Add Active Directory to Cloud SQL

mmv1/third_party/terraform/resources/resource_sql_database_instance.go.erb

@@ -157,6 +157,20 @@ func resourceSqlDatabaseInstance() *schema.Resource {
 							Default:  "ALWAYS",
 							Description: `This specifies when the instance should be active. Can be either ALWAYS, NEVER or ON_DEMAND.`,
 						},
+						"active_directory_config": {
+							Type:     schema.TypeList,
+							Optional: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"domain": {
+										Type:        schema.TypeString,
+										Required:    true,
+										Description: `Domain name of the Active Directory for SQL Server (e.g., mydomain.com).`,
+									},
+								},
+							},
+						},
 						"availability_type": {
 							Type:             schema.TypeString,
 							Optional:         true,
@@ -969,6 +983,7 @@ func expandSqlDatabaseInstanceSettings(configured []interface{}) *sqladmin.Setti
 		Tier:                        _settings["tier"].(string),
 		ForceSendFields:             []string{"StorageAutoResize"},
 		ActivationPolicy:            _settings["activation_policy"].(string),
+		ActiveDirectoryConfig:       expandActiveDirectoryConfig(_settings["active_directory_config"].([]interface{})),
 		AvailabilityType:            _settings["availability_type"].(string),
 		Collation:                   _settings["collation"].(string),
 		DataDiskSizeGb:              int64(_settings["disk_size"].(int)),
@@ -1131,6 +1146,18 @@ func expandBackupRetentionSettings(configured interface{}) *sqladmin.BackupReten
 	}
 }
 
+func expandActiveDirectoryConfig(configured interface{}) *sqladmin.SqlActiveDirectoryConfig {
+	l := configured.([]interface{})
+	if len(l) == 0 {
+		return nil
+	}
+
+	config := l[0].(map[string]interface{})
+	return &sqladmin.SqlActiveDirectoryConfig{
+		Domain: config["domain"].(string),
+	}
+}
+
 func expandInsightsConfig(configured []interface{}) *sqladmin.InsightsConfig {
 	if len(configured) == 0 || configured[0] == nil {
 		return nil
@@ -1374,6 +1401,10 @@ func flattenSettings(settings *sqladmin.Settings) []map[string]interface{} {
 		"user_labels":                 settings.UserLabels,
 	}
 
+	if settings.ActiveDirectoryConfig != nil {
+		data["active_directory_config"] = flattenActiveDirectoryConfig(settings.ActiveDirectoryConfig)
+	}
+
 	if settings.BackupConfiguration != nil {
 		data["backup_configuration"] = flattenBackupConfiguration(settings.BackupConfiguration)
 	}
@@ -1434,6 +1465,16 @@ func flattenBackupRetentionSettings(b *sqladmin.BackupRetentionSettings) []map[s
 	}
 }
 
+func flattenActiveDirectoryConfig(sqlActiveDirectoryConfig *sqladmin.SqlActiveDirectoryConfig) []map[string]interface{} {
+	if sqlActiveDirectoryConfig == nil {
+		return nil
+	}
+	return []map[string]interface{}{
+		{
+			"domain": sqlActiveDirectoryConfig.Domain,
+		},
+	}
+}
 
 func flattenDatabaseFlags(databaseFlags []*sqladmin.DatabaseFlags) []map[string]interface{} {
 	flags := make([]map[string]interface{}, 0, len(databaseFlags))

mmv1/third_party/terraform/tests/resource_sql_database_instance_test.go.erb

@@ -1063,6 +1063,32 @@ func TestAccSqlDatabaseInstance_encryptionKey(t *testing.T) {
 }
 <% end -%>
 
+func TestAccSqlDatabaseInstance_ActiveDirectory(t *testing.T) {
+	t.Parallel()
+	databaseName := "tf-test-" + randString(t, 10)
+	networkName := BootstrapSharedTestNetwork(t, "sql-instance-private-test-ad")
+	addressName := "tf-test-" + randString(t, 10)
+	rootPassword := randString(t, 15)
+	adDomainName := BootstrapSharedTestADDomain(t, "test-domain", networkName)
+
+	vcrTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccSqlDatabaseInstanceDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testGoogleSqlDatabaseInstance_ActiveDirectoryConfig(databaseName, networkName, addressName, rootPassword, adDomainName),
+			},
+			{
+				ResourceName:      "google_sql_database_instance.instance-with-ad",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"root_password", "deletion_protection"},
+			},
+		},
+	})
+}
+
 var testGoogleSqlDatabaseInstance_basic2 = `
 resource "google_sql_database_instance" "instance" {
   region              = "us-central1"
@@ -1099,6 +1125,47 @@ resource "google_sql_database_instance" "instance" {
 }
 `
 
+func testGoogleSqlDatabaseInstance_ActiveDirectoryConfig(databaseName, networkName, addressRangeName, rootPassword, adDomainName string) string {
+	return fmt.Sprintf(`
+data "google_compute_network" "servicenet" {
+  name                    = "%s"
+}
+
+resource "google_compute_global_address" "foobar" {
+  name          = "%s"
+  purpose       = "VPC_PEERING"
+  address_type  = "INTERNAL"
+  prefix_length = 16
+  network       = data.google_compute_network.servicenet.self_link
+}
+
+resource "google_service_networking_connection" "foobar" {
+  network                 = data.google_compute_network.servicenet.self_link
+  service                 = "servicenetworking.googleapis.com"
+  reserved_peering_ranges = [google_compute_global_address.foobar.name]
+}
+
+resource "google_sql_database_instance" "instance-with-ad" {
+  depends_on = [google_service_networking_connection.foobar]
+  name             = "%s"
+  region           = "us-central1"
+  database_version = "SQLSERVER_2017_STANDARD"
+  root_password    = "%s"
+  deletion_protection = false
+  settings {
+    tier = "db-custom-2-7680"
+    ip_configuration {
+      ipv4_enabled       = "false"
+      private_network    = data.google_compute_network.servicenet.self_link
+    }
+
+    active_directory_config {
+      domain = "%s"
+    }
+  }
+}`, networkName, addressRangeName, databaseName, rootPassword, adDomainName)
+}
+
 func testGoogleSqlDatabaseInstanceConfig_withoutReplica(instanceName string) string {
 	return fmt.Sprintf(`
 resource "google_sql_database_instance" "instance" {

mmv1/third_party/terraform/utils/bootstrap_utils_test.go

@@ -211,6 +211,47 @@ func BootstrapServiceAccount(t *testing.T, project, testRunner string) string {
 	return sa.Email
 }
 
+const SharedTestADDomainPrefix = "tf-bootstrap-ad"
+
+func BootstrapSharedTestADDomain(t *testing.T, testId string, networkName string) string {
+	project := getTestProjectFromEnv()
+	sharedADDomain := fmt.Sprintf("%s.%s.com", SharedTestADDomainPrefix, testId)
+	adDomainName := fmt.Sprintf("projects/%s/locations/global/domains/%s", project, sharedADDomain)
+
+	config := BootstrapConfig(t)
+	if config == nil {
+		return ""
+	}
+
+	log.Printf("[DEBUG] Getting shared test active directory domain %q", adDomainName)
+	getURL := fmt.Sprintf("%s%s", config.ActiveDirectoryBasePath, adDomainName)
+	_, err := sendRequestWithTimeout(config, "GET", project, getURL, config.userAgent, nil, 4*time.Minute)
+	if err != nil && isGoogleApiErrorWithCode(err, 404) {
+		log.Printf("[DEBUG] AD domain %q not found, bootstrapping", sharedADDomain)
+		postURL := fmt.Sprintf("%sprojects/%s/locations/global/domains?domainName=%s", config.ActiveDirectoryBasePath, project, sharedADDomain)
+		domainObj := map[string]interface{}{
+			"locations":          []string{"us-central1"},
+			"reservedIpRange":    "10.0.1.0/24",
+			"authorizedNetworks": []string{fmt.Sprintf("projects/%s/global/networks/%s", project, networkName)},
+		}
+
+		_, err := sendRequestWithTimeout(config, "POST", project, postURL, config.userAgent, domainObj, 60*time.Minute)
+		if err != nil {
+			t.Fatalf("Error bootstrapping shared active directory domain %q: %s", adDomainName, err)
+		}
+
+		log.Printf("[DEBUG] Waiting for active directory domain creation to finish")
+	}
+
+	_, err = sendRequestWithTimeout(config, "GET", project, getURL, config.userAgent, nil, 4*time.Minute)
+
+	if err != nil {
+		t.Fatalf("Error getting shared active directory domain %q: %s", adDomainName, err)
+	}
+
+	return sharedADDomain
+}
+
 const SharedTestNetworkPrefix = "tf-bootstrap-net-"
 
 // BootstrapSharedTestNetwork will return a shared compute network

mmv1/third_party/terraform/website/docs/r/sql_database_instance.html.markdown

@@ -254,6 +254,11 @@ The optional `settings.database_flags` sublist supports:
 
 * `value` - (Required) Value of the flag.
 
+The optional `settings.active_directory_config` subblock supports:
+
+* `domain` - (Required) The domain name for the active directory (e.g., mydomain.com).
+    Can only be used with SQL Server.
+
 The optional `settings.backup_configuration` subblock supports:
 
 * `binary_log_enabled` - (Optional) True if binary logging is enabled.