Merge branch 'GoogleCloudPlatform:main' into notifications_412_bug_fix

.ci/magician/github/membership_data.go

@@ -118,5 +118,7 @@ var (
 	}
 
 	// This is for new team members who are onboarding
-	trustedContributors = map[string]struct{}{}
+	trustedContributors = map[string]struct{}{
+		"bbasata": struct{}{},
+	}
 )

mmv1/api/resource/sweeper.go

@@ -13,10 +13,18 @@
 
 package resource
 
+// Sweeper provides configuration for the test sweeper
 type Sweeper struct {
 	// The field checked by sweeper to determine
 	// eligibility for deletion for generated resources
-	SweepableIdentifierField string   `yaml:"sweepable_identifier_field"`
-	Regions                  []string `yaml:"regions,omitempty"`
-	Prefixes                 []string `yaml:"prefixes,omitempty"`
+	IdentifierField  string            `yaml:"identifier_field"`
+	Regions          []string          `yaml:"regions,omitempty"`
+	Prefixes         []string          `yaml:"prefixes,omitempty"`
+	URLSubstitutions []URLSubstitution `yaml:"url_substitutions,omitempty"`
+}
+
+// URLSubstitution represents a region-zone pair for URL substitution
+type URLSubstitution struct {
+	Region string `yaml:"region,omitempty"`
+	Zone   string `yaml:"zone,omitempty"`
 }

mmv1/products/accesscontextmanager/ServicePerimeterDryRunEgressPolicy.yaml

@@ -72,9 +72,10 @@ nested_query:
 custom_code:
   constants: 'templates/terraform/constants/access_context_manager.go.tmpl'
   encoder: 'templates/terraform/encoders/access_context_manager_service_perimeter_dry_run_egress_policy.go.tmpl'
-  pre_create: 'templates/terraform/pre_create/access_context_manager_dry_run_resource.go.tmpl'
+  pre_create: 'templates/terraform/pre_create/access_context_manager_service_perimeter_dry_run_egress_policy.go.tmpl'
   pre_update: 'templates/terraform/pre_create/access_context_manager_dry_run_resource.go.tmpl'
-  pre_delete: 'templates/terraform/pre_create/access_context_manager_dry_run_resource.go.tmpl'
+  pre_delete: 'templates/terraform/pre_delete/access_context_manager_service_perimeter_dry_run_egress_policy.go.tmpl'
+  post_read: 'templates/terraform/post_read/access_context_manager_service_perimeter_resource.go.tmpl'
   custom_import: 'templates/terraform/custom_import/access_context_manager_service_perimeter_ingress_policy.go.tmpl'
 exclude_tgc: true
 # Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
@@ -218,3 +219,8 @@ properties:
       The name of the Access Policy this resource belongs to.
     ignore_read: true
     output: true
+  - name: 'etag'
+    type: String
+    output: true
+    description: |
+      The perimeter etag is internally used to prevent overwriting the list of policies on PATCH calls. It is retrieved from the same GET perimeter API call that's used to get the current list of policies. The policy defined in this resource is added or removed from that list, and then this etag is sent with the PATCH call along with the updated policies.

mmv1/products/accesscontextmanager/ServicePerimeterDryRunIngressPolicy.yaml

@@ -73,9 +73,10 @@ nested_query:
 custom_code:
   constants: 'templates/terraform/constants/access_context_manager.go.tmpl'
   encoder: 'templates/terraform/encoders/access_context_manager_service_perimeter_dry_run_egress_policy.go.tmpl'
-  pre_create: 'templates/terraform/pre_create/access_context_manager_dry_run_resource.go.tmpl'
+  pre_create: 'templates/terraform/pre_create/access_context_manager_service_perimeter_dry_run_ingress_policy.go.tmpl'
   pre_update: 'templates/terraform/pre_create/access_context_manager_dry_run_resource.go.tmpl'
-  pre_delete: 'templates/terraform/pre_create/access_context_manager_dry_run_resource.go.tmpl'
+  pre_delete: 'templates/terraform/pre_delete/access_context_manager_service_perimeter_dry_run_ingress_policy.go.tmpl'
+  post_read: 'templates/terraform/post_read/access_context_manager_service_perimeter_resource.go.tmpl'
   custom_import: 'templates/terraform/custom_import/access_context_manager_service_perimeter_ingress_policy.go.tmpl'
 exclude_tgc: true
 # Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
@@ -217,3 +218,8 @@ properties:
       The name of the Access Policy this resource belongs to.
     ignore_read: true
     output: true
+  - name: 'etag'
+    type: String
+    output: true
+    description: |
+      The perimeter etag is internally used to prevent overwriting the list of policies on PATCH calls. It is retrieved from the same GET perimeter API call that's used to get the current list of policies. The policy defined in this resource is added or removed from that list, and then this etag is sent with the PATCH call along with the updated policies.

mmv1/products/accesscontextmanager/ServicePerimeterEgressPolicy.yaml

@@ -73,6 +73,9 @@ custom_code:
   constants: 'templates/terraform/constants/access_context_manager.go.tmpl'
   custom_import: 'templates/terraform/custom_import/access_context_manager_service_perimeter_egress_policy.go.tmpl'
   encoder: 'templates/terraform/encoders/access_context_manager_service_perimeter_egress_policy.go.tmpl'
+  post_read: 'templates/terraform/post_read/access_context_manager_service_perimeter_resource.go.tmpl'
+  pre_create: 'templates/terraform/pre_create/access_context_manager_service_perimeter_egress_policy.go.tmpl'
+  pre_delete: 'templates/terraform/pre_delete/access_context_manager_service_perimeter_egress_policy.go.tmpl'
 exclude_tgc: true
 # Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
 exclude_sweeper: true
@@ -215,3 +218,8 @@ properties:
       The name of the Access Policy this resource belongs to.
     ignore_read: true
     output: true
+  - name: 'etag'
+    type: String
+    output: true
+    description: |
+      The perimeter etag is internally used to prevent overwriting the list of policies on PATCH calls. It is retrieved from the same GET perimeter API call that's used to get the current list of policies. The policy defined in this resource is added or removed from that list, and then this etag is sent with the PATCH call along with the updated policies.

mmv1/products/accesscontextmanager/ServicePerimeterIngressPolicy.yaml

@@ -74,6 +74,9 @@ custom_code:
   constants: 'templates/terraform/constants/access_context_manager.go.tmpl'
   custom_import: 'templates/terraform/custom_import/access_context_manager_service_perimeter_ingress_policy.go.tmpl'
   encoder: 'templates/terraform/encoders/access_context_manager_service_perimeter_ingress_policy.go.tmpl'
+  post_read: 'templates/terraform/post_read/access_context_manager_service_perimeter_resource.go.tmpl'
+  pre_create: 'templates/terraform/pre_create/access_context_manager_service_perimeter_ingress_policy.go.tmpl'
+  pre_delete: 'templates/terraform/pre_delete/access_context_manager_service_perimeter_ingress_policy.go.tmpl'
 exclude_tgc: true
 # Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
 exclude_sweeper: true
@@ -217,3 +220,8 @@ properties:
       The name of the Access Policy this resource belongs to.
     ignore_read: true
     output: true
+  - name: 'etag'
+    type: String
+    output: true
+    description: |
+      The perimeter etag is internally used to prevent overwriting the list of policies on PATCH calls. It is retrieved from the same GET perimeter API call that's used to get the current list of policies. The policy defined in this resource is added or removed from that list, and then this etag is sent with the PATCH call along with the updated policies.

mmv1/products/apphub/Application.yaml

@@ -42,10 +42,10 @@ custom_code:
 custom_diff:
   - 'apphubApplicationCustomizeDiff'
 sweeper:
-  regions:
-    - "us-central1"
-    - "us-east1"
-    - "global"
+  url_substitutions:
+    - region: "us-central1"
+    - region: "us-east1"
+    - region: "global"
 examples:
   - name: 'apphub_application_basic'
     primary_resource_id: 'example'

mmv1/products/artifactregistry/Repository.yaml

@@ -55,9 +55,9 @@ custom_code:
   encoder: 'templates/terraform/encoders/location_from_region.go.tmpl'
   pre_create: 'templates/terraform/pre_create/artifact_registry_remote_repository.go.tmpl'
 sweeper:
-  regions:
-    - "us-central1"
-    - "us"
+  url_substitutions:
+    - region: "us-central1"
+    - region: "us"
 examples:
   - name: 'artifact_registry_repository_basic'
     primary_resource_id: 'my-repo'

mmv1/products/biglake/Catalog.yaml

@@ -30,8 +30,8 @@ timeouts:
   delete_minutes: 20
 custom_code:
 sweeper:
-  regions:
-    - "US"
+  url_substitutions:
+    - region: "US"
 examples:
   - name: 'bigquery_biglake_catalog'
     primary_resource_id: 'default'

mmv1/products/bigqueryanalyticshub/DataExchange.yaml

@@ -42,8 +42,8 @@ iam_policy:
     - '{{data_exchange_id}}'
 custom_code:
 sweeper:
-  regions:
-    - "US"
+  url_substitutions:
+    - region: "US"
 examples:
   - name: 'bigquery_analyticshub_data_exchange_basic'
     primary_resource_id: 'data_exchange'

mmv1/products/bigqueryanalyticshub/ListingSubscription.yaml

@@ -28,6 +28,9 @@ import_format:
 custom_code:
   post_create: templates/terraform/post_create/analytics_hub_subscription.go.tmpl
   post_import: templates/terraform/post_import/analytics_hub_subscription.go.tmpl
+sweeper:
+  url_substitutions:
+    - region: "US"
 examples:
   - name: 'bigquery_analyticshub_listing_subscription_basic'
     primary_resource_id: 'subscription'

mmv1/products/bigqueryconnection/Connection.yaml

@@ -46,11 +46,11 @@ custom_code:
   encoder: 'templates/terraform/encoders/bigquery_connection.go.tmpl'
   post_create: 'templates/terraform/post_create/bigquery_connection_id.go.tmpl'
 sweeper:
-  regions:
-    - "US"
-    - "EU"
-    - "aws-us-east-1"
-    - "azure-eastus2"
+  url_substitutions:
+    - region: "US"
+    - region: "EU"
+    - region: "azure-eastus2"
+    - region: "aws-us-east-1"
 examples:
   - name: 'bigquery_connection_cloud_resource'
     primary_resource_id: 'connection'
@@ -70,10 +70,10 @@ examples:
     oics_vars_overrides:
       'deletion_protection': 'false'
     ignore_read_extra:
- # password removed
+      # password removed
       - 'cloud_sql.0.credential'
     external_providers: ["random", "time"]
-      # Random provider
+    # Random provider
     skip_vcr: true
   - name: 'bigquery_connection_full'
     primary_resource_id: 'connection'
@@ -87,10 +87,10 @@ examples:
     oics_vars_overrides:
       'deletion_protection': 'false'
     ignore_read_extra:
- # password removed
+      # password removed
       - 'cloud_sql.0.credential'
     external_providers: ["random", "time"]
-      # Random provider
+    # Random provider
     skip_vcr: true
   - name: 'bigquery_connection_aws'
     primary_resource_id: 'connection'
@@ -125,6 +125,9 @@ examples:
       connection_id: 'my-connection'
   - name: 'bigquery_connection_sql_with_cmek'
     primary_resource_id: 'bq-connection-cmek'
+    bootstrap_iam:
+      - member: "serviceAccount:bq-{project_number}@bigquery-encryption.iam.gserviceaccount.com"
+        role: "roles/cloudkms.cryptoKeyEncrypterDecrypter"
     vars:
       database_instance_name: 'my-database-instance'
       username: 'user'
@@ -136,7 +139,7 @@ examples:
     oics_vars_overrides:
       'deletion_protection': 'false'
     ignore_read_extra:
- # password removed
+      # password removed
       - 'cloud_sql.0.credential'
 parameters:
 properties:

mmv1/products/bigqueryreservation/CapacityCommitment.yaml

@@ -38,8 +38,8 @@ custom_code:
   constants: 'templates/terraform/constants/bigquery_reservation_capacity_commitment.go.tmpl'
   custom_import: 'templates/terraform/custom_import/bigquery_reservation_capacity_commitment_set_id.go.tmpl'
 sweeper:
-  regions:
-    - "us-west2"
+  url_substitutions:
+    - region: "us-west2"
 examples:
   - name: 'bigquery_reservation_capacity_commitment_basic'
     primary_resource_id: 'commitment'

mmv1/products/certificatemanager/Certificate.yaml

@@ -41,12 +41,12 @@ custom_code:
 schema_version: 1
 state_upgraders: true
 sweeper:
-  regions:
-    - "us-central1"
-    - "us-east1"
-    - "us-south1"
-    - "us-west1"
-    - "us-west2"
+  url_substitutions:
+    - region: "us-central1"
+    - region: "us-east1"
+    - region: "us-west2"
+    - region: "us-west1"
+    - region: "us-south1"
 examples:
   - name: 'certificate_manager_google_managed_certificate_dns'
     primary_resource_id: 'default'

mmv1/products/certificatemanager/DnsAuthorization.yaml

@@ -39,9 +39,9 @@ custom_code:
 schema_version: 1
 state_upgraders: true
 sweeper:
-  regions:
-    - "global"
-    - "us-central1"
+  url_substitutions:
+    - region: "us-central1"
+    - region: "global"
 examples:
   - name: 'certificate_manager_dns_authorization_basic'
     primary_resource_id: 'default'

mmv1/products/certificatemanager/TrustConfig.yaml

@@ -41,9 +41,9 @@ async:
     resource_inside_response: false
 custom_code:
 sweeper:
-  regions:
-    - "global"
-    - "us-central1"
+  url_substitutions:
+    - region: "global"
+    - region: "us-central1"
 examples:
   - name: 'certificate_manager_trust_config'
     primary_resource_id: 'default'

mmv1/products/cloudbuild/Trigger.yaml

@@ -47,9 +47,9 @@ custom_diff:
 schema_version: 2
 state_upgraders: true
 sweeper:
-  regions:
-    - "us-central1"
-    - "global"
+  url_substitutions:
+    - region: "us-central1"
+    - region: "global"
 examples:
   - name: 'cloudbuild_trigger_filename'
     primary_resource_id: 'filename-trigger'

mmv1/products/cloudbuildv2/Connection.yaml

@@ -50,9 +50,9 @@ custom_code:
 exclude_tgc: true
 legacy_long_form_project: true
 sweeper:
-  regions:
-    - "us-west1"
-    - "us-central1"
+  url_substitutions:
+    - region: "us-central1"
+    - region: "us-west1"
 examples:
   - name: 'cloudbuildv2_connection'
     primary_resource_id: 'my-connection'

mmv1/products/cloudfunctions2/Function.yaml

@@ -57,10 +57,10 @@ custom_code:
   encoder: 'templates/terraform/encoders/cloudfunctions2_runtime_update_policy.go.tmpl'
 taint_resource_on_failed_create: true
 sweeper:
-  regions:
-    - "us-central1"
-    - "us-west1"
-    - "europe-west6"
+  url_substitutions:
+    - region: "us-central1"
+    - region: "europe-west6"
+    - region: "us-west1"
 examples:
   - name: 'cloudfunctions2_basic'
     primary_resource_id: 'function'

mmv1/products/cloudrun/Service.yaml

@@ -61,10 +61,10 @@ schema_version: 2
 state_upgrade_base_schema_version: 1
 state_upgraders: true
 sweeper:
-  regions:
-    - "us-central1"
-    - "europe-west1"
-    - "europe-north1"
+  url_substitutions:
+    - region: "us-central1"
+    - region: "europe-west1"
+    - region: "europe-north1"
 examples:
   - name: 'cloud_run_service_basic'
     primary_resource_id: 'default'
@@ -475,7 +475,8 @@ properties:
                                     description: |-
                                       The name of the secret in Cloud Secret Manager. By default, the secret is assumed to be in the same project.
                                       If the secret is in another project, you must define an alias.
-                                      An alias definition has the form: :projects/{project-id|project-number}/secrets/.
+                                      An alias definition has the form:
+                                      {alias}:projects/{project-id|project-number}/secrets/{secret-name}.
                                       If multiple alias definitions are needed, they must be separated by commas.
                                       The alias definitions must be set on the run.googleapis.com/secrets annotation.
                                     required: true

mmv1/products/colab/Schedule.yaml

@@ -37,7 +37,7 @@ custom_code:
   post_update: 'templates/terraform/post_update/colab_schedule.go.tmpl'
   constants: 'templates/terraform/constants/colab_schedule.go.tmpl'
 sweeper:
-  sweepable_identifier_field: 'displayName'
+  identifier_field: 'displayName'
 examples:
   - name: 'colab_schedule_basic'
     primary_resource_id: 'schedule'

mmv1/products/compute/Address.yaml

@@ -52,12 +52,12 @@ collection_url_key: 'items'
 custom_code:
   post_create: 'templates/terraform/post_create/labels.tmpl'
 sweeper:
-  regions:
-    - "us-west1"
-    - "us-west2"
-    - "us-central1"
-    - "us-east1"
-    - "europe-west1"
+  url_substitutions:
+    - region: "us-west2"
+    - region: "us-central1"
+    - region: "us-east1"
+    - region: "europe-west1"
+    - region: "us-west1"
 examples:
   - name: 'address_basic'
     primary_resource_id: 'ip_address'

mmv1/products/compute/Autoscaler.yaml

@@ -41,6 +41,10 @@ async:
     resource_inside_response: false
 collection_url_key: 'items'
 custom_code:
+sweeper:
+  url_substitutions:
+    - zone: "us-central1-a"
+    - zone: "us-central1-f"
 examples:
   - name: 'autoscaler_single_instance'
     primary_resource_id: 'default'