Acm ingress policy update fixes

[melinath]

Previous work in this area:

• accesscontextmanager: in-place updates for dry run policies #18578
• feat(accesscontextmanager): support in-place updates for IngressPolicy and EgressPolicy #17045

The big change this makes is limiting the update mask for the status / spec fields on ACM service perimeter so that it doesn't ever override values for fields on the fine-grained resources unless they're actually set (and changed!) on the service perimeter. This prevents problems that can arise when the resources are otherwise being used as intented.

Fixes hashicorp/terraform-provider-google#26728
Fixes hashicorp/terraform-provider-google#29005

Release Note Template for Downstream PRs (will be copied)

See Write release notes for guidance.

accesscontextmanager: added `etag` field to `google_access_context_manager_service_perimeter`

accesscontextmanager: fixed sending of `etag` on update requests for `google_access_context_manager_service_perimeter_egress_policy` and `google_access_context_manager_service_perimeter_ingress_policy` to prevent concurrent requests from impacting each other

accesscontextmanager: fixed bug in `google_access_context_manager_service_perimeter` where changes to the status / spec fields could cause updates to related ingress/egress policies even if those fields weren't specified on `google_access_context_manager_service_perimeter`

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit de20a70:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	9 files changed, 363 insertions(+), 26 deletions(-)
google-beta provider	View Diff	9 files changed, 363 insertions(+), 26 deletions(-)
terraform-google-conversion	View Diff	1 file changed, 10 insertions(+)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
3	2	0	1

Affected Service Packages

• accesscontextmanager

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 1 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccAccessContextManager

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
✅ Log	-	TestAccAccessContextManager/access_level
✅ Log	-	TestAccAccessContextManager/access_level_condition
✅ Log	-	TestAccAccessContextManager/access_level_custom
✅ Log	-	TestAccAccessContextManager/access_level_full
✅ Log	-	TestAccAccessContextManager/access_levels
✅ Log	-	TestAccAccessContextManager/access_policy
✅ Log	-	TestAccAccessContextManager/authorized_orgs_desc
✅ Log	-	TestAccAccessContextManager/data_source_access_policy_basic
✅ Log	-	TestAccAccessContextManager/gcp_user_access_binding_principal
✅ Log	-	TestAccAccessContextManager/service_perimeter
✅ Log	-	TestAccAccessContextManager/service_perimeter_dry_run_egress_policy
✅ Log	-	TestAccAccessContextManager/service_perimeter_dry_run_egress_policy_update
✅ Log	-	TestAccAccessContextManager/service_perimeter_dry_run_ingress_policy
✅ Log	-	TestAccAccessContextManager/service_perimeter_dry_run_ingress_policy_update
✅ Log	-	TestAccAccessContextManager/service_perimeter_dry_run_resource
✅ Log	-	TestAccAccessContextManager/service_perimeter_egress_policy
✅ Log	-	TestAccAccessContextManager/service_perimeter_egress_policy_parent_update
✅ Log	-	TestAccAccessContextManager/service_perimeter_egress_policy_update
✅ Log	-	TestAccAccessContextManager/service_perimeter_ingress_policy
✅ Log	-	TestAccAccessContextManager/service_perimeter_ingress_policy_update
✅ Log	-	TestAccAccessContextManager/service_perimeter_nongcp_patterns
✅ Log	-	TestAccAccessContextManager/service_perimeter_resource
✅ Log	-	TestAccAccessContextManager/service_perimeter_update
✅ Log	-	TestAccAccessContextManager/service_perimeters
✅ Log	-	TestAccAccessContextManager/service_perimeters_nongcp_patterns
❌ Error · Log	-	TestAccAccessContextManager/gcp_user_access_binding

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@melinath VCR tests complete for de20a70!

[melinath]

Failing VCR test looks unrelated.

I ported the TestAccAccessContextManager/service_perimeter_egress_policy_parent_update changes to main and confirmed it failed as expected per hashicorp/terraform-provider-google#29005:

Error: Unable to update ServicePerimeterEgressPolicy "accessPolicies/433581504775/servicePerimeters/perimeter" - not found in list

[melinath]

@modular-magician reassign-reviewer

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@ScottSuarez, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.