resources_dry_run doesn't have a condition to append //compute.googleapis.com to VPC IDs

[kirantejaj]

TL;DR

resources_dry_run documentation says (Dry-run) A list of GCP resources that are inside of the service perimeter. Currently only projects and VPC networks are allowed. If set, a dry-run policy will be set.

Even though VPC is allowed a condition to check and add prefix is missing. in the dynamic spec block every resource has projects appended.

dynamic "spec" { for_each = local.dry_run ? ["dry-run"] : [] content { restricted_services = var.restricted_services_dry_run resources = formatlist("projects/%s", var.resources_dry_run )

As a work around I am adding below in place of resources = formatlist("projects/%s", var.resources_dry_run )

resources = [ for item in var.resources_dry_run : can(regex("global/networks", item)) ? format("//compute.googleapis.com/%s", item) : format("projects/%s", item) ]

We are getting below errors otherwise.

Error: Error updating ServicePerimeter "accessPolicies/xxx/servicePerimeters/xxx": googleapi: Error 400: Invalid Service Perimeter 'accessPolicies/xxx/servicePerimeters/xxx'. Invalid perimeter member: 'projects/projects/xxxx/global/networks/xxxx'. Must be of the form 'projects/[1-9][0-9]{0,18}' OR '//compute.googleapis.com/projects/[a-z][a-z0-9-]{4,28}[a-z0-9]/global/networks/a-z?'.

Expected behavior

The checks are added for regular resources. Only when in dry_run mode checks are missing for VPC.

Below is the code block which takes care of adding prefixes for projects and VPCs in enforced mode.

resource "google_access_context_manager_service_perimeter_resource" "service_perimeter_resource" { for_each = local.resources perimeter_name = google_access_context_manager_service_perimeter.regular_service_perimeter.name resource = can(regex("global/networks", each.value)) ? "//compute.googleapis.com/${each.value}" : "projects/${each.value}" }

Observed behavior

No response

Terraform Configuration

module "regular_service_perimeter_1" {
  source         = "terraform-google-modules/vpc-service-controls/google//modules/regular_service_perimeter"
  policy         = var.org_policy_id
  perimeter_name = var.perimeter_name
  description    = "Dry run Perimeter"
  access_levels_dry_run       = [module.access_level_members.name]
  resources_dry_run      = local.resources_list
  restricted_services = ["bigquery.googleapis.com", "storage.googleapis.com"]
  vpc_accessible_services_dry_run = ["RESTRICTED-SERVICES"]
}

Terraform Version

Terraform v1.5.3
on linux_amd64
+ provider registry.terraform.io/hashicorp/google v4.74.0
+ provider registry.terraform.io/hashicorp/google-beta v4.74.0

Additional information

No response