Object lock feature implementation for Storage

mmv1/third_party/terraform/services/storage/resource_storage_bucket.go.erb

@@ -256,6 +256,13 @@ func ResourceStorageBucket() *schema.Resource {
 				Description: `The bucket's Lifecycle Rules configuration.`,
 			},
 
+			"enable_object_retention": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `Enables each object in the bucket to have its own retention policy, which prevents deletion until stored for a specific length of time.`,
+			},
+
 			"versioning": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -594,7 +601,11 @@ func resourceStorageBucketCreate(d *schema.ResourceData, meta interface{}) error
 
 	err = transport_tpg.Retry(transport_tpg.RetryOptions{
 		RetryFunc: func() error {
-			res, err = config.NewStorageClient(userAgent).Buckets.Insert(project, sb).Do()
+			insertCall := config.NewStorageClient(userAgent).Buckets.Insert(project, sb)
+			if d.Get("enable_object_retention").(bool) {
+				insertCall.EnableObjectRetention(true)
+			}
+			res, err = insertCall.Do()
 			return err
 		},
 	})
@@ -1121,6 +1132,16 @@ func flattenBucketRetentionPolicy(bucketRetentionPolicy *storage.BucketRetention
 	return bucketRetentionPolicies
 }
 
+func flattenBucketObjectRetention(bucketObjectRetention *storage.BucketObjectRetention) bool {
+	if bucketObjectRetention == nil {
+		return false
+	}
+	if bucketObjectRetention.Mode == "Enabled" {
+		return true
+	}
+	return false
+}
+
 func expandBucketVersioning(configured interface{}) *storage.BucketVersioning {
 	versionings := configured.([]interface{})
 	if len(versionings) == 0 {
@@ -1620,6 +1641,9 @@ func setStorageBucket(d *schema.ResourceData, config *transport_tpg.Config, res
 	if err := d.Set("logging", flattenBucketLogging(res.Logging)); err != nil {
 		return fmt.Errorf("Error setting logging: %s", err)
 	}
+	if err := d.Set("enable_object_retention", flattenBucketObjectRetention(res.ObjectRetention)); err != nil {
+		return fmt.Errorf("Error setting object retention: %s", err)
+	}
 	if err := d.Set("versioning", flattenBucketVersioning(res.Versioning)); err != nil {
 		return fmt.Errorf("Error setting versioning: %s", err)
 	}

mmv1/third_party/terraform/services/storage/resource_storage_bucket_object.go

@@ -207,10 +207,33 @@ func ResourceStorageBucketObject() *schema.Resource {
 				},
 			},
 
+			"retention": {
+				Type:          schema.TypeList,
+				MaxItems:      1,
+				Optional:      true,
+				ConflictsWith: []string{"event_based_hold"},
+				Description:   `Object level retention configuration.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"retain_until_time": {
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: `Time in RFC 3339 (e.g. 2030-01-01T02:03:04Z) until which object retention protects this object.`,
+						},
+						"mode": {
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: `The object retention mode. Supported values include: "Unlocked", "Locked".`,
+						},
+					},
+				},
+			},
+
 			"event_based_hold": {
-				Type:        schema.TypeBool,
-				Optional:    true,
-				Description: `Whether an object is under event-based hold. Event-based hold is a way to retain objects until an event occurs, which is signified by the hold's release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any).`,
+				Type:          schema.TypeBool,
+				Optional:      true,
+				ConflictsWith: []string{"retention"},
+				Description:   `Whether an object is under event-based hold. Event-based hold is a way to retain objects until an event occurs, which is signified by the hold's release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any).`,
 			},
 
 			"temporary_hold": {
@@ -312,6 +335,10 @@ func resourceStorageBucketObjectCreate(d *schema.ResourceData, meta interface{})
 		object.KmsKeyName = v.(string)
 	}
 
+	if v, ok := d.GetOk("retention"); ok {
+		object.Retention = expandObjectRetention(v)
+	}
+
 	if v, ok := d.GetOk("event_based_hold"); ok {
 		object.EventBasedHold = v.(bool)
 	}
@@ -357,6 +384,16 @@ func resourceStorageBucketObjectUpdate(d *schema.ResourceData, meta interface{})
 		return fmt.Errorf("Error retrieving object during update %s: %s", name, err)
 	}
 
+	hasRetentionChanges := d.HasChange("retention")
+	if hasRetentionChanges {
+		if v, ok := d.GetOk("retention"); ok {
+			res.Retention = expandObjectRetention(v)
+		} else {
+			res.Retention = nil
+			res.NullFields = append(res.NullFields, "Retention")
+		}
+	}
+
 	if d.HasChange("event_based_hold") {
 		v := d.Get("event_based_hold")
 		res.EventBasedHold = v.(bool)
@@ -368,6 +405,9 @@ func resourceStorageBucketObjectUpdate(d *schema.ResourceData, meta interface{})
 	}
 
 	updateCall := objectsService.Update(bucket, name, res)
+	if hasRetentionChanges {
+		updateCall.OverrideUnlockedRetention(true)
+	}
 	_, err = updateCall.Do()
 
 	if err != nil {
@@ -443,6 +483,9 @@ func resourceStorageBucketObjectRead(d *schema.ResourceData, meta interface{}) e
 	if err := d.Set("media_link", res.MediaLink); err != nil {
 		return fmt.Errorf("Error setting media_link: %s", err)
 	}
+	if err := d.Set("retention", flattenObjectRetention(res.Retention)); err != nil {
+		return fmt.Errorf("Error setting retention: %s", err)
+	}
 	if err := d.Set("event_based_hold", res.EventBasedHold); err != nil {
 		return fmt.Errorf("Error setting event_based_hold: %s", err)
 	}
@@ -513,3 +556,34 @@ func expandCustomerEncryption(input []interface{}) map[string]string {
 	}
 	return expanded
 }
+
+func expandObjectRetention(configured interface{}) *storage.ObjectRetention {
+	retentions := configured.([]interface{})
+	if len(retentions) == 0 {
+		return nil
+	}
+	retention := retentions[0].(map[string]interface{})
+
+	objectRetention := &storage.ObjectRetention{
+		RetainUntilTime: retention["retain_until_time"].(string),
+		Mode:            retention["mode"].(string),
+	}
+
+	return objectRetention
+}
+
+func flattenObjectRetention(objectRetention *storage.ObjectRetention) []map[string]interface{} {
+	retentions := make([]map[string]interface{}, 0, 1)
+
+	if objectRetention == nil {
+		return retentions
+	}
+
+	retention := map[string]interface{}{
+		"mode":              objectRetention.Mode,
+		"retain_until_time": objectRetention.RetainUntilTime,
+	}
+
+	retentions = append(retentions, retention)
+	return retentions
+}

mmv1/third_party/terraform/services/storage/resource_storage_bucket_object_test.go

@@ -415,6 +415,48 @@ func TestAccStorageObject_holds(t *testing.T) {
 	})
 }
 
+func TestAccStorageObject_retention(t *testing.T) {
+	t.Parallel()
+
+	bucketName := acctest.TestBucketName(t)
+	data := []byte(content)
+	h := md5.New()
+	if _, err := h.Write(data); err != nil {
+		t.Errorf("error calculating md5: %v", err)
+	}
+	dataMd5 := base64.StdEncoding.EncodeToString(h.Sum(nil))
+	testFile := getNewTmpTestFile(t, "tf-test")
+	if err := ioutil.WriteFile(testFile.Name(), data, 0644); err != nil {
+		t.Errorf("error writing file: %v", err)
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccStorageObjectDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testGoogleStorageBucketsObjectRetention(bucketName, "2040-01-01T02:03:04.000Z"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGoogleStorageObject(t, bucketName, objectName, dataMd5),
+				),
+			},
+			{
+				Config: testGoogleStorageBucketsObjectRetention(bucketName, "2040-01-02T02:03:04.000Z"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGoogleStorageObject(t, bucketName, objectName, dataMd5),
+				),
+			},
+			{
+				Config: testGoogleStorageBucketsObjectRetentionDisabled(bucketName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGoogleStorageObject(t, bucketName, objectName, dataMd5),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckGoogleStorageObject(t *testing.T, bucket, object, md5 string) resource.TestCheckFunc {
 	return testAccCheckGoogleStorageObjectWithEncryption(t, bucket, object, md5, "")
 }
@@ -646,6 +688,44 @@ resource "google_storage_bucket_object" "object" {
 `, bucketName, objectName, content, customerEncryptionKey)
 }
 
+func testGoogleStorageBucketsObjectRetention(bucketName string, retainUntilTime string) string {
+	return fmt.Sprintf(`
+resource "google_storage_bucket" "bucket" {
+  name                    = "%s"
+  location                = "US"
+  force_destroy           = true
+  enable_object_retention = true
+}
+
+resource "google_storage_bucket_object" "object" {
+  name      = "%s"
+  bucket    = google_storage_bucket.bucket.name
+  content   = "%s"
+  retention {
+	mode              = "Unlocked"
+	retain_until_time = "%s"
+  }      
+}
+`, bucketName, objectName, content, retainUntilTime)
+}
+
+func testGoogleStorageBucketsObjectRetentionDisabled(bucketName string) string {
+	return fmt.Sprintf(`
+resource "google_storage_bucket" "bucket" {
+  name                    = "%s"
+  location                = "US"
+  force_destroy           = true
+  enable_object_retention = true
+}
+
+resource "google_storage_bucket_object" "object" {
+  name      = "%s"
+  bucket    = google_storage_bucket.bucket.name
+  content   = "%s" 
+}
+`, bucketName, objectName, content)
+}
+
 func testGoogleStorageBucketsObjectHolds(bucketName string, eventBasedHold bool, temporaryHold bool) string {
 	return fmt.Sprintf(`
 resource "google_storage_bucket" "bucket" {