Skip to content

Support IAM conditional policies on managed zones#16533

Merged
slevenick merged 22 commits intoGoogleCloudPlatform:mainfrom
shellyvilenko:managed-zones-conditions
Mar 16, 2026
Merged

Support IAM conditional policies on managed zones#16533
slevenick merged 22 commits intoGoogleCloudPlatform:mainfrom
shellyvilenko:managed-zones-conditions

Conversation

@shellyvilenko
Copy link
Copy Markdown
Contributor

@shellyvilenko shellyvilenko commented Feb 25, 2026

…Y_PARAM_NESTED'

included iam_conditions_request_type: 'QUERY_PARAM_NESTED' I think that QUERY_PARAM_NESTED is appropriate here because of the GetIamPolicyRequest

Support Iam conditional policies on dns managed zones

Release Note Template for Downstream PRs (will be copied)

See Write release notes for guidance.

dns: added support for IAM conditions to `google_dns_managed_zone` resource

…Y_PARAM_NESTED'

included iam_conditions_request_type: 'QUERY_PARAM_NESTED' I think that QUERY_PARAM_NESTED is appropriate here because of the GetIamPolicyRequest
add example fort he conditions
Resolve conflicts
@modular-magician
Copy link
Copy Markdown
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 3 files changed, 706 insertions(+), 9 deletions(-))
google-beta provider: Diff ( 3 files changed, 706 insertions(+), 9 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 4 insertions(+))

add usage of template to managedzone.yaml
add managed zone var to template
@modular-magician
Copy link
Copy Markdown
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 3 files changed, 706 insertions(+), 9 deletions(-))
google-beta provider: Diff ( 3 files changed, 706 insertions(+), 9 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 4 insertions(+))

@modular-magician
Copy link
Copy Markdown
Collaborator

Non-exercised tests

🔴 Tests were added that are skipped in VCR:

  • TestAccDNSManagedZoneIamBindingGenerated_withAndWithoutCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withAndWithoutCondition

Tests analytics

Total tests: 56
Passed tests: 47
Skipped tests: 3
Affected tests: 6

Click here to see the affected service packages
  • dns

Action taken

Found 6 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
  • TestAccDNSManagedZoneIamBindingGenerated
  • TestAccDNSManagedZoneIamBindingGenerated_withCondition
  • TestAccDNSManagedZoneIamMemberGenerated
  • TestAccDNSManagedZoneIamMemberGenerated_withCondition
  • TestAccDNSManagedZoneIamPolicyGenerated
  • TestAccDNSManagedZoneIamPolicyGenerated_withCondition

Get to know how VCR tests work

1 similar comment
@modular-magician
Copy link
Copy Markdown
Collaborator

Non-exercised tests

🔴 Tests were added that are skipped in VCR:

  • TestAccDNSManagedZoneIamBindingGenerated_withAndWithoutCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withAndWithoutCondition

Tests analytics

Total tests: 56
Passed tests: 47
Skipped tests: 3
Affected tests: 6

Click here to see the affected service packages
  • dns

Action taken

Found 6 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
  • TestAccDNSManagedZoneIamBindingGenerated
  • TestAccDNSManagedZoneIamBindingGenerated_withCondition
  • TestAccDNSManagedZoneIamMemberGenerated
  • TestAccDNSManagedZoneIamMemberGenerated_withCondition
  • TestAccDNSManagedZoneIamPolicyGenerated
  • TestAccDNSManagedZoneIamPolicyGenerated_withCondition

Get to know how VCR tests work

@modular-magician
Copy link
Copy Markdown
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 5 files changed, 792 insertions(+), 9 deletions(-))
google-beta provider: Diff ( 5 files changed, 792 insertions(+), 9 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 4 insertions(+))
Open in Cloud Shell: Diff ( 4 files changed, 124 insertions(+))

@modular-magician
Copy link
Copy Markdown
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 5 files changed, 792 insertions(+), 9 deletions(-))
google-beta provider: Diff ( 5 files changed, 792 insertions(+), 9 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 4 insertions(+))
Open in Cloud Shell: Diff ( 4 files changed, 124 insertions(+))

@modular-magician
Copy link
Copy Markdown
Collaborator

Non-exercised tests

🔴 Tests were added that are skipped in VCR:

  • TestAccDNSManagedZoneIamBindingGenerated_withAndWithoutCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withAndWithoutCondition

Tests analytics

Total tests: 57
Passed tests: 50
Skipped tests: 3
Affected tests: 4

Click here to see the affected service packages
  • dns

Action taken

Found 4 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
  • TestAccDNSManagedZoneIamBindingGenerated_withCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withCondition
  • TestAccDNSManagedZoneIamPolicyGenerated_withCondition
  • TestAccDNSManagedZone_dnsManagedZoneIamConditionExample

Get to know how VCR tests work

1 similar comment
@modular-magician
Copy link
Copy Markdown
Collaborator

Non-exercised tests

🔴 Tests were added that are skipped in VCR:

  • TestAccDNSManagedZoneIamBindingGenerated_withAndWithoutCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withAndWithoutCondition

Tests analytics

Total tests: 57
Passed tests: 50
Skipped tests: 3
Affected tests: 4

Click here to see the affected service packages
  • dns

Action taken

Found 4 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
  • TestAccDNSManagedZoneIamBindingGenerated_withCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withCondition
  • TestAccDNSManagedZoneIamPolicyGenerated_withCondition
  • TestAccDNSManagedZone_dnsManagedZoneIamConditionExample

Get to know how VCR tests work

@modular-magician
Copy link
Copy Markdown
Collaborator

🔴 Tests failed during RECORDING mode:
TestAccDNSManagedZoneIamBindingGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZoneIamMemberGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZoneIamPolicyGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZone_dnsManagedZoneIamConditionExample [Error message] [Debug log]

🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR.

View the build log or the debug log for each test

@modular-magician
Copy link
Copy Markdown
Collaborator

🟢 Tests passed during RECORDING mode:
TestAccDNSManagedZoneIamBindingGenerated [Debug log]
TestAccDNSManagedZoneIamMemberGenerated [Debug log]
TestAccDNSManagedZoneIamPolicyGenerated [Debug log]

🟢 No issues found for passed tests after REPLAYING rerun.


🔴 Tests failed during RECORDING mode:
TestAccDNSManagedZoneIamBindingGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZoneIamMemberGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZoneIamPolicyGenerated_withCondition [Error message] [Debug log]

🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR.

View the build log or the debug log for each test

@modular-magician
Copy link
Copy Markdown
Collaborator

🟢 Tests passed during RECORDING mode:
TestAccDNSManagedZoneIamMemberGenerated [Debug log]
TestAccDNSManagedZoneIamPolicyGenerated [Debug log]

🟢 No issues found for passed tests after REPLAYING rerun.


🔴 Tests failed during RECORDING mode:
TestAccDNSManagedZoneIamBindingGenerated [Error message] [Debug log]
TestAccDNSManagedZoneIamBindingGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZoneIamMemberGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZoneIamPolicyGenerated_withCondition [Error message] [Debug log]

🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR.

View the build log or the debug log for each test

randomize dns name in tests
use randomized dns name in tests
@modular-magician
Copy link
Copy Markdown
Collaborator

🔴 Tests failed during RECORDING mode:
TestAccDNSManagedZoneIamBindingGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZoneIamMemberGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZoneIamPolicyGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZone_dnsManagedZoneIamConditionExample [Error message] [Debug log]

🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR.

View the build log or the debug log for each test

@modular-magician
Copy link
Copy Markdown
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 5 files changed, 793 insertions(+), 9 deletions(-))
google-beta provider: Diff ( 5 files changed, 793 insertions(+), 9 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 4 insertions(+))
Open in Cloud Shell: Diff ( 4 files changed, 124 insertions(+))

@modular-magician
Copy link
Copy Markdown
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 5 files changed, 793 insertions(+), 9 deletions(-))
google-beta provider: Diff ( 5 files changed, 793 insertions(+), 9 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 4 insertions(+))
Open in Cloud Shell: Diff ( 4 files changed, 124 insertions(+))

@modular-magician
Copy link
Copy Markdown
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 5 files changed, 793 insertions(+), 9 deletions(-))
google-beta provider: Diff ( 5 files changed, 793 insertions(+), 9 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 4 insertions(+))
Open in Cloud Shell: Diff ( 4 files changed, 124 insertions(+))

@modular-magician
Copy link
Copy Markdown
Collaborator

Non-exercised tests

🔴 Tests were added that are skipped in VCR:

  • TestAccDNSManagedZoneIamBindingGenerated_withAndWithoutCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withAndWithoutCondition

Tests analytics

Total tests: 57
Passed tests: 50
Skipped tests: 3
Affected tests: 4

Click here to see the affected service packages
  • dns

Action taken

Found 4 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
  • TestAccDNSManagedZoneIamBindingGenerated_withCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withCondition
  • TestAccDNSManagedZoneIamPolicyGenerated_withCondition
  • TestAccDNSManagedZone_dnsManagedZoneIamConditionExample

Get to know how VCR tests work

2 similar comments
@modular-magician
Copy link
Copy Markdown
Collaborator

Non-exercised tests

🔴 Tests were added that are skipped in VCR:

  • TestAccDNSManagedZoneIamBindingGenerated_withAndWithoutCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withAndWithoutCondition

Tests analytics

Total tests: 57
Passed tests: 50
Skipped tests: 3
Affected tests: 4

Click here to see the affected service packages
  • dns

Action taken

Found 4 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
  • TestAccDNSManagedZoneIamBindingGenerated_withCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withCondition
  • TestAccDNSManagedZoneIamPolicyGenerated_withCondition
  • TestAccDNSManagedZone_dnsManagedZoneIamConditionExample

Get to know how VCR tests work

@modular-magician
Copy link
Copy Markdown
Collaborator

Non-exercised tests

🔴 Tests were added that are skipped in VCR:

  • TestAccDNSManagedZoneIamBindingGenerated_withAndWithoutCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withAndWithoutCondition

Tests analytics

Total tests: 57
Passed tests: 50
Skipped tests: 3
Affected tests: 4

Click here to see the affected service packages
  • dns

Action taken

Found 4 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
  • TestAccDNSManagedZoneIamBindingGenerated_withCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withCondition
  • TestAccDNSManagedZoneIamPolicyGenerated_withCondition
  • TestAccDNSManagedZone_dnsManagedZoneIamConditionExample

Get to know how VCR tests work

@modular-magician
Copy link
Copy Markdown
Collaborator

🔴 Tests failed during RECORDING mode:
TestAccDNSManagedZoneIamBindingGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZoneIamMemberGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZoneIamPolicyGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZone_dnsManagedZoneIamConditionExample [Error message] [Debug log]

🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR.

View the build log or the debug log for each test

@modular-magician
Copy link
Copy Markdown
Collaborator

🔴 Tests failed during RECORDING mode:
TestAccDNSManagedZoneIamBindingGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZoneIamMemberGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZoneIamPolicyGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZone_dnsManagedZoneIamConditionExample [Error message] [Debug log]

🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR.

View the build log or the debug log for each test

@modular-magician
Copy link
Copy Markdown
Collaborator

Non-exercised tests

🔴 Tests were added that are skipped in VCR:

  • TestAccDNSManagedZoneIamBindingGenerated_withAndWithoutCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withAndWithoutCondition

Tests analytics

Total tests: 57
Passed tests: 47
Skipped tests: 3
Affected tests: 7

Click here to see the affected service packages
  • dns

Action taken

Found 7 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
  • TestAccDNSManagedZoneIamBindingGenerated
  • TestAccDNSManagedZoneIamBindingGenerated_withCondition
  • TestAccDNSManagedZoneIamMemberGenerated
  • TestAccDNSManagedZoneIamMemberGenerated_withCondition
  • TestAccDNSManagedZoneIamPolicyGenerated
  • TestAccDNSManagedZoneIamPolicyGenerated_withCondition
  • TestAccDNSManagedZone_dnsManagedZoneIamConditionExample

Get to know how VCR tests work

@modular-magician
Copy link
Copy Markdown
Collaborator

🟢 Tests passed during RECORDING mode:
TestAccDNSManagedZoneIamBindingGenerated [Debug log]
TestAccDNSManagedZoneIamBindingGenerated_withCondition [Debug log]
TestAccDNSManagedZoneIamMemberGenerated [Debug log]
TestAccDNSManagedZoneIamMemberGenerated_withCondition [Debug log]

🟢 No issues found for passed tests after REPLAYING rerun.


🔴 Tests failed during RECORDING mode:
TestAccDNSManagedZoneIamPolicyGenerated [Error message] [Debug log]
TestAccDNSManagedZoneIamPolicyGenerated_withCondition [Error message] [Debug log]
TestAccDNSManagedZone_dnsManagedZoneIamConditionExample [Error message] [Debug log]

🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR.

View the build log or the debug log for each test

Change the expression in dns_managed_zone_iam_condition.tf.tmpl to a single-line string to avoid newline-related parsing errors
@modular-magician
Copy link
Copy Markdown
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 5 files changed, 792 insertions(+), 14 deletions(-))
google-beta provider: Diff ( 5 files changed, 792 insertions(+), 14 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 6 insertions(+))
Open in Cloud Shell: Diff ( 4 files changed, 120 insertions(+))

@modular-magician
Copy link
Copy Markdown
Collaborator

Non-exercised tests

🔴 Tests were added that are skipped in VCR:

  • TestAccDNSManagedZoneIamBindingGenerated_withAndWithoutCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withAndWithoutCondition

Tests analytics

Total tests: 57
Passed tests: 51
Skipped tests: 3
Affected tests: 3

Click here to see the affected service packages
  • dns

Action taken

Found 3 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
  • TestAccDNSManagedZoneIamPolicyGenerated
  • TestAccDNSManagedZoneIamPolicyGenerated_withCondition
  • TestAccDNSManagedZone_dnsManagedZoneIamConditionExample

Get to know how VCR tests work

@modular-magician
Copy link
Copy Markdown
Collaborator

🟢 Tests passed during RECORDING mode:
TestAccDNSManagedZoneIamPolicyGenerated [Debug log]
TestAccDNSManagedZoneIamPolicyGenerated_withCondition [Debug log]

🟢 No issues found for passed tests after REPLAYING rerun.


🔴 Tests failed during RECORDING mode:
TestAccDNSManagedZone_dnsManagedZoneIamConditionExample [Error message] [Debug log]

🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR.

View the build log or the debug log for each test

try to use admin@hashicorptest.com instead of made up account
@modular-magician
Copy link
Copy Markdown
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 5 files changed, 792 insertions(+), 14 deletions(-))
google-beta provider: Diff ( 5 files changed, 792 insertions(+), 14 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 6 insertions(+))
Open in Cloud Shell: Diff ( 4 files changed, 120 insertions(+))

@modular-magician
Copy link
Copy Markdown
Collaborator

Non-exercised tests

🔴 Tests were added that are skipped in VCR:

  • TestAccDNSManagedZoneIamBindingGenerated_withAndWithoutCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withAndWithoutCondition

Tests analytics

Total tests: 57
Passed tests: 53
Skipped tests: 3
Affected tests: 1

Click here to see the affected service packages
  • dns

Action taken

Found 1 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
  • TestAccDNSManagedZone_dnsManagedZoneIamConditionExample

Get to know how VCR tests work

@modular-magician
Copy link
Copy Markdown
Collaborator

🟢 Tests passed during RECORDING mode:
TestAccDNSManagedZone_dnsManagedZoneIamConditionExample [Debug log]

🟢 No issues found for passed tests after REPLAYING rerun.


🟢 All tests passed!

View the build log or the debug log for each test

@ScottSuarez ScottSuarez marked this pull request as ready for review March 11, 2026 21:36
@github-actions github-actions bot requested a review from slevenick March 11, 2026 21:36
@github-actions
Copy link
Copy Markdown

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@slevenick, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

@modular-magician
Copy link
Copy Markdown
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 5 files changed, 792 insertions(+), 14 deletions(-))
google-beta provider: Diff ( 5 files changed, 792 insertions(+), 14 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 6 insertions(+))
Open in Cloud Shell: Diff ( 4 files changed, 120 insertions(+))

@modular-magician
Copy link
Copy Markdown
Collaborator

Non-exercised tests

🔴 Tests were added that are skipped in VCR:

  • TestAccDNSManagedZoneIamBindingGenerated_withAndWithoutCondition
  • TestAccDNSManagedZoneIamMemberGenerated_withAndWithoutCondition

Tests analytics

Total tests: 57
Passed tests: 54
Skipped tests: 3
Affected tests: 0

Click here to see the affected service packages
  • dns

🟢 All tests passed!

View the build log

@github-actions
Copy link
Copy Markdown

@slevenick This PR has been waiting for review for 3 weekdays. Please take a look! Use the label disable-review-reminders to disable these notifications.

Copy link
Copy Markdown
Contributor

@slevenick slevenick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@slevenick slevenick added this pull request to the merge queue Mar 16, 2026
Merged via the queue into GoogleCloudPlatform:main with commit 3aeaaf3 Mar 16, 2026
24 checks passed
slevenick added a commit to slevenick/magic-modules that referenced this pull request Mar 17, 2026
aditikumarii-google pushed a commit to aditikumarii-google/magic-modules that referenced this pull request Mar 18, 2026
zli82016 pushed a commit to zli82016/magic-modules that referenced this pull request Mar 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants