Add support to allow create CMEK Redis instance in terraform

.changelog/6197.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+redis: Added CMEK key field `customer_managed_key` in `google_redis_instance `
+```

google/resource_redis_instance.go

@@ -136,6 +136,13 @@ will be used.`,
 				Description:  `The connection mode of the Redis instance. Default value: "DIRECT_PEERING" Possible values: ["DIRECT_PEERING", "PRIVATE_SERVICE_ACCESS"]`,
 				Default:      "DIRECT_PEERING",
 			},
+			"customer_managed_key": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				Description: `Optional. The KMS key reference that you want to use to encrypt the data at rest for this Redis
+instance. If this is provided, CMEK is enabled.`,
+			},
 			"display_name": {
 				Type:        schema.TypeString,
 				Optional:    true,
@@ -616,6 +623,12 @@ func resourceRedisInstanceCreate(d *schema.ResourceData, meta interface{}) error
 	} else if v, ok := d.GetOkExists("secondary_ip_range"); !isEmptyValue(reflect.ValueOf(secondaryIpRangeProp)) && (ok || !reflect.DeepEqual(v, secondaryIpRangeProp)) {
 		obj["secondaryIpRange"] = secondaryIpRangeProp
 	}
+	customerManagedKeyProp, err := expandRedisInstanceCustomerManagedKey(d.Get("customer_managed_key"), d, config)
+	if err != nil {
+		return err
+	} else if v, ok := d.GetOkExists("customer_managed_key"); !isEmptyValue(reflect.ValueOf(customerManagedKeyProp)) && (ok || !reflect.DeepEqual(v, customerManagedKeyProp)) {
+		obj["customerManagedKey"] = customerManagedKeyProp
+	}
 
 	obj, err = resourceRedisInstanceEncoder(d, meta, obj)
 	if err != nil {
@@ -827,6 +840,9 @@ func resourceRedisInstanceRead(d *schema.ResourceData, meta interface{}) error {
 	if err := d.Set("secondary_ip_range", flattenRedisInstanceSecondaryIpRange(res["secondaryIpRange"], d, config)); err != nil {
 		return fmt.Errorf("Error reading Instance: %s", err)
 	}
+	if err := d.Set("customer_managed_key", flattenRedisInstanceCustomerManagedKey(res["customerManagedKey"], d, config)); err != nil {
+		return fmt.Errorf("Error reading Instance: %s", err)
+	}
 
 	return nil
 }
@@ -1490,6 +1506,10 @@ func flattenRedisInstanceSecondaryIpRange(v interface{}, d *schema.ResourceData,
 	return v
 }
 
+func flattenRedisInstanceCustomerManagedKey(v interface{}, d *schema.ResourceData, config *Config) interface{} {
+	return v
+}
+
 func expandRedisInstanceAlternativeLocationId(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
 	return v, nil
 }
@@ -1778,6 +1798,10 @@ func expandRedisInstanceSecondaryIpRange(v interface{}, d TerraformResourceData,
 	return v, nil
 }
 
+func expandRedisInstanceCustomerManagedKey(v interface{}, d TerraformResourceData, config *Config) (interface{}, error) {
+	return v, nil
+}
+
 func resourceRedisInstanceEncoder(d *schema.ResourceData, meta interface{}, obj map[string]interface{}) (map[string]interface{}, error) {
 	config := meta.(*Config)
 	region, err := getRegionFromSchema("region", "location_id", d, config)

website/docs/r/redis_instance.html.markdown

@@ -182,6 +182,53 @@ resource "google_redis_instance" "cache" {
   }
 }
 
+// This example assumes this network already exists.
+// The API creates a tenant network per network authorized for a
+// Redis instance and that network is not deleted when the user-created
+// network (authorized_network) is deleted, so this prevents issues
+// with tenant network quota.
+// If this network hasn't been created and you are using this example in your
+// config, add an additional network resource or change
+// this from "data"to "resource"
+data "google_compute_network" "redis-network" {
+  name = "redis-test-network"
+}
+```
+## Example Usage - Redis Instance Cmek
+
+
+```hcl
+resource "google_redis_instance" "cache" {
+  name           = "cmek-memory-cache"
+  tier           = "STANDARD_HA"
+  memory_size_gb = 1
+
+  location_id             = "us-central1-a"
+  alternative_location_id = "us-central1-f"
+
+  authorized_network = data.google_compute_network.redis-network.id
+
+  redis_version     = "REDIS_6_X"
+  display_name      = "Terraform Test Instance"
+  reserved_ip_range = "192.168.0.0/29"
+
+  labels = {
+    my_key    = "my_val"
+    other_key = "other_val"
+  }
+  customer_managed_key = google_kms_crypto_key.redis_key.id
+}
+
+resource "google_kms_key_ring" "redis_keyring" {
+  name     = "redis-keyring"
+  location = "us-central1"
+}
+
+resource "google_kms_crypto_key" "redis_key" {
+  name            = "redis-key"
+  key_ring        = google_kms_key_ring.redis_keyring.id
+}
+
 // This example assumes this network already exists.
 // The API creates a tenant network per network authorized for a
 // Redis instance and that network is not deleted when the user-created
@@ -322,6 +369,11 @@ The following arguments are supported:
   "auto". For PRIVATE_SERVICE_ACCESS mode value must be the name of an allocated address 
   range associated with the private service access connection, or "auto".
 
+* `customer_managed_key` -
+  (Optional)
+  Optional. The KMS key reference that you want to use to encrypt the data at rest for this Redis
+  instance. If this is provided, CMEK is enabled.
+
 * `region` -
   (Optional)
   The name of the Redis region of the instance.