Skip to content

Commit d4f61d3

Browse files
imrannayerimrannayer
authored
feat!: Add BQ authorized routine (function) in authorization sub-module (#180)
1 parent ad3c347 commit d4f61d3

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+152
-59
lines changed

‎Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright 2022 Google LLC
1+
# Copyright 2023 Google LLC
22
#
33
# Licensed under the Apache License, Version 2.0 (the "License");
44
# you may not use this file except in compliance with the License.

‎build/int.cloudbuild.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright 2022 Google LLC
1+
# Copyright 2023 Google LLC
22
#
33
# Licensed under the Apache License, Version 2.0 (the "License");
44
# you may not use this file except in compliance with the License.

‎build/lint.cloudbuild.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright 2022 Google LLC
1+
# Copyright 2023 Google LLC
22
#
33
# Licensed under the Apache License, Version 2.0 (the "License");
44
# you may not use this file except in compliance with the License.

‎examples/basic_bq/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎examples/basic_bq/outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎examples/basic_bq/variables.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎examples/basic_bq/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2021 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎examples/basic_view/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎examples/basic_view/outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎examples/basic_view/variables.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎examples/basic_view/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎examples/multiple_tables/main.tf

+74-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -168,18 +168,88 @@ module "auth_dataset" {
168168
access = []
169169
}
170170

171+
resource "google_bigquery_table" "auth_ds_table" {
172+
deletion_protection = false
173+
dataset_id = module.auth_dataset.bigquery_dataset.dataset_id
174+
project = module.auth_dataset.bigquery_dataset.project
175+
table_id = "auth_db_table"
176+
177+
view {
178+
query = "SELECT 1 as col1 from (select SESSION_USER())"
179+
use_legacy_sql = false
180+
}
181+
}
182+
183+
resource "google_bigquery_routine" "auth_ds_routine1" {
184+
dataset_id = module.auth_dataset.bigquery_dataset.dataset_id
185+
project = module.auth_dataset.bigquery_dataset.project
186+
routine_id = "auth_ds_routine1"
187+
routine_type = "TABLE_VALUED_FUNCTION"
188+
language = "SQL"
189+
definition_body = <<-EOS
190+
SELECT 1 + value AS value
191+
EOS
192+
arguments {
193+
name = "value"
194+
argument_kind = "FIXED_TYPE"
195+
data_type = jsonencode({ "typeKind" = "INT64" })
196+
}
197+
return_table_type = jsonencode({ "columns" = [
198+
{ "name" = "value", "type" = { "typeKind" = "INT64" } },
199+
] })
200+
}
201+
202+
resource "google_bigquery_routine" "auth_ds_routine2" {
203+
dataset_id = module.auth_dataset.bigquery_dataset.dataset_id
204+
project = module.auth_dataset.bigquery_dataset.project
205+
routine_id = "auth_ds_routine2"
206+
routine_type = "TABLE_VALUED_FUNCTION"
207+
language = "SQL"
208+
definition_body = <<-EOS
209+
SELECT 2 + value AS value
210+
EOS
211+
arguments {
212+
name = "value"
213+
argument_kind = "FIXED_TYPE"
214+
data_type = jsonencode({ "typeKind" = "INT64" })
215+
}
216+
return_table_type = jsonencode({ "columns" = [
217+
{ "name" = "value", "type" = { "typeKind" = "INT64" } },
218+
] })
219+
}
220+
171221
module "add_authorization" {
172222
source = "../../modules/authorization"
173223

174-
dataset_id = module.bigquery.bigquery_dataset.dataset_id
175-
project_id = module.bigquery.bigquery_dataset.project
176-
authorized_views = []
224+
dataset_id = module.bigquery.bigquery_dataset.dataset_id
225+
project_id = module.bigquery.bigquery_dataset.project
226+
authorized_views = [
227+
{
228+
project_id = module.auth_dataset.bigquery_dataset.project
229+
dataset_id = module.auth_dataset.bigquery_dataset.dataset_id
230+
table_id = google_bigquery_table.auth_ds_table.table_id
231+
},
232+
]
177233
authorized_datasets = [
178234
{
179235
dataset_id = module.auth_dataset.bigquery_dataset.dataset_id
180236
project_id = module.auth_dataset.bigquery_dataset.project
181237
},
182238
]
239+
240+
authorized_routines = [
241+
{
242+
dataset_id = google_bigquery_routine.auth_ds_routine1.dataset_id
243+
project_id = google_bigquery_routine.auth_ds_routine1.project
244+
routine_id = google_bigquery_routine.auth_ds_routine1.routine_id
245+
},
246+
{
247+
dataset_id = google_bigquery_routine.auth_ds_routine2.dataset_id
248+
project_id = google_bigquery_routine.auth_ds_routine2.project
249+
routine_id = google_bigquery_routine.auth_ds_routine2.routine_id
250+
},
251+
]
252+
183253
depends_on = [
184254
module.auth_dataset
185255
]

‎examples/multiple_tables/outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎examples/multiple_tables/provider.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎examples/multiple_tables/variables.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎examples/multiple_tables/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎examples/scheduled_queries/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎examples/scheduled_queries/outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎examples/scheduled_queries/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎metadata.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright 2022 Google LLC
1+
# Copyright 2023 Google LLC
22
#
33
# Licensed under the Apache License, Version 2.0 (the "License");
44
# you may not use this file except in compliance with the License.

‎modules/authorization/README.md

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
1-
# BigQuery Authorized Views
1+
# BigQuery Authorized Datasets, Views and Routines
22

3-
This submodule is used to add [authorized views](https://cloud.google.com/bigquery/docs/share-access-views#authorize_the_view_to_access_the_source_dataset).
4-
The views that are created at another dataset are given readonly access so that even if the user does not have read access to the real dataset,
5-
they can read data over the view.
3+
This submodule is used to add [authorized datasets](https://cloud.google.com/bigquery/docs/authorized-datasets), [authorized views](https://cloud.google.com/bigquery/docs/share-access-views#authorize_the_view_to_access_the_source_dataset) and [authorized routines](https://cloud.google.com/bigquery/docs/authorized-functions).
4+
An `authorized dataset` lets you authorize all of the views in a specified dataset to access the data in a second dataset. An `authorized view` lets you share query results with particular users and groups without giving them access to the underlying source data. `Authorized Routine (Function)` let you share query results with particular users or groups without giving those users or groups access to the underlying tables
65

76
## Background
87
It is possible to define authorized views while creating a dataset. However, we have a chicken&egg problem if we create all at the same time. This module has the goal of solving that.
@@ -65,7 +64,8 @@ module "add_authorization" {
6564
| Name | Description | Type | Default | Required |
6665
|------|-------------|------|---------|:--------:|
6766
| authorized\_datasets | An array of datasets to be authorized on the dataset | <pre>list(object({<br> dataset_id = string,<br> project_id = string,<br> }))</pre> | `[]` | no |
68-
| authorized\_views | An array of views to give authorize for the dataset | <pre>list(object({<br> dataset_id = string,<br> project_id = string,<br> table_id = string # this is the view id, but we keep table_id to stay consistent as the resource<br> }))</pre> | n/a | yes |
67+
| authorized\_routines | An array of authorized routine to be authorized on the dataset | <pre>list(object({<br> project_id = string,<br> dataset_id = string,<br> routine_id = string<br> }))</pre> | `[]` | no |
68+
| authorized\_views | An array of views to give authorize for the dataset | <pre>list(object({<br> dataset_id = string,<br> project_id = string,<br> table_id = string # this is the view id, but we keep table_id to stay consistent as the resource<br> }))</pre> | `[]` | no |
6969
| dataset\_id | Unique ID for the dataset being provisioned. | `string` | n/a | yes |
7070
| project\_id | Project where the dataset and table are created | `string` | n/a | yes |
7171
| roles | An array of objects that define dataset access for one or more entities. | `any` | `[]` | no |

‎modules/authorization/main.tf

+13-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -28,6 +28,7 @@ locals {
2828
roles = zipmap(local.role_keys, var.roles)
2929
views = { for view in var.authorized_views : "${view["project_id"]}_${view["dataset_id"]}_${view["table_id"]}" => view }
3030
datasets = { for dataset in var.authorized_datasets : "${dataset["project_id"]}_${dataset["dataset_id"]}" => dataset }
31+
routines = { for routine in var.authorized_routines : "${routine["project_id"]}_${routine["dataset_id"]}_${routine["routine_id"]}" => routine }
3132

3233
iam_to_primitive = {
3334
"roles/bigquery.dataOwner" : "OWNER"
@@ -73,3 +74,14 @@ resource "google_bigquery_dataset_access" "authorized_dataset" {
7374
target_types = ["VIEWS"]
7475
}
7576
}
77+
78+
resource "google_bigquery_dataset_access" "authorized_routine" {
79+
for_each = local.routines
80+
dataset_id = var.dataset_id
81+
project = var.project_id
82+
routine {
83+
project_id = each.value.project_id
84+
dataset_id = each.value.dataset_id
85+
routine_id = each.value.routine_id
86+
}
87+
}

‎modules/authorization/metadata.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright 2022 Google LLC
1+
# Copyright 2023 Google LLC
22
#
33
# Licensed under the Apache License, Version 2.0 (the "License");
44
# you may not use this file except in compliance with the License.

‎modules/authorization/outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎modules/authorization/variables.tf

+12-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -43,6 +43,7 @@ variable "authorized_views" {
4343
project_id = string,
4444
table_id = string # this is the view id, but we keep table_id to stay consistent as the resource
4545
}))
46+
default = []
4647
}
4748

4849
variable "authorized_datasets" {
@@ -53,3 +54,13 @@ variable "authorized_datasets" {
5354
}))
5455
default = []
5556
}
57+
58+
variable "authorized_routines" {
59+
description = "An array of authorized routine to be authorized on the dataset"
60+
type = list(object({
61+
project_id = string,
62+
dataset_id = string,
63+
routine_id = string
64+
}))
65+
default = []
66+
}

‎modules/authorization/versions.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ terraform {
2020

2121
google = {
2222
source = "hashicorp/google"
23-
version = ">= 3.53, < 5.0"
23+
version = ">= 4.44, < 5.0"
2424
}
2525
}
2626

‎modules/scheduled_queries/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎modules/scheduled_queries/metadata.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright 2022 Google LLC
1+
# Copyright 2023 Google LLC
22
#
33
# Licensed under the Apache License, Version 2.0 (the "License");
44
# you may not use this file except in compliance with the License.

‎modules/scheduled_queries/outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎modules/scheduled_queries/variables.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎modules/scheduled_queries/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎modules/udf/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎modules/udf/metadata.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright 2022 Google LLC
1+
# Copyright 2023 Google LLC
22
#
33
# Licensed under the Apache License, Version 2.0 (the "License");
44
# you may not use this file except in compliance with the License.

‎modules/udf/outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

0 commit comments

Comments
 (0)