From 6235f5a38c1dd29958e6a0776a77754e77054e89 Mon Sep 17 00:00:00 2001 From: Shobhit Narayan Date: Mon, 6 Jul 2026 19:36:23 +0000 Subject: [PATCH 1/2] securesourcemanager: Add service_account and scan_config to Repository --- .../securesourcemanager/Repository.yaml | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/mmv1/products/securesourcemanager/Repository.yaml b/mmv1/products/securesourcemanager/Repository.yaml index 70e7c3386d5a..e3c88e658928 100644 --- a/mmv1/products/securesourcemanager/Repository.yaml +++ b/mmv1/products/securesourcemanager/Repository.yaml @@ -174,3 +174,25 @@ properties: description: | README template name. Valid values can be viewed at https://cloud.google.com/secure-source-manager/docs/reference/rest/v1/projects.locations.repositories#initialconfig. + - name: 'serviceAccount' + type: String + description: | + Repository level service account (BYOSA). + - name: 'scanConfig' + type: NestedObject + description: | + Provides configuration for scanning. + properties: + - name: 'secretScanConfig' + type: NestedObject + description: | + Configuration for secret scanning. + properties: + - name: 'enabled' + type: Boolean + description: | + Enables secret scanning for the repository. + - name: 'inspectTemplate' + type: String + description: | + The DLP inspect template to use for secret scanning. From b8f1499470e2ade5d3bde57428a9a85430c1eb69 Mon Sep 17 00:00:00 2001 From: Shobhit Narayan Date: Thu, 9 Jul 2026 15:41:42 +0000 Subject: [PATCH 2/2] securesourcemanager: Remove BYOSA mention and add regional template test configurations --- .../securesourcemanager/Repository.yaml | 36 ++++++++++++++++++- ...manager_repository_secret_scanning.tf.tmpl | 30 ++++++++++++++++ ...manager_repository_service_account.tf.tmpl | 19 ++++++++++ 3 files changed, 84 insertions(+), 1 deletion(-) create mode 100644 mmv1/templates/terraform/samples/services/securesourcemanager/secure_source_manager_repository_secret_scanning.tf.tmpl create mode 100644 mmv1/templates/terraform/samples/services/securesourcemanager/secure_source_manager_repository_service_account.tf.tmpl diff --git a/mmv1/products/securesourcemanager/Repository.yaml b/mmv1/products/securesourcemanager/Repository.yaml index e3c88e658928..b5cac1ada0ba 100644 --- a/mmv1/products/securesourcemanager/Repository.yaml +++ b/mmv1/products/securesourcemanager/Repository.yaml @@ -75,6 +75,39 @@ samples: deletion_policy: '"DELETE"' ignore_read_extra: - deletion_policy + - name: secure_source_manager_repository_service_account + primary_resource_id: default + steps: + - name: secure_source_manager_repository_service_account + resource_id_vars: + repository_id: my-repository + instance_id: my-instance + deletion_policy: PREVENT + sa_id: my-sa + test_vars_overrides: + deletion_policy: '"DELETE"' + oics_vars_overrides: + deletion_policy: '"DELETE"' + ignore_read_extra: + - deletion_policy + - name: secure_source_manager_repository_secret_scanning + primary_resource_id: default + steps: + - name: secure_source_manager_repository_secret_scanning + resource_id_vars: + repository_id: my-repository + instance_id: my-instance + deletion_policy: PREVENT + test_env_vars: + project: PROJECT_NAME + test_vars_overrides: + deletion_policy: '"DELETE"' + oics_vars_overrides: + deletion_policy: '"DELETE"' + ignore_read_extra: + - deletion_policy + + parameters: - name: location type: String @@ -177,9 +210,10 @@ properties: - name: 'serviceAccount' type: String description: | - Repository level service account (BYOSA). + Repository level service account. - name: 'scanConfig' type: NestedObject + diff_suppress_func: 'tpgresource.EmptyOrUnsetBlockDiffSuppress' description: | Provides configuration for scanning. properties: diff --git a/mmv1/templates/terraform/samples/services/securesourcemanager/secure_source_manager_repository_secret_scanning.tf.tmpl b/mmv1/templates/terraform/samples/services/securesourcemanager/secure_source_manager_repository_secret_scanning.tf.tmpl new file mode 100644 index 000000000000..56c8188f9125 --- /dev/null +++ b/mmv1/templates/terraform/samples/services/securesourcemanager/secure_source_manager_repository_secret_scanning.tf.tmpl @@ -0,0 +1,30 @@ +resource "google_secure_source_manager_instance" "instance" { + location = "us-central1" + instance_id = "{{index $.ResourceIdVars "instance_id"}}" + deletion_policy = "{{index $.ResourceIdVars "deletion_policy"}}" +} + +resource "google_data_loss_prevention_inspect_template" "template" { + parent = "projects/{{index $.TestEnvVars "project"}}/locations/us-central1" + display_name = "Test Inspect Template" + + inspect_config { + info_types { + name = "EMAIL_ADDRESS" + } + } +} + +resource "google_secure_source_manager_repository" "{{$.PrimaryResourceId}}" { + location = "us-central1" + repository_id = "{{index $.ResourceIdVars "repository_id"}}" + instance = google_secure_source_manager_instance.instance.name + deletion_policy = "{{index $.ResourceIdVars "deletion_policy"}}" + + scan_config { + secret_scan_config { + enabled = true + inspect_template = google_data_loss_prevention_inspect_template.template.id + } + } +} diff --git a/mmv1/templates/terraform/samples/services/securesourcemanager/secure_source_manager_repository_service_account.tf.tmpl b/mmv1/templates/terraform/samples/services/securesourcemanager/secure_source_manager_repository_service_account.tf.tmpl new file mode 100644 index 000000000000..2f8e2d70b06d --- /dev/null +++ b/mmv1/templates/terraform/samples/services/securesourcemanager/secure_source_manager_repository_service_account.tf.tmpl @@ -0,0 +1,19 @@ +resource "google_secure_source_manager_instance" "instance" { + location = "us-central1" + instance_id = "{{index $.ResourceIdVars "instance_id"}}" + deletion_policy = "{{index $.ResourceIdVars "deletion_policy"}}" +} + +resource "google_service_account" "sa" { + account_id = "{{index $.ResourceIdVars "sa_id"}}" + display_name = "Test Service Account" +} + +resource "google_secure_source_manager_repository" "{{$.PrimaryResourceId}}" { + location = "us-central1" + repository_id = "{{index $.ResourceIdVars "repository_id"}}" + instance = google_secure_source_manager_instance.instance.name + deletion_policy = "{{index $.ResourceIdVars "deletion_policy"}}" + + service_account = google_service_account.sa.email +}