Add fine-grained resource egressPolicy

[hao-nan-li]

Add fine-grained resource egressPolicy

If this PR is for Terraform, I acknowledge that I have:

• Searched through the issue tracker for an open issue that this either resolves or contributes to, commented on it to claim it, and written "fixes {url}" or "part of {url}" in this PR description. If there were no relevant open issues, I opened one and commented that I would like to work on it (not necessary for very small changes).
• Ensured that all new fields I added that can be set by a user appear in at least one example (for generated resources) or third_party test (for handwritten resources or update tests).
• Generated Terraform providers, and ran make test and make lint in the generated providers to ensure it passes unit and linter tests.
• Ran relevant acceptance tests using my own Google Cloud project and credentials (If the acceptance tests do not yet pass or you are unable to run them, please let your reviewer know).
• Read the Release Notes Guide before writing my release note below.

Release Note Template for Downstream PRs (will be copied)

`google_access_context_manager_egress_policy`

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

Terraform GA: Diff ( 5 files changed, 621 insertions(+), 2 deletions(-))
Terraform Beta: Diff ( 5 files changed, 621 insertions(+), 2 deletions(-))
TF Conversion: Diff ( 2 files changed, 3 insertions(+), 3 deletions(-))

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_access_context_manager_egress_policy (0 total tests)
Untested fields: egress_policy_name, resource

Please add acceptance tests which include these fields.

[modular-magician]

Tests analytics

Total tests: 2629
Passed tests 2345
Skipped tests: 277
Affected tests: 7

Action taken

Found 7 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

TestAccTPUNode_tpuNodeFullExample|TestAccFirebaserulesRelease_BasicRelease|TestAccAlloydbCluster_missingLocation|TestAccAlloydbBackup_missingLocation|TestAccApigeeKeystoresAliasesKeyCertFile_apigeeKeystoresAliasesKeyCertFileTestExample|TestAccApigeeKeystoresAliasesPkcs12_ApigeeKeystoresAliasesPkcs12Example|TestAccDataSourceGoogleFirebaseAndroidAppConfig

Get to know how VCR tests work

[modular-magician]

Tests passed during RECORDING mode:
TestAccFirebaserulesRelease_BasicRelease[Debug log]
TestAccAlloydbCluster_missingLocation[Debug log]
TestAccAlloydbBackup_missingLocation[Debug log]
TestAccApigeeKeystoresAliasesKeyCertFile_apigeeKeystoresAliasesKeyCertFileTestExample[Debug log]
TestAccApigeeKeystoresAliasesPkcs12_ApigeeKeystoresAliasesPkcs12Example[Debug log]
TestAccDataSourceGoogleFirebaseAndroidAppConfig[Debug log]

Tests failed during RECORDING mode:
TestAccTPUNode_tpuNodeFullExample[Error message] [Debug log]

Please fix these to complete your PR
View the build log or the debug log for each test

[melinath]

a few questions below. Also, could you do a manual test run in CI since the tests here skip VCR?

[melinath]

I would expect the name of this field to be something like service_perimeter since it is a reference to a service perimeter, not to an egress policy. (Since this resource is the egress policy.)

However, it looks like this would match the ingress policy resource added last week, so I'm fine with moving forward (unless we want to try to modify both.)

[hao-nan-li]

I'd prefer keeping it as it is to match ingress_policy

[melinath]

Since we have the opportunity, it would be great to modify both this & ingress policy to use service_perimeter (or some other name that refers to the target instead of the current resource) instead.

[melinath]

but I leave the decision to you.

[hao-nan-li]

egress.log

Uploaded the log for local run since this test is skipped by VCR.

Quick update: looks like Ingress_policy test passed in the nightly test.
https://ci-oss.hashicorp.engineering/test/-944881702515174777?currentProjectId=GoogleCloud&branch=%3Cdefault%3E
https://ci-oss.hashicorp.engineering/test/-944881702515174777?currentProjectId=GoogleCloudBeta&branch=%3Cdefault%3E

I believe the current status of this PR is good enough for users to use this fine-grained resource.

[melinath]

LGTM in terms of implementation. It looks like the fix for ingress policy is making the tests pass in the nightly build, but it will likely still need to be reverted from the release branch, so there is an opportunity to change the field name for the service perimeter reference if you want to.

[hao-nan-li]

LGTM in terms of implementation. It looks like the fix for ingress policy is making the tests pass in the nightly build, but it will likely still need to be reverted from the release branch, so there is an opportunity to change the field name for the service perimeter reference if you want to.

I tried to change the field name to servicePerimeter and to perimeterName, both return me an error "Invalid JSON payload received. Unknown name \"resource\" at 'service_perimeter': Cannot find field.". Given that the current functionality work fine, and that the naming is well aligned to ingressPolicy, I will go with the current implementation. If users later on run into issues, I will try to handle them during the fix-it window.