project-factory has incorrect validation for assured_workload_config in folders

[jowko]

Affected components

• Fabric modules
• FAST
• Other

The problem

JSON Schema validation is not correct in project-factory module. When creating folder with assured workloads enabled, partner field is required by folder module but JSON schema does not mark this field as required. Because of that, we do not catch this issue during JSON schema validation step - creating this folder fails on terraform plan.

Mentioned schema:

cloud-foundation-fabric/modules/project-factory/schemas/folder.schema.json

Lines 555 to 661 in 74ccc8a

	"assured_workload_config": {
	"type": "object",
	"additionalProperties": false,
	"properties": {
	"compliance_regime": {
	"type": "string",
	"enum": [
	"ASSURED_WORKLOADS_FOR_PARTNERS",
	"AU_REGIONS_AND_US_SUPPORT",
	"AUSTRALIA_DATA_BOUNDARY_AND_SUPPORT",
	"CA_PROTECTED_B",
	"CA_REGIONS_AND_SUPPORT",
	"CANADA_CONTROLLED_GOODS",
	"CANADA_DATA_BOUNDARY_AND_SUPPORT",
	"CJIS",
	"COMPLIANCE_REGIME_UNSPECIFIED",
	"DATA_BOUNDARY_FOR_CANADA_CONTROLLED_GOODS",
	"DATA_BOUNDARY_FOR_CANADA_PROTECTED_B",
	"DATA_BOUNDARY_FOR_CJIS",
	"DATA_BOUNDARY_FOR_FEDRAMP_HIGH",
	"DATA_BOUNDARY_FOR_FEDRAMP_MODERATE",
	"DATA_BOUNDARY_FOR_IL2",
	"DATA_BOUNDARY_FOR_IL4",
	"DATA_BOUNDARY_FOR_IL5",
	"DATA_BOUNDARY_FOR_IRS_PUBLICATION_1075",
	"DATA_BOUNDARY_FOR_ITAR",
	"EU_DATA_BOUNDARY_AND_SUPPORT",
	"EU_REGIONS_AND_SUPPORT",
	"FEDRAMP_HIGH",
	"FEDRAMP_MODERATE",
	"HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS",
	"HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS_US_SUPPORT",
	"HIPAA",
	"HITRUST",
	"IL2",
	"IL4",
	"IL5",
	"IRS_1075",
	"ISR_REGIONS",
	"ISR_REGIONS_AND_SUPPORT",
	"ISRAEL_DATA_BOUNDARY_AND_SUPPORT",
	"ITAR",
	"JAPAN_DATA_BOUNDARY",
	"JP_REGIONS_AND_SUPPORT",
	"KSA_DATA_BOUNDARY_WITH_ACCESS_JUSTIFICATIONS",
	"KSA_REGIONS_AND_SUPPORT_WITH_SOVEREIGNTY_CONTROLS",
	"REGIONAL_CONTROLS",
	"REGIONAL_DATA_BOUNDARY",
	"US_DATA_BOUNDARY_AND_SUPPORT",
	"US_DATA_BOUNDARY_FOR_HEALTHCARE_AND_LIFE_SCIENCES",
	"US_DATA_BOUNDARY_FOR_HEALTHCARE_AND_LIFE_SCIENCES_WITH_SUPPORT",
	"US_REGIONAL_ACCESS"
	]
	},
	"display_name": {
	"type": "string"
	},
	"location": {
	"type": "string"
	},
	"organization": {
	"type": "string"
	},
	"enable_sovereign_controls": {
	"type": "boolean"
	},
	"labels": {
	"$ref": "#/$defs/labels"
	},
	"partner": {
	"type": "string",
	"enum": [
	"LOCAL_CONTROLS_BY_S3NS",
	"PARTNER_UNSPECIFIED",
	"SOVEREIGN_CONTROLS_BY_CNTXT_NO_EKM",
	"SOVEREIGN_CONTROLS_BY_CNTXT",
	"SOVEREIGN_CONTROLS_BY_PSN",
	"SOVEREIGN_CONTROLS_BY_SIA_MINSAIT",
	"SOVEREIGN_CONTROLS_BY_T_SYSTEMS"
	]
	},
	"partner_permissions": {
	"type": "object",
	"additionalProperties": false,
	"properties": {
	"assured_workloads_monitoring": {
	"type": "boolean"
	},
	"data_logs_viewer": {
	"type": "boolean"
	},
	"service_access_approver": {
	"type": "boolean"
	}
	}
	},
	"violation_notifications_enabled": {
	"type": "boolean"
	}
	},
	"required": [
	"compliance_regime",
	"display_name",
	"location",
	"organization"
	]
	},

Mentioned folder module validation:

cloud-foundation-fabric/modules/folder/variables.tf

Lines 130 to 141 in 74ccc8a

	validation {
	condition = try(contains([
	"LOCAL_CONTROLS_BY_S3NS",
	"PARTNER_UNSPECIFIED",
	"SOVEREIGN_CONTROLS_BY_CNTXT_NO_EKM",
	"SOVEREIGN_CONTROLS_BY_CNTXT",
	"SOVEREIGN_CONTROLS_BY_PSN",
	"SOVEREIGN_CONTROLS_BY_SIA_MINSAIT",
	"SOVEREIGN_CONTROLS_BY_T_SYSTEMS",
	], var.assured_workload_config.partner), true)
	error_message = "Field assured_workload_config.partner must be one of the values listed in https://cloud.google.com/assured-workloads/docs/reference/rest/Shared.Types/Partner"
	}

Release version

master

Terraform version

1.16

Steps to reproduce

1. Try to create new folder using project-factory with assured workloads enabled. Example YAML:

name: my-folder-name

assured_workload_config:
  display_name: "My-Support-Folder"
  compliance_regime: EU_DATA_BOUNDARY_AND_SUPPORT
  location: europe-west3
  enable_sovereign_controls: true
  organization: "my-organization-id"
#  partner: PARTNER_UNSPECIFIED # this is required by folder module but not required by JSON Schema

2. Validate this file using JSON schema provided by module.
3. Run terraform plan/apply command - this fails because of variable validation error in folder module.

Expected behavior

JSON Schema should mark assured_workload_config.partner field as required or folder module should allow for putting null value here.

According to Google provider this field is not required: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/assured_workloads_workload#partner-1

Actual behavior

When assured_workload_config.partner is not configured, JSON schema validation does not report any issue but terraform plan fails with error:

    │ var.assured_workload_config.partner is null
Field assured_workload_config.partner must be one of the values listed in
https://cloud.google.com/assured-workloads/docs/reference/rest/Shared.Types/Partner

Additional context

No response

[ludoo]

Thanks for reporting this, want to send a PR to fix it?

[jowko]

I also found another issue with this module. Not sure if this is Google provider bug (we have 7.23.0 version currently set) or bug in the module itself. I created Assured workloads folder with partner value PARTNER_UNSPECIFIED and it was created by terraform with this option set:

+ partner                           = "PARTNER_UNSPECIFIED"

But after pipeline rerun this workload is replaced by Terraform because of this diff, so looks like permadiff issue:

+ partner                           = "PARTNER_UNSPECIFIED" # forces replacement

I will investigate it tomorrow to check if this is the provider issue or module issue. I also searched for fixes for google_assured_workloads_workload terraform resource in release notes of provider but did not found any mentions of fixing bugs with partner field: https://github.com/hashicorp/terraform-provider-google/releases

I think that proper fix for this validation issue would be to change this line:

condition = try(contains([ 

To something like this:

condition = try(var.assured_workload_config.partner == null || contains([

Not sure if this is right approach following your guidelines for variables validation. Then it will allow null or require to provide one of listed values.

[ludoo]

The two partner values above look identical to me :) and yes, in that case the easy fix is to allow null. We should also check if that's a provider issue, it kind of looks that way. If you want to send a PR, we can discuss approaches there. This is something we did not test much, as those are not resources we commonly use, sorry for that. :)