Added CMEK support for cloud data fusion

mmv1/products/datafusion/api.yaml

@@ -206,3 +206,15 @@ objects:
               project the network should specified in the form of projects/{host-project-id}/global/networks/{network}
             required: true
             input: true
+      - !ruby/object:Api::Type::NestedObject
+        name: 'cryptoKeyConfig'
+        description: |
+          The crypto key configuration. This field is used by the Customer-Managed Encryption Keys (CMEK) feature.
+        input: true
+        properties:
+          - !ruby/object:Api::Type::String
+            name: 'keyReference'
+            description: |
+              The name of the key which is used to encrypt/decrypt customer data. For key in Cloud KMS, the key should be in the format of projects/*/locations/*/keyRings/*/cryptoKeys/*.
+            required: true
+            input: true

mmv1/products/datafusion/terraform.yaml

@@ -30,6 +30,11 @@ overrides: !ruby/object:Overrides::ResourceOverrides
         primary_resource_id: "extended_instance"
         vars:
           instance_name: "my-instance"
+      - !ruby/object:Provider::Terraform::Examples
+        name: "data_fusion_instance_cmek"
+        primary_resource_id: "basic_cmek"
+        vars:
+          instance_name: "my-instance"
     properties:
       region: !ruby/object:Overrides::Terraform::PropertyOverride
         ignore_read: true

mmv1/templates/terraform/examples/data_fusion_instance_cmek.tf.erb

@@ -0,0 +1,32 @@
+resource "google_data_fusion_instance" "<%= ctx[:primary_resource_id] %>" {
+  name   = "<%= ctx[:vars]["instance_name"] %>"
+  region = "us-central1"
+  type   = "BASIC"
+
+  crypto_key_config {
+    key_reference = google_kms_crypto_key.crypto_key.id
+  }
+
+  depends_on = [google_kms_crypto_key_iam_binding.crypto_key_binding]
+}
+
+resource "google_kms_crypto_key" "crypto_key" {
+  name     = "<%= ctx[:vars]['instance_name'] %>"
+  key_ring = google_kms_key_ring.key_ring.id
+}
+
+resource "google_kms_key_ring" "key_ring" {
+  name     = "<%= ctx[:vars]['instance_name'] %>"
+  location = "us-central1"
+}
+
+resource "google_kms_crypto_key_iam_binding" "crypto_key_binding" {
+  crypto_key_id = google_kms_crypto_key.crypto_key.id
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+
+  members = [
+    "serviceAccount:service-${data.google_project.project.number}@gcp-sa-datafusion.iam.gserviceaccount.com"
+  ]
+}
+
+data "google_project" "project" {}