Add support for google_service_account_key

google/provider.go

@@ -125,6 +125,7 @@ func Provider() terraform.ResourceProvider {
 			"google_runtimeconfig_config":                  resourceRuntimeconfigConfig(),
 			"google_runtimeconfig_variable":                resourceRuntimeconfigVariable(),
 			"google_service_account":                       resourceGoogleServiceAccount(),
+			"google_service_account_key":                   resourceGoogleServiceAccountKey(),
 			"google_storage_bucket":                        resourceStorageBucket(),
 			"google_storage_bucket_acl":                    resourceStorageBucketAcl(),
 			"google_storage_bucket_object":                 resourceStorageBucketObject(),

google/resource_google_service_account_key.go

@@ -0,0 +1,175 @@
+package google
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/terraform/helper/encryption"
+	"github.com/hashicorp/terraform/helper/schema"
+	"google.golang.org/api/iam/v1"
+)
+
+func resourceGoogleServiceAccountKey() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceGoogleServiceAccountKeyCreate,
+		Read:   resourceGoogleServiceAccountKeyRead,
+		Delete: resourceGoogleServiceAccountKeyDelete,
+		Schema: map[string]*schema.Schema{
+			// Required
+			"service_account_id": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"public_key_type": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			// Optional
+			"private_key_type": &schema.Schema{
+				Type:     schema.TypeString,
+				Default:  "TYPE_GOOGLE_CREDENTIALS_FILE",
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"key_algorithm": &schema.Schema{
+				Type:     schema.TypeString,
+				Default:  "KEY_ALG_RSA_2048",
+				Optional: true,
+				ForceNew: true,
+			},
+
+			"pgp_key": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+			"private_key": &schema.Schema{
+				Type:      schema.TypeString,
+				Computed:  true,
+				Sensitive: true,
+			},
+			"public_key": {
+				Type:     schema.TypeString,
+				Computed: true,
+				Optional: true,
+				ForceNew: true,
+			},
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+				Optional: true,
+				ForceNew: true,
+			},
+			// Computed
+			"valid_after": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"valid_before": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"private_key_encrypted": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"private_key_fingerprint": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceGoogleServiceAccountKeyCreate(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+
+	serviceAccount := d.Get("service_account_id").(string)
+
+	r := &iam.CreateServiceAccountKeyRequest{}
+
+	if v, ok := d.GetOk("key_algorithm"); ok {
+		r.KeyAlgorithm = v.(string)
+	}
+
+	var pubKey string
+	var err error
+	if pubkeyInterface, ok := d.GetOk("public_key"); ok {
+		pubKey = pubkeyInterface.(string)
+	}
+
+	if pubKey == "" {
+
+		if v, ok := d.GetOk("private_key_type"); ok {
+			r.PrivateKeyType = v.(string)
+		}
+
+		sak, err := config.clientIAM.Projects.ServiceAccounts.Keys.Create(serviceAccount, r).Do()
+		if err != nil || sak == nil {
+			return fmt.Errorf("Error creating service account key: %s", err)
+		}
+
+		d.SetId(sak.Name)
+		// Data only available on create.
+		d.Set("valid_after", sak.ValidAfterTime)
+		d.Set("valid_before", sak.ValidBeforeTime)
+		if v, ok := d.GetOk("pgp_key"); ok {
+			encryptionKey, err := encryption.RetrieveGPGKey(v.(string))
+			if err != nil {
+				return err
+			}
+
+			fingerprint, encrypted, err := encryption.EncryptValue(encryptionKey, sak.PrivateKeyData, "Google Service Account Key")
+			if err != nil {
+				return err
+			}
+
+			d.Set("private_key_encrypted", encrypted)
+			d.Set("private_key_fingerprint", fingerprint)
+		} else {
+			d.Set("private_key", sak.PrivateKeyData)
+		}
+	}
+
+	err = serviceAccountKeyWaitTime(config.clientIAM.Projects.ServiceAccounts.Keys, d.Id(), d.Get("public_key_type").(string), "Creating Service account key", 4)
+	if err != nil {
+		return err
+	}
+	resourceGoogleServiceAccountKeyRead(d, meta)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func resourceGoogleServiceAccountKeyRead(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+
+	publicKeyType := d.Get("public_key_type").(string)
+
+	// Confirm the service account key exists
+	sak, err := config.clientIAM.Projects.ServiceAccounts.Keys.Get(d.Id()).PublicKeyType(publicKeyType).Do()
+	if err != nil {
+		return handleNotFoundError(err, d, fmt.Sprintf("Service Account Key %q", d.Id()))
+	}
+
+	d.Set("name", sak.Name)
+	d.Set("key_algorithm", sak.KeyAlgorithm)
+	d.Set("public_key", sak.PublicKeyData)
+	return nil
+}
+
+func resourceGoogleServiceAccountKeyDelete(d *schema.ResourceData, meta interface{}) error {
+	config := meta.(*Config)
+
+	_, err := config.clientIAM.Projects.ServiceAccounts.Keys.Delete(d.Id()).Do()
+	if err != nil {
+		return err
+	}
+
+	d.SetId("")
+	return nil
+}

google/resource_google_service_account_key_test.go

@@ -0,0 +1,60 @@
+package google
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/acctest"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+// Test that a service account key can be created and destroyed
+func TestAccGoogleServiceAccountKey_basic(t *testing.T) {
+	resourceName := "google_service_account_key.acceptance"
+	accountID := "a" + acctest.RandString(10)
+	displayName := "Terraform Test"
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccGoogleServiceAccountKey(accountID, displayName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGoogleServiceAccountKeyExists(resourceName),
+					resource.TestCheckResourceAttrSet(resourceName, "public_key"),
+					resource.TestCheckResourceAttrSet(resourceName, "valid_after"),
+					resource.TestCheckResourceAttrSet(resourceName, "valid_before"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckGoogleServiceAccountKeyExists(r string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[r]
+		if !ok {
+			return fmt.Errorf("Not found: %s", r)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No ID is set")
+		}
+
+		return nil
+	}
+}
+
+func testAccGoogleServiceAccountKey(account, name string) string {
+	return fmt.Sprintf(`resource "google_service_account" "acceptance" {
+	account_id = "%v"
+	display_name = "%v"
+
+	}
+
+	resource "google_service_account_key" "acceptance" {
+		service_account_id = "${google_service_account.acceptance.id}"
+		public_key_type = "TYPE_X509_PEM_FILE"
+	}`, account, name)
+}

google/service_account_waiter.go

@@ -0,0 +1,61 @@
+package google
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"google.golang.org/api/googleapi"
+	iam "google.golang.org/api/iam/v1"
+)
+
+type ServiceAccountKeyWaiter struct {
+	Service       *iam.ProjectsServiceAccountsKeysService
+	PublicKeyType string
+	KeyName       string
+}
+
+func (w *ServiceAccountKeyWaiter) RefreshFunc() resource.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		var err error
+		var sak *iam.ServiceAccountKey
+		sak, err = w.Service.Get(w.KeyName).PublicKeyType(w.PublicKeyType).Do()
+
+		if err != nil {
+			if err.(*googleapi.Error).Code == 404 {
+				return nil, "PENDING", nil
+			} else {
+				return nil, "", err
+			}
+		} else {
+			return sak, "DONE", nil
+		}
+	}
+}
+
+func (w *ServiceAccountKeyWaiter) Conf() *resource.StateChangeConf {
+	return &resource.StateChangeConf{
+		Pending: []string{"PENDING"},
+		Target:  []string{"DONE"},
+		Refresh: w.RefreshFunc(),
+	}
+}
+
+func serviceAccountKeyWaitTime(client *iam.ProjectsServiceAccountsKeysService, keyName, publicKeyType, activity string, timeoutMin int) error {
+	w := &ServiceAccountKeyWaiter{
+		Service:       client,
+		PublicKeyType: publicKeyType,
+		KeyName:       keyName,
+	}
+
+	state := w.Conf()
+	state.Delay = 10 * time.Second
+	state.Timeout = time.Duration(timeoutMin) * time.Minute
+	state.MinTimeout = 2 * time.Second
+	_, err := state.WaitForState()
+	if err != nil {
+		return fmt.Errorf("Error waiting for %s: %s", activity, err)
+	}
+
+	return nil
+}