feat!: deletion_policy PREVENT as default (#940)

apeabody · web-flow · commit 1c1e01845746 · 2024-09-10T13:43:06.000-05:00
diff --git a/README.md b/README.md
@@ -137,7 +137,7 @@ determining that location is as follows:
 | create\_project\_sa | Whether the default service account for the project shall be created | `bool` | `true` | no |
 | default\_network\_tier | Default Network Service Tier for resources created in this project. If unset, the value will not be modified. See https://cloud.google.com/network-tiers/docs/using-network-service-tiers and https://cloud.google.com/network-tiers. | `string` | `""` | no |
 | default\_service\_account | Project default service account setting: can be one of `delete`, `deprivilege`, `disable`, or `keep`. | `string` | `"disable"` | no |
-| deletion\_policy | The deletion policy for the project. | `string` | `null` | no |
+| deletion\_policy | The deletion policy for the project. | `string` | `"PREVENT"` | no |
 | disable\_dependent\_services | Whether services that are enabled and which depend on this service should also be disabled when this service is destroyed. | `bool` | `true` | no |
 | disable\_services\_on\_destroy | Whether project services will be disabled when the resources are destroyed | `bool` | `true` | no |
 | domain | The domain name (optional). | `string` | `""` | no |
diff --git a/docs/upgrading_to_project_factory_v17.0.md b/docs/upgrading_to_project_factory_v17.0.md
@@ -0,0 +1,20 @@
+# Upgrading to Project Factory v17.0
+
+The v17.0 release of Project Factory is a backwards incompatible release.
+
+### Google Cloud Provider Project deletion_policy
+
+The `deletion_policy` for projects now defaults to `"PREVENT"` rather than `"DELETE"`.  This aligns with the behavior in Google Cloud Platform Provider v6+.  To maintain the old behavior you can set `deletion_policy = "DELETE"`.
+
+```diff
+  module "project" {
+-   version          = "~> 16.0"
++   version          = "~> 17.0"
+
++   deletion_policy = "DELETE"
+}
+```
+
+### Google Cloud Platform Provider upgrade
+
+The Project Factory module now requires version `5.41` or higher of the Google Cloud Platform Provider and `5.41` or higher of the Google Cloud Platform Beta Provider.
diff --git a/examples/app_engine/main.tf b/examples/app_engine/main.tf
@@ -32,6 +32,8 @@ module "app-engine-project" {
   activate_apis = [
     "appengine.googleapis.com",
   ]
+
+  deletion_policy = "DELETE"
 }
 
 module "app-engine" {
diff --git a/examples/budget_project/main.tf b/examples/budget_project/main.tf
@@ -38,6 +38,7 @@ module "budget_project" {
     "billingbudgets.googleapis.com"
   ]
 
+  deletion_policy = "DELETE"
 }
 
 
diff --git a/examples/essential_contacts/main.tf b/examples/essential_contacts/main.tf
@@ -41,4 +41,6 @@ module "project-factory" {
 
   default_service_account     = "DISABLE"
   disable_services_on_destroy = false
+
+  deletion_policy = "DELETE"
 }
diff --git a/examples/fabric_project/main.tf b/examples/fabric_project/main.tf
@@ -35,4 +35,6 @@ module "fabric-project" {
   owners          = var.owners
   parent          = var.parent
   prefix          = local.prefix
+
+  deletion_policy = "DELETE"
 }
diff --git a/examples/gke_shared_vpc/main.tf b/examples/gke_shared_vpc/main.tf
@@ -26,4 +26,6 @@ module "project-factory" {
   activate_apis        = ["compute.googleapis.com", "container.googleapis.com", "cloudbilling.googleapis.com"]
   shared_vpc_subnets   = var.shared_vpc_subnets
   default_network_tier = var.default_network_tier
+
+  deletion_policy = "DELETE"
 }
diff --git a/examples/quota_project/main.tf b/examples/quota_project/main.tf
@@ -58,4 +58,6 @@ module "quota-project" {
       value      = "95"
     }
   ]
+
+  deletion_policy = "DELETE"
 }
diff --git a/examples/shared_vpc/main.tf b/examples/shared_vpc/main.tf
@@ -39,6 +39,7 @@ module "host-project" {
     "cloudresourcemanager.googleapis.com"
   ]
 
+  deletion_policy = "DELETE"
 }
 
 /******************************************
@@ -113,6 +114,7 @@ module "service-project" {
   ]
 
   disable_services_on_destroy = false
+  deletion_policy             = "DELETE"
 }
 
 /******************************************
@@ -146,6 +148,7 @@ module "service-project-b" {
   }]
 
   disable_services_on_destroy = false
+  deletion_policy             = "DELETE"
 }
 
 /******************************************
@@ -184,6 +187,7 @@ module "service-project-c" {
 
   disable_services_on_destroy = false
   grant_network_role          = false
+  deletion_policy             = "DELETE"
 }
 
 /******************************************
diff --git a/examples/simple_project/main.tf b/examples/simple_project/main.tf
@@ -31,4 +31,6 @@ module "project-factory" {
       "roles/bigquery.jobUser",
     ]
   }]
+
+  deletion_policy = "DELETE"
 }
diff --git a/examples/tags_project/main.tf b/examples/tags_project/main.tf
@@ -25,4 +25,6 @@ module "project-factory" {
   billing_account         = var.billing_account
   default_service_account = "deprivilege"
   tag_binding_values      = [var.tag_value]
+
+  deletion_policy = "DELETE"
 }
diff --git a/modules/core_project_factory/variables.tf b/modules/core_project_factory/variables.tf
@@ -280,5 +280,5 @@ variable "cloud_armor_tier" {
 variable "deletion_policy" {
   description = "The deletion policy for the project."
   type        = string
-  default     = null
+  default     = "PREVENT"
 }
diff --git a/modules/fabric-project/README.md b/modules/fabric-project/README.md
@@ -38,7 +38,7 @@ module "project_myproject" {
 | auto\_create\_network | Whether to create the default network for the project | `bool` | `false` | no |
 | billing\_account | Billing account id. | `string` | `""` | no |
 | custom\_roles | Map of role name => comma-delimited list of permissions to create in this project. | `map(string)` | `{}` | no |
-| deletion\_policy | The deletion policy for the project. | `string` | `null` | no |
+| deletion\_policy | The deletion policy for the project. | `string` | `"PREVENT"` | no |
 | editors | Optional list of IAM-format members to set as project editor. | `list(string)` | `[]` | no |
 | extra\_bindings\_members | List of comma-delimited IAM-format members for additional IAM bindings, one item per role. | `list(string)` | `[]` | no |
 | extra\_bindings\_roles | List of roles for additional IAM bindings, pair with members list below. | `list(string)` | `[]` | no |
diff --git a/modules/fabric-project/variables.tf b/modules/fabric-project/variables.tf
@@ -125,5 +125,5 @@ variable "labels" {
 variable "deletion_policy" {
   description = "The deletion policy for the project."
   type        = string
-  default     = null
+  default     = "PREVENT"
 }
diff --git a/modules/svpc_service_project/README.md b/modules/svpc_service_project/README.md
@@ -46,6 +46,7 @@ module "service-project" {
 | create\_project\_sa | Whether the default service account for the project shall be created | `bool` | `true` | no |
 | default\_network\_tier | Default Network Service Tier for resources created in this project. If unset, the value will not be modified. See https://cloud.google.com/network-tiers/docs/using-network-service-tiers and https://cloud.google.com/network-tiers. | `string` | `""` | no |
 | default\_service\_account | Project default service account setting: can be one of `delete`, `deprivilege`, `disable`, or `keep`. | `string` | `"disable"` | no |
+| deletion\_policy | The deletion policy for the project. | `string` | `"PREVENT"` | no |
 | disable\_dependent\_services | Whether services that are enabled and which depend on this service should also be disabled when this service is destroyed. | `bool` | `true` | no |
 | disable\_services\_on\_destroy | Whether project services will be disabled when the resources are destroyed | `bool` | `true` | no |
 | domain | The domain name (optional). | `string` | `""` | no |
diff --git a/modules/svpc_service_project/main.tf b/modules/svpc_service_project/main.tf
@@ -59,6 +59,7 @@ module "project-factory" {
   default_service_account           = var.default_service_account
   disable_dependent_services        = var.disable_dependent_services
   default_network_tier              = var.default_network_tier
+  deletion_policy                   = var.deletion_policy
 }
 
 /******************************************
diff --git a/modules/svpc_service_project/variables.tf b/modules/svpc_service_project/variables.tf
@@ -228,3 +228,9 @@ variable "default_network_tier" {
   type        = string
   default     = ""
 }
+
+variable "deletion_policy" {
+  description = "The deletion policy for the project."
+  type        = string
+  default     = "PREVENT"
+}
diff --git a/test/fixtures/minimal/main.tf b/test/fixtures/minimal/main.tf
@@ -49,6 +49,8 @@ module "project-factory" {
 
   default_service_account     = "DISABLE"
   disable_services_on_destroy = false
+
+  deletion_policy = "DELETE"
 }
 
 // Add a binding to the container service robot account to test that the
diff --git a/test/fixtures/vpc_sc_project/main.tf b/test/fixtures/vpc_sc_project/main.tf
@@ -50,6 +50,8 @@ module "project-factory" {
 
   vpc_service_control_attach_enabled = true
   vpc_service_control_perimeter_name = "accessPolicies/${var.policy_id}/servicePerimeters/${local.perimeter_name}"
+
+  deletion_policy = "DELETE"
 }
 
 resource "google_project_iam_member" "iam-binding" {
diff --git a/variables.tf b/variables.tf
@@ -369,5 +369,5 @@ variable "cloud_armor_tier" {
 variable "deletion_policy" {
   description = "The deletion policy for the project."
   type        = string
-  default     = null
+  default     = "PREVENT"
 }

Original file line number	Diff line number	Diff line change
`@@ -32,6 +32,8 @@ module "app-engine-project" {`
`32`	`32`	`activate_apis = [`
`33`	`33`	`"appengine.googleapis.com",`
`34`	`34`	`]`
	`35`	`+`
	`36`	`+ deletion_policy = "DELETE"`
`35`	`37`	`}`
`36`	`38`
`37`	`39`	`module "app-engine" {`
Original file line number	Diff line number	Diff line change
`@@ -38,6 +38,7 @@ module "budget_project" {`
`38`	`38`	`"billingbudgets.googleapis.com"`
`39`	`39`	`]`
`40`	`40`
	`41`	`+ deletion_policy = "DELETE"`
`41`	`42`	`}`
`42`	`43`
`43`	`44`
Original file line number	Diff line number	Diff line change
`@@ -41,4 +41,6 @@ module "project-factory" {`
`41`	`41`
`42`	`42`	`default_service_account = "DISABLE"`
`43`	`43`	`disable_services_on_destroy = false`
	`44`	`+`
	`45`	`+ deletion_policy = "DELETE"`
`44`	`46`	`}`
Original file line number	Diff line number	Diff line change
`@@ -35,4 +35,6 @@ module "fabric-project" {`
`35`	`35`	`owners = var.owners`
`36`	`36`	`parent = var.parent`
`37`	`37`	`prefix = local.prefix`
	`38`	`+`
	`39`	`+ deletion_policy = "DELETE"`
`38`	`40`	`}`
Original file line number	Diff line number	Diff line change
`@@ -26,4 +26,6 @@ module "project-factory" {`
`26`	`26`	`activate_apis = ["compute.googleapis.com", "container.googleapis.com", "cloudbilling.googleapis.com"]`
`27`	`27`	`shared_vpc_subnets = var.shared_vpc_subnets`
`28`	`28`	`default_network_tier = var.default_network_tier`
	`29`	`+`
	`30`	`+ deletion_policy = "DELETE"`
`29`	`31`	`}`
Original file line number	Diff line number	Diff line change
`@@ -58,4 +58,6 @@ module "quota-project" {`
`58`	`58`	`value = "95"`
`59`	`59`	`}`
`60`	`60`	`]`
	`61`	`+`
	`62`	`+ deletion_policy = "DELETE"`
`61`	`63`	`}`
Original file line number	Diff line number	Diff line change
`@@ -39,6 +39,7 @@ module "host-project" {`
`39`	`39`	`"cloudresourcemanager.googleapis.com"`
`40`	`40`	`]`
`41`	`41`
	`42`	`+ deletion_policy = "DELETE"`
`42`	`43`	`}`
`43`	`44`
`44`	`45`	`/******************************************`
`@@ -113,6 +114,7 @@ module "service-project" {`
`113`	`114`	`]`
`114`	`115`
`115`	`116`	`disable_services_on_destroy = false`
	`117`	`+ deletion_policy = "DELETE"`
`116`	`118`	`}`
`117`	`119`
`118`	`120`	`/******************************************`
`@@ -146,6 +148,7 @@ module "service-project-b" {`
`146`	`148`	`}]`
`147`	`149`
`148`	`150`	`disable_services_on_destroy = false`
	`151`	`+ deletion_policy = "DELETE"`
`149`	`152`	`}`
`150`	`153`
`151`	`154`	`/******************************************`
`@@ -184,6 +187,7 @@ module "service-project-c" {`
`184`	`187`
`185`	`188`	`disable_services_on_destroy = false`
`186`	`189`	`grant_network_role = false`
	`190`	`+ deletion_policy = "DELETE"`
`187`	`191`	`}`
`188`	`192`
`189`	`193`	`/******************************************`
Original file line number	Diff line number	Diff line change
`@@ -31,4 +31,6 @@ module "project-factory" {`
`31`	`31`	`"roles/bigquery.jobUser",`
`32`	`32`	`]`
`33`	`33`	`}]`
	`34`	`+`
	`35`	`+ deletion_policy = "DELETE"`
`34`	`36`	`}`