storage/resource_storage_bucket_object.go

Co-authored-by: Stephen Lewis (Burrows) <[email protected]>

* Update mmv1/third_party/terraform/services/storage/resource_storage_bucket_object.go

Co-authored-by: Stephen Lewis (Burrows) <[email protected]>

* Update mmv1/third_party/terraform/services/storage/resource_storage_bucket_test.go.erb

Co-authored-by: Stephen Lewis (Burrows) <[email protected]>

* Update mmv1/third_party/terraform/services/storage/resource_storage_bucket_object.go

Co-authored-by: Stephen Lewis (Burrows) <[email protected]>

* Update mmv1/third_party/terraform/services/storage/resource_storage_bucket.go.erb

Co-authored-by: Stephen Lewis (Burrows) <[email protected]>

* Updates from review comments

* Update mmv1/third_party/terraform/services/storage/resource_storage_bucket_object.go

Co-authored-by: Stephen Lewis (Burrows) <[email protected]>

* Update mmv1/third_party/terraform/website/docs/r/storage_bucket_object.html.markdown

Co-authored-by: Stephen Lewis (Burrows) <[email protected]>

* Removing non-deterministic date from test

* Removing unused variable

* fixing nested_customer_encryption anchor link

---------

Co-authored-by: Stephen Lewis (Burrows) <[email protected]>
  • Loading branch information
@thomasmaclean @melinath
thomasmaclean and melinath authored Oct 31, 2023
1 parent 2b59ef2 commit 4f30808
Show file tree
Hide file tree
Showing 6 changed files with 259 additions and 16 deletions.
26 changes: 25 additions & 1 deletion mmv1/third_party/terraform/services/storage/resource_storage_bucket.go.erb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -256,6 +256,13 @@ func ResourceStorageBucket() *schema.Resource {
Description: `The bucket's Lifecycle Rules configuration.`,
},

"enable_object_retention": {
Type: schema.TypeBool,
Optional: true,
ForceNew: true,
Description: `Enables each object in the bucket to have its own retention policy, which prevents deletion until stored for a specific length of time.`,
},

"versioning": {
Type: schema.TypeList,
Optional: true,
Expand Down Expand Up @@ -594,7 +601,11 @@ func resourceStorageBucketCreate(d *schema.ResourceData, meta interface{}) error

err = transport_tpg.Retry(transport_tpg.RetryOptions{
RetryFunc: func() error {
res, err = config.NewStorageClient(userAgent).Buckets.Insert(project, sb).Do()
insertCall := config.NewStorageClient(userAgent).Buckets.Insert(project, sb)
if d.Get("enable_object_retention").(bool) {
insertCall.EnableObjectRetention(true)
}
res, err = insertCall.Do()
return err
},
})
Expand Down Expand Up @@ -1121,6 +1132,16 @@ func flattenBucketRetentionPolicy(bucketRetentionPolicy *storage.BucketRetention
return bucketRetentionPolicies
}

func flattenBucketObjectRetention(bucketObjectRetention *storage.BucketObjectRetention) bool {
if bucketObjectRetention == nil {
return false
}
if bucketObjectRetention.Mode == "Enabled" {
return true
}
return false
}

func expandBucketVersioning(configured interface{}) *storage.BucketVersioning {
versionings := configured.([]interface{})
if len(versionings) == 0 {
Expand Down Expand Up @@ -1620,6 +1641,9 @@ func setStorageBucket(d *schema.ResourceData, config *transport_tpg.Config, res
if err := d.Set("logging", flattenBucketLogging(res.Logging)); err != nil {
return fmt.Errorf("Error setting logging: %s", err)
}
if err := d.Set("enable_object_retention", flattenBucketObjectRetention(res.ObjectRetention)); err != nil {
return fmt.Errorf("Error setting object retention: %s", err)
}
if err := d.Set("versioning", flattenBucketVersioning(res.Versioning)); err != nil {
return fmt.Errorf("Error setting versioning: %s", err)
}
Expand Down
80 changes: 77 additions & 3 deletions mmv1/third_party/terraform/services/storage/resource_storage_bucket_object.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -207,10 +207,33 @@ func ResourceStorageBucketObject() *schema.Resource {
},
},

"retention": {
Type: schema.TypeList,
MaxItems: 1,
Optional: true,
ConflictsWith: []string{"event_based_hold"},
Description: `Object level retention configuration.`,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"retain_until_time": {
Type: schema.TypeString,
Required: true,
Description: `Time in RFC 3339 (e.g. 2030-01-01T02:03:04Z) until which object retention protects this object.`,
},
"mode": {
Type: schema.TypeString,
Required: true,
Description: `The object retention mode. Supported values include: "Unlocked", "Locked".`,
},
},
},
},

"event_based_hold": {
Type: schema.TypeBool,
Optional: true,
Description: `Whether an object is under event-based hold. Event-based hold is a way to retain objects until an event occurs, which is signified by the hold's release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any).`,
Type: schema.TypeBool,
Optional: true,
ConflictsWith: []string{"retention"},
Description: `Whether an object is under event-based hold. Event-based hold is a way to retain objects until an event occurs, which is signified by the hold's release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any).`,
},

"temporary_hold": {
Expand Down Expand Up @@ -312,6 +335,10 @@ func resourceStorageBucketObjectCreate(d *schema.ResourceData, meta interface{})
object.KmsKeyName = v.(string)
}

if v, ok := d.GetOk("retention"); ok {
object.Retention = expandObjectRetention(v)
}

if v, ok := d.GetOk("event_based_hold"); ok {
object.EventBasedHold = v.(bool)
}
Expand Down Expand Up @@ -357,6 +384,16 @@ func resourceStorageBucketObjectUpdate(d *schema.ResourceData, meta interface{})
return fmt.Errorf("Error retrieving object during update %s: %s", name, err)
}

hasRetentionChanges := d.HasChange("retention")
if hasRetentionChanges {
if v, ok := d.GetOk("retention"); ok {
res.Retention = expandObjectRetention(v)
} else {
res.Retention = nil
res.NullFields = append(res.NullFields, "Retention")
}
}

if d.HasChange("event_based_hold") {
v := d.Get("event_based_hold")
res.EventBasedHold = v.(bool)
Expand All @@ -368,6 +405,9 @@ func resourceStorageBucketObjectUpdate(d *schema.ResourceData, meta interface{})
}

updateCall := objectsService.Update(bucket, name, res)
if hasRetentionChanges {
updateCall.OverrideUnlockedRetention(true)
}
_, err = updateCall.Do()

if err != nil {
Expand Down Expand Up @@ -443,6 +483,9 @@ func resourceStorageBucketObjectRead(d *schema.ResourceData, meta interface{}) e
if err := d.Set("media_link", res.MediaLink); err != nil {
return fmt.Errorf("Error setting media_link: %s", err)
}
if err := d.Set("retention", flattenObjectRetention(res.Retention)); err != nil {
return fmt.Errorf("Error setting retention: %s", err)
}
if err := d.Set("event_based_hold", res.EventBasedHold); err != nil {
return fmt.Errorf("Error setting event_based_hold: %s", err)
}
Expand Down Expand Up @@ -513,3 +556,34 @@ func expandCustomerEncryption(input []interface{}) map[string]string {
}
return expanded
}

func expandObjectRetention(configured interface{}) *storage.ObjectRetention {
retentions := configured.([]interface{})
if len(retentions) == 0 {
return nil
}
retention := retentions[0].(map[string]interface{})

objectRetention := &storage.ObjectRetention{
RetainUntilTime: retention["retain_until_time"].(string),
Mode: retention["mode"].(string),
}

return objectRetention
}

func flattenObjectRetention(objectRetention *storage.ObjectRetention) []map[string]interface{} {
retentions := make([]map[string]interface{}, 0, 1)

if objectRetention == nil {
return retentions
}

retention := map[string]interface{}{
"mode": objectRetention.Mode,
"retain_until_time": objectRetention.RetainUntilTime,
}

retentions = append(retentions, retention)
return retentions
}
80 changes: 80 additions & 0 deletions mmv1/third_party/terraform/services/storage/resource_storage_bucket_object_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -415,6 +415,48 @@ func TestAccStorageObject_holds(t *testing.T) {
})
}

func TestAccStorageObject_retention(t *testing.T) {
t.Parallel()

bucketName := acctest.TestBucketName(t)
data := []byte(content)
h := md5.New()
if _, err := h.Write(data); err != nil {
t.Errorf("error calculating md5: %v", err)
}
dataMd5 := base64.StdEncoding.EncodeToString(h.Sum(nil))
testFile := getNewTmpTestFile(t, "tf-test")
if err := ioutil.WriteFile(testFile.Name(), data, 0644); err != nil {
t.Errorf("error writing file: %v", err)
}

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
CheckDestroy: testAccStorageObjectDestroyProducer(t),
Steps: []resource.TestStep{
{
Config: testGoogleStorageBucketsObjectRetention(bucketName, "2040-01-01T02:03:04.000Z"),
Check: resource.ComposeTestCheckFunc(
testAccCheckGoogleStorageObject(t, bucketName, objectName, dataMd5),
),
},
{
Config: testGoogleStorageBucketsObjectRetention(bucketName, "2040-01-02T02:03:04.000Z"),
Check: resource.ComposeTestCheckFunc(
testAccCheckGoogleStorageObject(t, bucketName, objectName, dataMd5),
),
},
{
Config: testGoogleStorageBucketsObjectRetentionDisabled(bucketName),
Check: resource.ComposeTestCheckFunc(
testAccCheckGoogleStorageObject(t, bucketName, objectName, dataMd5),
),
},
},
})
}

func testAccCheckGoogleStorageObject(t *testing.T, bucket, object, md5 string) resource.TestCheckFunc {
return testAccCheckGoogleStorageObjectWithEncryption(t, bucket, object, md5, "")
}
Expand Down Expand Up @@ -646,6 +688,44 @@ resource "google_storage_bucket_object" "object" {
`, bucketName, objectName, content, customerEncryptionKey)
}

func testGoogleStorageBucketsObjectRetention(bucketName string, retainUntilTime string) string {
return fmt.Sprintf(`
resource "google_storage_bucket" "bucket" {
name = "%s"
location = "US"
force_destroy = true
enable_object_retention = true
}
resource "google_storage_bucket_object" "object" {
name = "%s"
bucket = google_storage_bucket.bucket.name
content = "%s"
retention {
mode = "Unlocked"
retain_until_time = "%s"
}
}
`, bucketName, objectName, content, retainUntilTime)
}

func testGoogleStorageBucketsObjectRetentionDisabled(bucketName string) string {
return fmt.Sprintf(`
resource "google_storage_bucket" "bucket" {
name = "%s"
location = "US"
force_destroy = true
enable_object_retention = true
}
resource "google_storage_bucket_object" "object" {
name = "%s"
bucket = google_storage_bucket.bucket.name
content = "%s"
}
`, bucketName, objectName, content)
}

func testGoogleStorageBucketsObjectHolds(bucketName string, eventBasedHold bool, temporaryHold bool) string {
return fmt.Sprintf(`
resource "google_storage_bucket" "bucket" {
Expand Down
Loading

0 comments on commit 4f30808

Please sign in to comment.