fix: Added VPC Accessible Services configuration (#84)

* Added VPC Accessible Services configuration

* Minor documentation update

* malformatted documentation fix

* Minor description fix

Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>

* Minor description fix

Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>

* regen docs

Co-authored-by: Leonardo Morales <leonardo.morales@gft.com>
Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>

Author: 3 people

modules/regular_service_perimeter/README.md

@@ -110,6 +110,8 @@ module "regular_service_perimeter_1" {
 | restricted\_services | GCP services that are subject to the Service Perimeter restrictions. Must contain a list of services. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions. | `list(string)` | `[]` | no |
 | restricted\_services\_dry\_run | (Dry-run) GCP services that are subject to the Service Perimeter restrictions. Must contain a list of services. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions.  If set, a dry-run policy will be set. | `list(string)` | `[]` | no |
 | shared\_resources | A map of lists of resources to share in a Bridge perimeter module. Each list should contain all or a subset of the perimeters resources | `object({ all = list(string) })` | <pre>{<br>  "all": []<br>}</pre> | no |
+| vpc\_accessible\_services | A list of [VPC Accessible Services](https://cloud.google.com/vpc-service-controls/docs/vpc-accessible-services) that will be restricted within the VPC Network. Use ["\*"] to allow any service (disable VPC Accessible Services); Use ["RESTRICTED-SERVICES"] to match the restricted services list; Use [] to not allow any service. | `list(string)` | <pre>[<br>  "*"<br>]</pre> | no |
+| vpc\_accessible\_services\_dry\_run | (Dry-run) A list of [VPC Accessible Services](https://cloud.google.com/vpc-service-controls/docs/vpc-accessible-services) that will be restricted within the VPC Network. Use ["\*"] to allow any service (disable VPC Accessible Services); Use ["RESTRICTED-SERVICES"] to match the restricted services list; Use [] to not allow any service. | `list(string)` | <pre>[<br>  "*"<br>]</pre> | no |
 
 ## Outputs
 

modules/regular_service_perimeter/main.tf

@@ -15,7 +15,7 @@
  */
 
 locals {
-  dry_run = (length(var.restricted_services_dry_run) > 0 || length(var.resources_dry_run) > 0 || length(var.access_levels_dry_run) > 0)
+  dry_run = (length(var.restricted_services_dry_run) > 0 || length(var.resources_dry_run) > 0 || length(var.access_levels_dry_run) > 0 || !contains(var.vpc_accessible_services_dry_run, "*"))
 }
 
 resource "google_access_context_manager_service_perimeter" "regular_service_perimeter" {
@@ -97,6 +97,14 @@ resource "google_access_context_manager_service_perimeter" "regular_service_peri
         }
       }
     }
+
+    dynamic "vpc_accessible_services" {
+      for_each = contains(var.vpc_accessible_services, "*") ? [] : [var.vpc_accessible_services]
+      content {
+        enable_restriction = true
+        allowed_services   = vpc_accessible_services.value
+      }
+    }
   }
 
 
@@ -174,6 +182,14 @@ resource "google_access_context_manager_service_perimeter" "regular_service_peri
           }
         }
       }
+
+      dynamic "vpc_accessible_services" {
+        for_each = contains(var.vpc_accessible_services_dry_run, "*") ? [] : [var.vpc_accessible_services_dry_run]
+        content {
+          enable_restriction = true
+          allowed_services   = vpc_accessible_services.value
+        }
+      }
     }
   }
   use_explicit_dry_run_spec = local.dry_run

modules/regular_service_perimeter/variables.tf

@@ -117,3 +117,15 @@ variable "ingress_policies_dry_run" {
   }))
   default = []
 }
+
+variable "vpc_accessible_services" {
+  description = "A list of [VPC Accessible Services](https://cloud.google.com/vpc-service-controls/docs/vpc-accessible-services) that will be restricted within the VPC Network. Use [\"*\"] to allow any service (disable VPC Accessible Services); Use [\"RESTRICTED-SERVICES\"] to match the restricted services list; Use [] to not allow any service."
+  type        = list(string)
+  default     = ["*"]
+}
+
+variable "vpc_accessible_services_dry_run" {
+  description = "(Dry-run) A list of [VPC Accessible Services](https://cloud.google.com/vpc-service-controls/docs/vpc-accessible-services) that will be restricted within the VPC Network. Use [\"*\"] to allow any service (disable VPC Accessible Services); Use [\"RESTRICTED-SERVICES\"] to match the restricted services list; Use [] to not allow any service."
+  type        = list(string)
+  default     = ["*"]
+}