Add support for setting kms_key_name on machine image

mmv1/products/compute/api.yaml

@@ -7553,7 +7553,6 @@ objects:
             output: true
           - !ruby/object:Api::Type::String
             name: 'kmsKeyName'
-            output: true
             description: |
               The name of the encryption key that is stored in Google Cloud KMS.
           - !ruby/object:Api::Type::String

mmv1/products/compute/terraform.yaml

@@ -1105,6 +1105,9 @@ overrides: !ruby/object:Overrides::ResourceOverrides
   License: !ruby/object:Overrides::Terraform::ResourceOverride
     exclude: true
   MachineImage: !ruby/object:Overrides::Terraform::ResourceOverride
+    properties:
+      machineImageEncryptionKey.kmsKeyName: !ruby/object:Overrides::Terraform::PropertyOverride
+        diff_suppress_func: compareCryptoKeyVersions
     iam_policy: !ruby/object:Api::Resource::IamPolicy
       allowed_iam_role: 'roles/compute.admin'
       parent_resource_attribute: 'machine_image'
@@ -1116,6 +1119,14 @@ overrides: !ruby/object:Overrides::ResourceOverrides
         vars:
           vm_name: "vm"
           image_name: "image"
+      - !ruby/object:Provider::Terraform::Examples
+        name: "compute_machine_image_kms"
+        primary_resource_id: "image"
+        vars:
+          vm_name: "vm"
+          image_name: "image"
+          key_name: "key"
+          keyring_name: "keyring"
 
   MachineType: !ruby/object:Overrides::Terraform::ResourceOverride
     exclude: true

mmv1/templates/terraform/examples/compute_machine_image_kms.tf.erb

@@ -0,0 +1,48 @@
+resource "google_compute_instance" "vm" {
+  provider     = google-beta
+  name         = "<%= ctx[:vars]['vm_name'] %>"
+  machine_type = "e2-medium"
+
+  boot_disk {
+    initialize_params {
+      image = "debian-cloud/debian-9"
+    }
+  }
+
+  network_interface {
+    network = "default"
+  }
+}
+
+resource "google_compute_machine_image" "<%= ctx[:primary_resource_id] %>" {
+  provider        = google-beta
+  name            = "<%= ctx[:vars]['image_name'] %>"
+  source_instance = google_compute_instance.vm.self_link
+  machine_image_encryption_key {
+    kms_key_name = google_kms_crypto_key.crypto_key.id
+  }
+  depends_on = [google_project_iam_member.kms-project-binding]
+}
+
+resource "google_kms_crypto_key" "crypto_key" {
+  provider = google-beta
+  name     = "<%= ctx[:vars]['key_name'] %>"
+  key_ring = google_kms_key_ring.key_ring.id
+}
+
+resource "google_kms_key_ring" "key_ring" {
+  provider = google-beta
+  name     = "<%= ctx[:vars]['keyring_name'] %>"
+  location = "us"
+}
+
+data "google_project" "project" {
+  provider = google-beta
+}
+
+resource "google_project_iam_member" "kms-project-binding" {
+  provider = google-beta
+  project  = data.google_project.project.project_id
+  role     = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member   = "serviceAccount:service-${data.google_project.project.number}@compute-system.iam.gserviceaccount.com"
+}