Terraform-provider-google: Add --oauth-service-account-email and --oauth-token-scope to cloud scheduler resource

[spacetj]

Description

Add --oauth-service-account-email and --oauth-token-scope to cloud scheduler resource so that we can use cloud scheduler to make gcp rest calls.

New or Affected Resource(s)

google_cloud_scheduler_job

Potential Terraform Configuration

resource "google_cloud_scheduler_job" "job" {
  name     = "test-job"
  schedule = "*/4 * * * *"
  oauth-service-account-email = "[email protected]"
  oauth-token-scope = "https://www.googleapis.com/auth/cloud-platform"

  http_target {
    uri = "https://region-gcp_project.cloudfunctions.net/func_name"
    http_method = "POST"
   }
}

---

Revised implementation Taken from @francoissera comment below.

resource "google_cloud_scheduler_job" "job" {
  name     = "test-job"
  schedule = "*/4 * * * *"

  http_target {
    uri = "https://region-gcp_project.cloudfunctions.net/func_name"
    http_method = "POST"
    oauthToken = {
        serviceAccountEmail = "myservice_account_email}"
        audience = "https://region-gcp_project.cloudfunctions.net/func_name"
     }
   }
 }

[francoisserra]

I think oauthToken and oidcToken are part of HttpTarget and not AppEngineHttpTarget, as stated in the API doc https://cloud.google.com/scheduler/docs/reference/rest/v1/projects.locations.jobs#httptarget

for example, to schedule the call of a http triggered cloud function with authentication enabled:

resource "google_cloud_scheduler_job" "job" {
  name     = "test-job"
  schedule = "*/4 * * * *"

  http_target {
    uri = "https://region-gcp_project.cloudfunctions.net/func_name"
    http_method = "POST"
    oidcToken = {
        serviceAccountEmail = "myservice_account_email}"
        audience = "https://region-gcp_project.cloudfunctions.net/func_name"
     }
   }
 }

[spacetj]

You're right @francoisserra. I have updated and credited my initial issue to take in your changes. Thanks for the feedback.

[chriswacker]

I would really like to see this so Cloud Scheduler jobs that call authenticated Cloud Run apps can be fully managed with Terraform.

[SP3269]

Should that be "oauth-token-scopes", plural and array, and not a singular "oauth-token-scope"? E.g.

oauth-token-scopes = [ "https://www.googleapis.com/auth/admin.directory.group", "https://www.googleapis.com/auth/admin.directory.user", ]

More often than not I use narrow scopes for my applications, have to use multiple.

[megan07]

Thanks @spacetj for opening this issue. It's been closed with #4222 and will be released shortly.

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!