Add support for BigQuery Column Level Security

[ed-hammond]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

With the introduction of Column Level Security in BigQuery, attempting to specify the policyTags in the table schema is silently ignored by the google_bigquery_table resource. There are no errors, but the policy is not applied to BigQuery. While it is nice errors are not thrown so that at least something gets defined, it leads to misunderstandings and potential security risks.

Would like to see the policyTags be passed to BigQuery for application to the field in question.

New or Affected Resource(s)

• google_bigquery_table

Potential Terraform Configuration

At a minimum, it would be helpful if this syntax were supported:

  {
     "name": "field_name",
     "type": "STRING",
     "mode": "NULLABLE",
     "description": "field description",
     "policyTags": {
       "names": [
         "projects/myproj/locations/us/taxonomies/123456789/policyTags/123456789",
         var.common_policy
       ]
     }
  },

References

• Add support for BigQuery taxonomies and policy tags Add support for BigQuery taxonomies and policy tags #6075
• Introduction to BigQuery Column-level security
• Restricting access with BigQuery Column-level security
• REST Resource: projects.locations.taxonomies
• REST Resource: projects.locations.taxonomies.policyTags

[danawillow]

What version of the provider are you using? I think this should work in some of the more recent versions.

[ed-hammond]

I upleveled to 3.19.0 and it works as expected.
I should have tried that before filing the issue.
Thanks. Sorry to have bothered you.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!