apigee: add access_logging_config support for google_apigee_instance (#14410) (#10303)

[upstream:2cd585e56bba61bf072a843e3ebeee26b90f7639]

Signed-off-by: Modular Magician <[email protected]>

Author: modular-magician

.changelog/14410.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+apigee: add `access_logging_config` field to `google_apigee_instance`
+```

google-beta/services/apigee/resource_apigee_instance.go

@@ -95,6 +95,30 @@ func ResourceApigeeInstance() *schema.Resource {
 				Description: `The Apigee Organization associated with the Apigee instance,
 in the format 'organizations/{{org_name}}'.`,
 			},
+			"access_logging_config": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Description: `Access logging configuration enables the access logging feature at the instance.
+Apigee customers can enable access logging to ship the access logs to their own project's cloud logging.`,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enabled": {
+							Type:        schema.TypeBool,
+							Required:    true,
+							Description: `Boolean flag that specifies whether the customer access log feature is enabled.`,
+						},
+						"filter": {
+							Type:     schema.TypeString,
+							Optional: true,
+							Description: `Ship the access log entries that match the statusCode defined in the filter.
+The statusCode is the only expected/supported filter field. (Ex: statusCode)
+The filter will parse it to the Common Expression Language semantics for expression
+evaluation to build the filter condition. (Ex: "filter": statusCode >= 200 && statusCode < 300 )`,
+						},
+					},
+				},
+			},
 			"consumer_accept_list": {
 				Type:             schema.TypeList,
 				Computed:         true,
@@ -225,6 +249,12 @@ func resourceApigeeInstanceCreate(d *schema.ResourceData, meta interface{}) erro
 	} else if v, ok := d.GetOkExists("consumer_accept_list"); !tpgresource.IsEmptyValue(reflect.ValueOf(consumerAcceptListProp)) && (ok || !reflect.DeepEqual(v, consumerAcceptListProp)) {
 		obj["consumerAcceptList"] = consumerAcceptListProp
 	}
+	accessLoggingConfigProp, err := expandApigeeInstanceAccessLoggingConfig(d.Get("access_logging_config"), d, config)
+	if err != nil {
+		return err
+	} else if v, ok := d.GetOkExists("access_logging_config"); !tpgresource.IsEmptyValue(reflect.ValueOf(accessLoggingConfigProp)) && (ok || !reflect.DeepEqual(v, accessLoggingConfigProp)) {
+		obj["accessLoggingConfig"] = accessLoggingConfigProp
+	}
 
 	lockName, err := tpgresource.ReplaceVars(d, config, "{{org_id}}/apigeeInstances")
 	if err != nil {
@@ -347,6 +377,9 @@ func resourceApigeeInstanceRead(d *schema.ResourceData, meta interface{}) error
 	if err := d.Set("service_attachment", flattenApigeeInstanceServiceAttachment(res["serviceAttachment"], d, config)); err != nil {
 		return fmt.Errorf("Error reading Instance: %s", err)
 	}
+	if err := d.Set("access_logging_config", flattenApigeeInstanceAccessLoggingConfig(res["accessLoggingConfig"], d, config)); err != nil {
+		return fmt.Errorf("Error reading Instance: %s", err)
+	}
 
 	return nil
 }
@@ -367,6 +400,12 @@ func resourceApigeeInstanceUpdate(d *schema.ResourceData, meta interface{}) erro
 	} else if v, ok := d.GetOkExists("consumer_accept_list"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, consumerAcceptListProp)) {
 		obj["consumerAcceptList"] = consumerAcceptListProp
 	}
+	accessLoggingConfigProp, err := expandApigeeInstanceAccessLoggingConfig(d.Get("access_logging_config"), d, config)
+	if err != nil {
+		return err
+	} else if v, ok := d.GetOkExists("access_logging_config"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, accessLoggingConfigProp)) {
+		obj["accessLoggingConfig"] = accessLoggingConfigProp
+	}
 
 	lockName, err := tpgresource.ReplaceVars(d, config, "{{org_id}}/apigeeInstances")
 	if err != nil {
@@ -387,6 +426,10 @@ func resourceApigeeInstanceUpdate(d *schema.ResourceData, meta interface{}) erro
 	if d.HasChange("consumer_accept_list") {
 		updateMask = append(updateMask, "consumerAcceptList")
 	}
+
+	if d.HasChange("access_logging_config") {
+		updateMask = append(updateMask, "accessLoggingConfig")
+	}
 	// updateMask is a URL parameter but not present in the schema, so ReplaceVars
 	// won't set it
 	url, err = transport_tpg.AddQueryParams(url, map[string]string{"updateMask": strings.Join(updateMask, ",")})
@@ -574,6 +617,29 @@ func flattenApigeeInstanceServiceAttachment(v interface{}, d *schema.ResourceDat
 	return v
 }
 
+func flattenApigeeInstanceAccessLoggingConfig(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	if v == nil {
+		return nil
+	}
+	original := v.(map[string]interface{})
+	if len(original) == 0 {
+		return nil
+	}
+	transformed := make(map[string]interface{})
+	transformed["enabled"] =
+		flattenApigeeInstanceAccessLoggingConfigEnabled(original["enabled"], d, config)
+	transformed["filter"] =
+		flattenApigeeInstanceAccessLoggingConfigFilter(original["filter"], d, config)
+	return []interface{}{transformed}
+}
+func flattenApigeeInstanceAccessLoggingConfigEnabled(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
+func flattenApigeeInstanceAccessLoggingConfigFilter(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
 func expandApigeeInstanceName(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
 	return v, nil
 }
@@ -605,3 +671,37 @@ func expandApigeeInstanceDiskEncryptionKeyName(v interface{}, d tpgresource.Terr
 func expandApigeeInstanceConsumerAcceptList(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
 	return v, nil
 }
+
+func expandApigeeInstanceAccessLoggingConfig(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	l := v.([]interface{})
+	if len(l) == 0 || l[0] == nil {
+		return nil, nil
+	}
+	raw := l[0]
+	original := raw.(map[string]interface{})
+	transformed := make(map[string]interface{})
+
+	transformedEnabled, err := expandApigeeInstanceAccessLoggingConfigEnabled(original["enabled"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedEnabled); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["enabled"] = transformedEnabled
+	}
+
+	transformedFilter, err := expandApigeeInstanceAccessLoggingConfigFilter(original["filter"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedFilter); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["filter"] = transformedFilter
+	}
+
+	return transformed, nil
+}
+
+func expandApigeeInstanceAccessLoggingConfigEnabled(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
+func expandApigeeInstanceAccessLoggingConfigFilter(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}

google-beta/services/apigee/resource_apigee_instance_generated_meta.yaml

@@ -5,6 +5,8 @@ api_service_name: 'apigee.googleapis.com'
 api_version: 'v1'
 api_resource_type_kind: 'Instance'
 fields:
+  - field: 'access_logging_config.enabled'
+  - field: 'access_logging_config.filter'
   - field: 'consumer_accept_list'
   - field: 'description'
   - field: 'disk_encryption_key_name'

google-beta/services/apigee/resource_apigee_instance_generated_test.go

@@ -530,6 +530,11 @@ resource "google_apigee_instance" "apigee_instance" {
   display_name             = "tf-test%{random_suffix}"
   org_id                   = google_apigee_organization.apigee_org.id
   disk_encryption_key_name = google_kms_crypto_key.apigee_key.id
+
+  access_logging_config {
+    enabled = true,
+    filter  = "status_code >= 200 && status_code < 300"
+  }
 }
 `, context)
 }

google-beta/services/apigee/resource_apigee_instance_update_test.go

@@ -136,6 +136,11 @@ resource "google_apigee_instance" "apigee_instance" {
   consumer_accept_list = [
     google_project.project1.project_id,
   ]
+
+  access_logging_config {
+    enabled = false,
+    filter  = "status_code >= 0 && status_code < 600"
+  }
 }
 `, context)
 }
@@ -220,6 +225,11 @@ resource "google_apigee_instance" "apigee_instance" {
     google_project.project1.project_id,
     google_project.project2.project_id,
   ]
+
+  access_logging_config {
+    enabled = true,
+    filter  = "status_code >= 200 && status_code < 300"
+  }
 }
 `, context)
 }

website/docs/r/apigee_instance.html.markdown

@@ -272,7 +272,26 @@ The following arguments are supported:
   which the customers can provide during the instance creation. By default, the customer
   project associated with the Apigee organization will be included to the list.
 
+* `access_logging_config` -
+  (Optional)
+  Access logging configuration enables the access logging feature at the instance.
+  Apigee customers can enable access logging to ship the access logs to their own project's cloud logging.
+  Structure is [documented below](#nested_access_logging_config).
+
+
+
+<a name="nested_access_logging_config"></a>The `access_logging_config` block supports:
 
+* `enabled` -
+  (Required)
+  Boolean flag that specifies whether the customer access log feature is enabled.
+
+* `filter` -
+  (Optional)
+  Ship the access log entries that match the statusCode defined in the filter.
+  The statusCode is the only expected/supported filter field. (Ex: statusCode)
+  The filter will parse it to the Common Expression Language semantics for expression
+  evaluation to build the filter condition. (Ex: "filter": statusCode >= 200 && statusCode < 300 )
 
 ## Attributes Reference