GCP: Setting IAMPolicies on DNS-zones

[muffl0n]

Settings IAMPolicies on DNS-zones is currently in preview: https://cloud.google.com/dns/docs/access-control

Cloud DNS supports IAM permissions at the project level and individual DNS zone level (available in Preview).

Is this already supported by Pulumi? Couldn't find anything in the docs.

[jaxxstorm]

I believe this is tracked here? https://www.pulumi.com/registry/packages/google-native/api-docs/dns/v1/policy/

[muffl0n]

Please do not confuse Policy with IAMPolicy here. See https://cloud.google.com/dns/docs/policies

[nimbinatus]

It looks like it's in the beta version API, which should appear in the native provider for GCP. Here's where I'm finding it:

• https://www.pulumi.com/registry/packages/google-native/api-docs/dns/v1beta2/managedzoneiampolicy/
  It's also appearing in the general v1:
• https://www.pulumi.com/registry/packages/google-native/api-docs/dns/v1/managedzoneiampolicy/

I'm not finding it in the main Google Cloud API docs on DNS, so I'm guessing that we can't be sure yet if that will be the permanent endpoint. If you're using it, please remember that there may be breaking changes since it's a preview, and those breaking changes generally come from upstream rather than Pulumi.

If you want to look up a preview GCP API like this in the future, the easiest way I've found is as follows:

1. Go find the API call, like this one here: https://cloud.google.com/dns/docs/zones/iam-per-resource-zones#api, which leads to this call:

   https://dns.googleapis.com/dns/v1/projects/PROJECT_ID/managedZones/MANAGED_ZONE:setIamPolicy
   

2. Break it down to the namespace (dns) and version (v1).
3. Go find the discovery doc in the repo. Here's the ones we're exploring for GCP Native: https://github.com/pulumi/pulumi-google-native/tree/master/discovery. Based on the call, we need https://github.com/pulumi/pulumi-google-native/blob/master/discovery/dns_v1.json
4. Follow the path in the API call to find the right part of the discovery document. Here's the one I'm finding for that call: https://github.com/pulumi/pulumi-google-native/blob/master/discovery/dns_v1.json#L705-L733

This method ensures that, if there is a breaking change from upstream, you can find your way back as those discovery docs get updated when upstream does.

You'll notice if you head to the GET call at https://cloud.google.com/dns/docs/zones/iam-per-resource-zones#get_access_control_policy_for_a_resource, you'll find that it's using v1beta1 instead of v1. I'd use the v1beta2 discovery doc in that case.

Does this help?

[muffl0n]

Awesome! Thank you very much for this detailed response! ❤️