Add Cloud Identity Policy resource (v1beta1) to terraform google-beta

[gomu18]

Adding support for the resource https://docs.cloud.google.com/identity/docs/reference/rest/v1beta1/policies in Terraform beta

`google_cloud_identity_policy` (beta)

override-missing-service-label

[github-actions]

Hello! I am a robot. Tests will require approval from a repository maintainer to run.

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@hao-nan-li, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 2 files changed, 233 insertions(+))
google-beta provider: Diff ( 6 files changed, 1131 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 257 insertions(+))

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_cloud_identity_policy (0 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_cloud_identity_policy" "primary" {
  customer = # value needed
  policy_query {
    group    = # value needed
    org_unit = # value needed
    query    = # value needed
  }
  setting {
    type       = # value needed
    value_json = # value needed
  }
}

Missing service labels

The following new resources do not have corresponding service labels:

• google_cloud_identity_policy

If you believe this detection to be incorrect please raise the concern with your reviewer. Googlers: This error is safe to ignore once you've completed go/fix-missing-service-labels.
An override-missing-service-label label can be added to allow merging.

[modular-magician]

Tests analytics

Total tests: 3
Passed tests: 1
Skipped tests: 2
Affected tests: 0

Click here to see the affected service packages

• cloudidentity

🟢 All tests passed!

View the build log

[hao-nan-li]

Could you add some test for this new resource?

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 3 files changed, 378 insertions(+))
google-beta provider: Diff ( 8 files changed, 1411 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 257 insertions(+))

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_cloud_identity_policy (0 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_cloud_identity_policy" "primary" {
  customer = # value needed
  policy_query {
    group    = # value needed
    org_unit = # value needed
    query    = # value needed
  }
  setting {
    type       = # value needed
    value_json = # value needed
  }
}

Missing service labels

The following new resources do not have corresponding service labels:

• google_cloud_identity_policy

If you believe this detection to be incorrect please raise the concern with your reviewer. Googlers: This error is safe to ignore once you've completed go/fix-missing-service-labels.
An override-missing-service-label label can be added to allow merging.

[modular-magician]

Tests analytics

Total tests: 5
Passed tests: 1
Skipped tests: 2
Affected tests: 2

Click here to see the affected service packages

• cloudidentity

Action taken

Found 2 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

• TestAccCloudIdentityPolicy_cloudidentityPolicyBasic
• TestAccCloudIdentityPolicy_cloudidentityPolicyBasicExample

Get to know how VCR tests work

[modular-magician]

🔴 Tests failed during RECORDING mode:
TestAccCloudIdentityPolicy_cloudidentityPolicyBasic [Error message] [Debug log]
TestAccCloudIdentityPolicy_cloudidentityPolicyBasicExample [Error message] [Debug log]

🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR.

View the build log or the debug log for each test

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 3 files changed, 378 insertions(+))
google-beta provider: Diff ( 8 files changed, 1411 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 257 insertions(+))

Missing service labels

The following new resources do not have corresponding service labels:

• google_cloud_identity_policy

If you believe this detection to be incorrect please raise the concern with your reviewer. Googlers: This error is safe to ignore once you've completed go/fix-missing-service-labels.
An override-missing-service-label label can be added to allow merging.

[modular-magician]

Tests analytics

Total tests: 5
Passed tests: 1
Skipped tests: 2
Affected tests: 2

Click here to see the affected service packages

• cloudidentity

Action taken

Found 2 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

• TestAccCloudIdentityPolicy_cloudidentityPolicyBasic
• TestAccCloudIdentityPolicy_cloudidentityPolicyBasicExample

Get to know how VCR tests work

[modular-magician]

🔴 Tests failed during RECORDING mode:
TestAccCloudIdentityPolicy_cloudidentityPolicyBasic [Error message] [Debug log]
TestAccCloudIdentityPolicy_cloudidentityPolicyBasicExample [Error message] [Debug log]

🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR.

View the build log or the debug log for each test

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 3 files changed, 378 insertions(+))
google-beta provider: Diff ( 8 files changed, 1411 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 257 insertions(+))

Missing service labels

The following new resources do not have corresponding service labels:

• google_cloud_identity_policy

If you believe this detection to be incorrect please raise the concern with your reviewer. Googlers: This error is safe to ignore once you've completed go/fix-missing-service-labels.
An override-missing-service-label label can be added to allow merging.

[modular-magician]

Tests analytics

Total tests: 5
Passed tests: 1
Skipped tests: 2
Affected tests: 2

Click here to see the affected service packages

• cloudidentity

Action taken

Found 2 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

• TestAccCloudIdentityPolicy_cloudidentityPolicyBasic
• TestAccCloudIdentityPolicy_cloudidentityPolicyBasicExample

Get to know how VCR tests work

[modular-magician]

🔴 Tests failed during RECORDING mode:
TestAccCloudIdentityPolicy_cloudidentityPolicyBasic [Error message] [Debug log]
TestAccCloudIdentityPolicy_cloudidentityPolicyBasicExample [Error message] [Debug log]

🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR.

View the build log or the debug log for each test

[github-actions]

@hao-nan-li This PR has been waiting for review for 3 weekdays. Please take a look! Use the label disable-review-reminders to disable these notifications.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 5 files changed, 1049 insertions(+))
google-beta provider: Diff ( 9 files changed, 2022 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 286 insertions(+))

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_cloud_identity_policy (2 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_cloud_identity_policy" "primary" {
  policy_query {
    group = # value needed
  }
}

Missing service labels

The following new resources do not have corresponding service labels:

• google_cloud_identity_policy

If you believe this detection to be incorrect please raise the concern with your reviewer. Googlers: This error is safe to ignore once you've completed go/fix-missing-service-labels.
An override-missing-service-label label can be added to allow merging.

[modular-magician]

Tests analytics

Total tests: 4
Passed tests: 1
Skipped tests: 2
Affected tests: 1

Click here to see the affected service packages

• cloudidentity

Action taken

Found 1 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

• TestAccCloudIdentityPolicy_cloudidentityPolicyBasic

Get to know how VCR tests work

[modular-magician]

🔴 Tests failed during RECORDING mode:
TestAccCloudIdentityPolicy_cloudidentityPolicyBasic [Error message] [Debug log]

🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR.

View the build log or the debug log for each test

[gomu18]

I have added resource acceptance tests to test out Create/Update/Delete/Get flows. I ran into 2 issues here.

1. I was unable to run the test in RECORDING mode in CI because the API requires Workspace Super Admin credentials which cannot be replicated in a CI setup. So I recorded the tests locally, and the committed those files in test-fixtures directory so that they get copied over and can be REPLAYED, but the PR still shows failures for running in RECORDING mode. How to stop that?
2. I want to generate this change only for google-beta and have mentioned this in the resource yaml as well, but I still have build and unit tests failing for the google provider. Can you help me with how to disable that?

The large PR is because of the checked in VCR cassette file, and if that is excluded, it is less than the limit of 500 lines of code. Thanks.

[hao-nan-li]

I have added resource acceptance tests to test out Create/Update/Delete/Get flows. I ran into 2 issues here.

1. I was unable to run the test in RECORDING mode in CI because the API requires Workspace Super Admin credentials which cannot be replicated in a CI setup. So I recorded the tests locally, and the committed those files in test-fixtures directory so that they get copied over and can be REPLAYED, but the PR still shows failures for running in RECORDING mode. How to stop that?
2. I want to generate this change only for google-beta and have mentioned this in the resource yaml as well, but I still have build and unit tests failing for the google provider. Can you help me with how to disable that?

The large PR is because of the checked in VCR cassette file, and if that is excluded, it is less than the limit of 500 lines of code. Thanks.

1. You can skip the test on CI, and upload logs from a local run.
2. Search for existing code with "{{ if eq $.TargetVersionName ga }}", these blocks are used to exclude changes to google-provider.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 4 files changed, 879 insertions(+))
google-beta provider: Diff ( 9 files changed, 2022 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 286 insertions(+))

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_cloud_identity_policy (2 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_cloud_identity_policy" "primary" {
  policy_query {
    group = # value needed
  }
}

Missing service labels

The following new resources do not have corresponding service labels:

• google_cloud_identity_policy

If you believe this detection to be incorrect please raise the concern with your reviewer. Googlers: This error is safe to ignore once you've completed go/fix-missing-service-labels.
An override-missing-service-label label can be added to allow merging.

[modular-magician]

Tests analytics

Total tests: 4
Passed tests: 1
Skipped tests: 2
Affected tests: 1

Click here to see the affected service packages

• cloudidentity

Action taken

Found 1 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

• TestAccCloudIdentityPolicy_cloudidentityPolicyBasic

Get to know how VCR tests work

[modular-magician]

🔴 Tests failed during RECORDING mode:
TestAccCloudIdentityPolicy_cloudidentityPolicyBasic [Error message] [Debug log]

🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR.

View the build log or the debug log for each test

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 4 files changed, 879 insertions(+))
google-beta provider: Diff ( 9 files changed, 2024 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 286 insertions(+))

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_cloud_identity_policy (2 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_cloud_identity_policy" "primary" {
  policy_query {
    group = # value needed
  }
}

Missing service labels

The following new resources do not have corresponding service labels:

• google_cloud_identity_policy

If you believe this detection to be incorrect please raise the concern with your reviewer. Googlers: This error is safe to ignore once you've completed go/fix-missing-service-labels.
An override-missing-service-label label can be added to allow merging.

[modular-magician]

Non-exercised tests

🔴 Tests were added that are skipped in VCR:

• TestAccCloudIdentityPolicy_cloudidentityPolicyBasic

Tests analytics

Total tests: 4
Passed tests: 1
Skipped tests: 3
Affected tests: 0

Click here to see the affected service packages

• cloudidentity

🟢 All tests passed!

View the build log

[hao-nan-li]

Perhaps I missed, have you uploaded the full log of the skipped test?

[gomu18]

Perhaps I missed, have you uploaded the full log of the skipped test?

Yes, please look at the file mmv1/third_party/terraform/services/cloudidentity/test-fixtures/TestAccCloudIdentityPolicy_cloudidentityPolicyBasic.yaml in the Files Changed tab. It contains logs from the test which was run in RECORDING mode.

[github-actions]

@hao-nan-li This PR has been waiting for review for 3 weekdays. Please take a look! Use the label disable-review-reminders to disable these notifications.

[hao-nan-li]

Perhaps I missed, have you uploaded the full log of the skipped test?

Yes, please look at the file mmv1/third_party/terraform/services/cloudidentity/test-fixtures/TestAccCloudIdentityPolicy_cloudidentityPolicyBasic.yaml in the Files Changed tab. It contains logs from the test which was run in RECORDING mode.

Could you run it locally and put the log in gpaste?

[github-actions]

@GoogleCloudPlatform/terraform-team @hao-nan-li This PR has been waiting for review for 1 week. Please take a look! Use the label disable-review-reminders to disable these notifications.

[hao-nan-li]

Can you remove this file from this PR?

[gomu18]

Without this file, there is no checked in evidence that I was able to run the tests without skipping and those calls succeeded. There are other examples like https://github.com/GoogleCloudPlatform/magic-modules/blob/main/mmv1/third_party/terraform/services/compute/test-fixtures/openapi.yaml, which have checked in yaml files.

Also I can run the test in replay mode with this file present, and use it to debug in the future if any breakages occur.

[gomu18]

Deleted after offline discussion. http://gpaste/6308412330737664 for proof of test run.

[hao-nan-li]

Is this file necessary?

[gomu18]

Yes, because it is used in conjunction with above yaml file to do replay runs.

[gomu18]

Deleted after offline discussion.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 2 files changed, 255 insertions(+))
google-beta provider: Diff ( 7 files changed, 1400 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 286 insertions(+))

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_cloud_identity_policy (2 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_cloud_identity_policy" "primary" {
  policy_query {
    group = # value needed
  }
}

Missing service labels

The following new resources do not have corresponding service labels:

• google_cloud_identity_policy

If you believe this detection to be incorrect please raise the concern with your reviewer. Googlers: This error is safe to ignore once you've completed go/fix-missing-service-labels.
An override-missing-service-label label can be added to allow merging.

[hao-nan-li]

https://paste.googleplex.com/6308412330737664 for TestAccCloudIdentityPolicy_cloudidentityPolicyBasic

[modular-magician]

Non-exercised tests

🔴 Tests were added that are skipped in VCR:

• TestAccCloudIdentityPolicy_cloudidentityPolicyBasic

Tests analytics

Total tests: 4
Passed tests: 1
Skipped tests: 3
Affected tests: 0

Click here to see the affected service packages

• cloudidentity

🟢 All tests passed!

View the build log

[hao-nan-li]

I noticed most of the fields are marked as immutable, is this resource immutable?

[gomu18]

No, the setting object has a nested field called valueJson which is mutable.

[notravis516-ux]

I cannot connect it to my web address and I need a fix on these issues. I really appreciate it.

[hao-nan-li]

I cannot connect it to my web address and I need a fix on these issues. I really appreciate it.

This PR is merged but not released yet. Did the issue happen when you tried to use this feature?

[notravis516-ux]

I don't think so but I had to fix something before I ran the badge fix. I am back in firebase now though doing everything I can but I'm kinda new at this so I had to use Gemini a lot. I don't have a clue what's up with it. I didn't think that you would be that fast to respond. I appreciate you. My weird program was mostly installed when I had a freaking script error and when I got past that now I just can't get it to link up??

…

On Wed, Feb 11, 2026, 4:16 PM hao-nan-li ***@***.***> wrote: *hao-nan-li* left a comment (GoogleCloudPlatform/magic-modules#16241) <#16241 (comment)> I cannot connect it to my web address and I need a fix on these issues. I really appreciate it. This PR is merged but not released yet. Did the issue happen when you tried to use this feature? — Reply to this email directly, view it on GitHub <#16241 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/B2LVEWKEYSDW6ZMGUJX4UVT4LOS4JAVCNFSM6AAAAACTCWEBFOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTQOBXGUZDQMRTHE> . You are receiving this because you commented.Message ID: ***@***.***>