Data source for IAM Testable Permissions

[onetwopunch]

Release Note Template for Downstream PRs (will be copied)

Add google_iam_testable_permissions data source

Fixes: hashicorp/terraform-provider-google#6120
Fixes: hashicorp/terraform-provider-google#4812

Adds a new data source for IAM testable permissions.

data "google_iam_testable_permissions" "perms" {
	full_resource_name   = "//cloudresourcemanager.googleapis.com/projects/my-project"
        custom_support_level = "NOT_SUPPORTED"
        stages               = ["GA", "BETA"]
}

output "perms" {
	value = data.google_iam_testable_permissions.perms.permissions
}

Then the output will look like this:

$ terraform apply
data.google_iam_testable_permissions.perms: Refreshing state...

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

perms = [
  {
    "api_disabled" = false
    "custom_support_level" = "NOT_SUPPORTED"
    "name" = "appengine.runtimes.actAsAdmin"
    "stage" = "GA"
    "title" = ""
  },
  {
    "api_disabled" = false
    "custom_support_level" = "NOT_SUPPORTED"
    "name" = "cloudsql.sslCerts.createEphemeral"
    "stage" = "GA"
    "title" = ""
  },

[onetwopunch]

CC @morgante @sleterrier

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 5 files changed, 309 insertions(+))
Terraform Beta: Diff ( 5 files changed, 309 insertions(+))

[morgante]

@onetwopunch Thanks for working on this. FYI once it's released we should add support to the custom role module.

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 5 files changed, 309 insertions(+))
Terraform Beta: Diff ( 5 files changed, 309 insertions(+))

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 5 files changed, 308 insertions(+))
Terraform Beta: Diff ( 5 files changed, 308 insertions(+))

[slevenick]

If customRolesSupportLevel is nil what does that represent within the API?

[onetwopunch]

This seems to be a API/Docs mismatch where the Docs say they response will be "SUPPORTED" but the actual API response just doesn't include customRolesSupportLevel if it's supported. I figured I'd add both here in case we decide to make the response line up with the docs. Is there any other pattern for that?

[modular-magician]

Hello! I am a robot who works on Magic Modules PRs.

I have detected that you are a community contributor, so your PR will be assigned to someone with a commit-bit on this repo for initial review.

Thanks for your contribution! A human will be with you soon.

@SirGitsalot, please review this PR or find an appropriate assignee.

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 5 files changed, 297 insertions(+))
Terraform Beta: Diff ( 5 files changed, 297 insertions(+))

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 5 files changed, 339 insertions(+))
Terraform Beta: Diff ( 5 files changed, 339 insertions(+))

[slevenick]

Same as below comment

[slevenick]

Instead of checking csl here, can we simplify the above and continue?

Like:
`if custom_support_level == p["customRolesSupportLevel"] || (p["customRolesSupportLevel"] == nil && custom_support_level == "SUPPORTED") {
continue
}
if stringInSlice....
....

[slevenick]

If stage comes back as nil what do we expect to do? Is that possible?