google_access_context_manager_service_perimeter_resource should be able add ingress and egress rules

[aweberlopes]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

It would be really nice besides resources added to perimeter that is possible to add ingress and egress rules to existing perimeter without touch the init deployment.

1. Create a Perimeter
2. Add Resources to the perimeter using google_access_context_manager_service_perimeter_resource
3. Add Ingress/Egress Rules that added via google_access_context_manager_service_perimeter_resource

New or Affected Resource(s)

• google_access_context_manager_service_perimeter_resource

Potential Terraform Configuration

resource "google_access_context_manager_service_perimeter_resource" "service-perimeter-resource" {
  perimeter_name = google_access_context_manager_service_perimeter.service-perimeter-resource.name
  resource = "projects/987654321"
  ingress_policies {
            ingress_from {
                sources {
                    access_level = google_access_context_manager_access_level.test-access.name
                }
                identity_type = "ANY_IDENTITY"
            }

            ingress_to {
                resources = [ "*" ]
                operations {
                    service_name = "bigquery.googleapis.com"

                    method_selectors {
                        method = "BigQueryStorage.ReadRows"
                    }

                    method_selectors {
                        method = "TableService.ListTables"
                    }

                    method_selectors {
                        permission = "bigquery.jobs.get"
                    }
                }

                operations {
                    service_name = "storage.googleapis.com"

                    method_selectors {
                        method = "google.storage.objects.create"
                    }
                }
            }
        }
  egress_policies {
            egress_from {
                identity_type = "ANY_USER_ACCOUNT"
            }
        }
  }
}

[CAR]

Similar to IAM policies in Terraform, without such a feature VPC SC Ingress/Egress is not scalable. Is there a roadmap to implement this feature? It is highly anticipated.

[rico-schmidt]

Added a +1. Decentralised management IAM policies is a big plus of the google terraform provider. An equivalent feature VPC SC policies is very impactful.

[CAR]

@rileykarson Any chance of an update here?

[snuggie12]

I'd like to see this for both igress/egress as well as projects. Should that be a separate request?