Add deletion_protection field to Metastore Service

mmv1/products/metastore/Service.yaml

@@ -53,6 +53,19 @@ async: !ruby/object:Api::OpAsync
     path: 'error'
     message: 'message'
 autogen_async: true
+virtual_fields:
+  - !ruby/object:Api::Type::Boolean
+    name: 'deletion_protection'
+    default_value: false
+    description: |
+      Whether Terraform will be prevented from destroying the service. Defaults to true.
+      When a`terraform destroy` or `terraform apply` would delete the service,
+      the command will fail if this field is not set to false in Terraform state.
+      When the field is set to true or unset in Terraform state, a `terraform apply`
+      or `terraform destroy` that would delete the service will fail.
+      When the field is set to false, deleting the service is allowed.
+custom_code: !ruby/object:Provider::Terraform::CustomCode
+  pre_delete: 'templates/terraform/pre_delete/dataproc_metastore_service.go.erb'
 import_format:
   ['projects/{{project}}/locations/{{location}}/services/{{service_id}}']
 examples:
@@ -63,6 +76,8 @@ examples:
     primary_resource_id: 'default'
     vars:
       metastore_service_name: 'metastore-srv'
+    ignore_read_extra:
+      - 'deletion_protection'
   - !ruby/object:Provider::Terraform::Examples
     name: 'dataproc_metastore_service_cmek_test'
     skip_docs: true

mmv1/products/metastore/go_Service.yaml

@@ -57,13 +57,27 @@ iam_policy:
   import_format:
     - 'projects/{{project}}/locations/{{location}}/services/{{service_id}}'
     - '{{service_id}}'
-custom_code:
+virtual_fields:
+  - !ruby/object:Api::Type::Boolean
+    name: 'deletion_protection'
+    default_value: false
+    description: |
+      Whether Terraform will be prevented from destroying the service. Defaults to true.
+      When a`terraform destroy` or `terraform apply` would delete the service,
+      the command will fail if this field is not set to false in Terraform state.
+      When the field is set to true or unset in Terraform state, a `terraform apply`
+      or `terraform destroy` that would delete the service will fail.
+      When the field is set to false, deleting the service is allowed.
+custom_code: !ruby/object:Provider::Terraform::CustomCode
+  pre_delete: 'templates/terraform/pre_delete/dataproc_metastore_service.go.tmpl'
 examples:
   - name: 'dataproc_metastore_service_basic'
     primary_resource_id: 'default'
     primary_resource_name: 'fmt.Sprintf("tf-test-metastore-srv%s", context["random_suffix"])'
     vars:
       metastore_service_name: 'metastore-srv'
+    ignore_read_extra:
+      - 'deletion_protection'
   - name: 'dataproc_metastore_service_cmek_test'
     primary_resource_id: 'default'
     vars:

mmv1/templates/terraform/examples/dataproc_metastore_service_basic.tf.erb

@@ -16,4 +16,5 @@ resource "google_dataproc_metastore_service" "<%= ctx[:primary_resource_id] %>"
   labels = {
     env = "test"
   }
-}
+  deletion_protection = false
+}

mmv1/templates/terraform/pre_delete/dataproc_metastore_service.go.erb

@@ -0,0 +1,3 @@
+if d.Get("deletion_protection").(bool) {
+    return fmt.Errorf("cannot destroy domain without setting deletion_protection=false and running `terraform apply`")
+}

mmv1/templates/terraform/pre_delete/go/dataproc_metastore_service.go.tmpl

@@ -0,0 +1,3 @@
+if d.Get("deletion_protection").(bool) {
+    return fmt.Errorf("cannot destroy service without setting deletion_protection=false and running `terraform apply`")
+}

mmv1/third_party/terraform/services/dataprocmetastore/go/resource_dataproc_metastore_service_test.go

@@ -3,6 +3,7 @@ package dataprocmetastore_test
 import (
 	"fmt"
 	"testing"
+	"regexp"
 	"github.com/hashicorp/terraform-provider-google/google/acctest"
 
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -25,6 +26,7 @@ func TestAccDataprocMetastoreService_updateAndImport(t *testing.T) {
 				ResourceName:      "google_dataproc_metastore_service.my_metastore",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 			{
 				Config: testAccDataprocMetastoreService_updateAndImport(name, tier[1]),
@@ -33,17 +35,49 @@ func TestAccDataprocMetastoreService_updateAndImport(t *testing.T) {
 				ResourceName:      "google_dataproc_metastore_service.my_metastore",
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"deletion_protection"},
 			},
 		},
 	})
 }
 
+func TestAccDataprocMetastoreService_updateLocation_deletionProtection(t *testing.T) {
+        t.Parallel()
+
+        name := "tf-test-metastore-" + acctest.RandString(t, 10)
+        tier := [2]string{"DEVELOPER", "ENTERPRISE"}
+
+        acctest.VcrTest(t, resource.TestCase{
+                PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+                ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+                Steps: []resource.TestStep{
+                        {
+                                Config: testAccDataprocMetastoreService_updateLocation_deletionProtection(name, "us-central1", tier[0]),
+                        },
+                        {
+                                ResourceName:            "google_dataproc_metastore_service.my_metastore",
+                                ImportState:             true,
+                                ImportStateVerify:       true,
+                                ImportStateVerifyIgnore: []string{"deletion_protection"},
+                        },
+                        {
+                                Config: testAccDataprocMetastoreService_updateLocation_deletionProtection(name, "us-west2", tier[1]),
+                                ExpectError: regexp.MustCompile("deletion_protection"),
+                        },
+                        {
+                                Config: testAccDataprocMetastoreService_updateAndImport(name, tier[1]),
+                        },
+                },
+        })
+}
+
 func testAccDataprocMetastoreService_updateAndImport(name, tier string) string {
 	return fmt.Sprintf(`
 resource "google_dataproc_metastore_service" "my_metastore" {
 	service_id = "%s"
 	location   = "us-central1"
 	tier       = "%s"
+	deletion_protection = false
 
 	hive_metastore_config {
 		version = "2.3.6"
@@ -52,6 +86,21 @@ resource "google_dataproc_metastore_service" "my_metastore" {
 `, name, tier)
 }
 
+func testAccDataprocMetastoreService_updateLocation_deletionProtection(name, location, tier string) string {
+        return fmt.Sprintf(`
+resource "google_dataproc_metastore_service" "my_metastore" {
+        service_id = "%s"
+        location   = "%s"
+        tier       = "%s"
+        deletion_protection = false
+
+        hive_metastore_config {
+                version = "2.3.6"
+        }
+}
+`, name, location, tier)
+}
+
 func TestAccDataprocMetastoreService_dataprocMetastoreServiceScheduledBackupExampleUpdate(t *testing.T) {
 	t.Parallel()
 
@@ -71,7 +120,7 @@ func TestAccDataprocMetastoreService_dataprocMetastoreServiceScheduledBackupExam
 				ResourceName:            "google_dataproc_metastore_service.backup",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"service_id", "location", "labels", "terraform_labels"},
+				ImportStateVerifyIgnore: []string{"service_id", "location", "labels", "terraform_labels", "deletion_protection"},
 			},
 			{
 				Config: testAccDataprocMetastoreService_dataprocMetastoreServiceScheduledBackupExampleUpdate(context),
@@ -166,4 +215,4 @@ resource "google_storage_bucket" "bucket" {
   location = "us-central1"
 }
 `, context)
-}
+}

mmv1/third_party/terraform/website/docs/guides/version_6_upgrade.html.markdown

@@ -414,4 +414,17 @@ that are derived from the API.
 
 ### `host.gce_instance.disable_ssh` now defaults to true
 
-`disable_ssh` field now defaults to true. To enable SSH, please set `disable_ssh` to false.
+`disable_ssh` field now defaults to true. To enable SSH, please set `disable_ssh` to false.
+
+## Resource: `metastore_service`
+
+### Service deletion now prevented by default with `deletion_protection`
+
+The field `deletion_protection` has been added with a default value of `true`. This field prevents
+Terraform from destroying or recreating the Service. In 6.0.0, existing services will have 
+`deletion_protection` set to `true` during the next refresh unless otherwise set in configuration.
+
+**`deletion_protection` does NOT prevent deletion outside of Terraform.**
+
+To disable deletion protection, explicitly set this field to `false` in configuration
+and then run `terraform apply` to apply the change.