Repository: GoogleCloudPlatform/terraform-validator
Pull request #419 (2021-12-06 18:44:38)

Add support for google_spanner_instance_iam
<!-- Put a description of what this PR is for here, along with any references to issues that this resolves or contributes to -->

add support for google_spanner_instance_iam


<!--
Replace each [ ] with [X] to check it. Switch to the preview view to make it easier to click on links.
These steps will speed up the review process, and we appreciate you spending time on them before sending
your code to be reviewed.
-->
If this PR is for Terraform, I acknowledge that I have:

- [X] Searched through the [issue tracker](https://github.com/hashicorp/terraform-provider-google/issues) for an open issue that this either resolves or contributes to, commented on it to claim it, and written "fixes {url}" or "part of {url}" in this PR description. If there were no relevant open issues, I opened one and commented that I would like to work on it (not necessary for very small changes).
- [ ] [Generated Terraform](https://github.com/GoogleCloudPlatform/magic-modules#generating-downstream-tools), and ran `make test` and `make lint` to ensure it passes unit and linter tests.
- [ ] Ensured that all new fields I added that can be set by a user appear in at least one [example](https://github.com/GoogleCloudPlatform/magic-modules/tree/master/templates/terraform/examples) (for generated resources) or [third_party test](https://github.com/GoogleCloudPlatform/magic-modules/tree/master/third_party/terraform/tests) (for handwritten resources or update tests).
- [X] [Ran](https://github.com/hashicorp/terraform-provider-google/blob/master/.github/CONTRIBUTING.md#tests) relevant acceptance tests (If the acceptance tests do not yet pass or you are unable to run them, please let your reviewer know).
- [X] Read the [Release Notes Guide](https://github.com/GoogleCloudPlatform/magic-modules/blob/master/.ci/RELEASE_NOTES_GUIDE.md) before writing my release note below.

<!-- AUTOCHANGELOG for Downstream PRs.

Please select one of the following "release-note:" headings:
    - release-note:enhancement
    - release-note:bug
    - release-note:note
    - release-note:new-resource
    - release-note:new-datasource
    - release-note:deprecation
    - release-note:breaking-change
    - release-note:none
    
Unless you choose release-note:none, please add a release note.

See .ci/RELEASE_NOTES_GUIDE.md for writing good release notes.

You can add more release note blocks if you want more than one CHANGELOG
entry for this PR.
-->
**Release Note Template for Downstream PRs (will be copied)**

```release-note:enhancement

```

Derived from https://github.com/GoogleCloudPlatform/magic-modules/pull/5501


Patch:
diff --git a/converters/google/resources/iam_spanner_instance.go b/converters/google/resources/iam_spanner_instance.go
new file mode 100644
index 00000000..035d6115
--- /dev/null
+++ b/converters/google/resources/iam_spanner_instance.go
@@ -0,0 +1,162 @@
+package google
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+
+	"github.com/hashicorp/errwrap"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"google.golang.org/api/cloudresourcemanager/v1"
+	spanner "google.golang.org/api/spanner/v1"
+)
+
+var IamSpannerInstanceSchema = map[string]*schema.Schema{
+	"instance": {
+		Type:     schema.TypeString,
+		Required: true,
+		ForceNew: true,
+	},
+
+	"project": {
+		Type:     schema.TypeString,
+		Optional: true,
+		Computed: true,
+		ForceNew: true,
+	},
+}
+
+type SpannerInstanceIamUpdater struct {
+	project  string
+	instance string
+	d        TerraformResourceData
+	Config   *Config
+}
+
+func NewSpannerInstanceIamUpdater(d TerraformResourceData, config *Config) (ResourceIamUpdater, error) {
+	project, err := getProject(d, config)
+	if err != nil {
+		return nil, err
+	}
+
+	return &SpannerInstanceIamUpdater{
+		project:  project,
+		instance: d.Get("instance").(string),
+		d:        d,
+		Config:   config,
+	}, nil
+}
+
+func SpannerInstanceIdParseFunc(d *schema.ResourceData, config *Config) error {
+	id, err := extractSpannerInstanceId(d.Id())
+	if err != nil {
+		return err
+	}
+	if err := d.Set("instance", id.Instance); err != nil {
+		return fmt.Errorf("Error setting instance: %s", err)
+	}
+	if err := d.Set("project", id.Project); err != nil {
+		return fmt.Errorf("Error setting project: %s", err)
+	}
+
+	// Explicitly set the id so imported resources have the same ID format as non-imported ones.
+	d.SetId(id.terraformId())
+	return nil
+}
+
+func (u *SpannerInstanceIamUpdater) GetResourceIamPolicy() (*cloudresourcemanager.Policy, error) {
+	userAgent, err := generateUserAgentString(u.d, u.Config.userAgent)
+	if err != nil {
+		return nil, err
+	}
+
+	p, err := u.Config.NewSpannerClient(userAgent).Projects.Instances.GetIamPolicy(spannerInstanceId{
+		Project:  u.project,
+		Instance: u.instance,
+	}.instanceUri(), &spanner.GetIamPolicyRequest{}).Do()
+
+	if err != nil {
+		return nil, errwrap.Wrapf(fmt.Sprintf("Error retrieving IAM policy for %s: {{err}}", u.DescribeResource()), err)
+	}
+
+	cloudResourcePolicy, err := spannerToResourceManagerPolicy(p)
+
+	if err != nil {
+		return nil, errwrap.Wrapf(fmt.Sprintf("Invalid IAM policy for %s: {{err}}", u.DescribeResource()), err)
+	}
+
+	return cloudResourcePolicy, nil
+}
+
+func (u *SpannerInstanceIamUpdater) SetResourceIamPolicy(policy *cloudresourcemanager.Policy) error {
+	spannerPolicy, err := resourceManagerToSpannerPolicy(policy)
+
+	if err != nil {
+		return errwrap.Wrapf(fmt.Sprintf("Invalid IAM policy for %s: {{err}}", u.DescribeResource()), err)
+	}
+
+	userAgent, err := generateUserAgentString(u.d, u.Config.userAgent)
+	if err != nil {
+		return err
+	}
+
+	_, err = u.Config.NewSpannerClient(userAgent).Projects.Instances.SetIamPolicy(spannerInstanceId{
+		Project:  u.project,
+		Instance: u.instance,
+	}.instanceUri(), &spanner.SetIamPolicyRequest{
+		Policy: spannerPolicy,
+	}).Do()
+
+	if err != nil {
+		return errwrap.Wrapf(fmt.Sprintf("Error setting IAM policy for %s: {{err}}", u.DescribeResource()), err)
+	}
+
+	return nil
+}
+
+func (u *SpannerInstanceIamUpdater) GetResourceId() string {
+	return spannerInstanceId{
+		Project:  u.project,
+		Instance: u.instance,
+	}.terraformId()
+}
+
+func (u *SpannerInstanceIamUpdater) GetMutexKey() string {
+	return fmt.Sprintf("iam-spanner-instance-%s-%s", u.project, u.instance)
+}
+
+func (u *SpannerInstanceIamUpdater) DescribeResource() string {
+	return fmt.Sprintf("Spanner Instance: %s/%s", u.project, u.instance)
+}
+
+type spannerInstanceId struct {
+	Project  string
+	Instance string
+}
+
+func (s spannerInstanceId) terraformId() string {
+	return fmt.Sprintf("%s/%s", s.Project, s.Instance)
+}
+
+func (s spannerInstanceId) parentProjectUri() string {
+	return fmt.Sprintf("projects/%s", s.Project)
+}
+
+func (s spannerInstanceId) instanceUri() string {
+	return fmt.Sprintf("%s/instances/%s", s.parentProjectUri(), s.Instance)
+}
+
+func (s spannerInstanceId) instanceConfigUri(c string) string {
+	return fmt.Sprintf("%s/instanceConfigs/%s", s.parentProjectUri(), c)
+}
+
+func extractSpannerInstanceId(id string) (*spannerInstanceId, error) {
+	if !regexp.MustCompile("^" + ProjectRegex + "/[a-z0-9-]+$").Match([]byte(id)) {
+		return nil, fmt.Errorf("Invalid spanner id format, expecting {projectId}/{instanceId}")
+	}
+	parts := strings.Split(id, "/")
+	return &spannerInstanceId{
+		Project:  parts[0],
+		Instance: parts[1],
+	}, nil
+}
diff --git a/converters/google/resources/resource_converters.go b/converters/google/resources/resource_converters.go
index 6d4fb727..113fa639 100644
--- a/converters/google/resources/resource_converters.go
+++ b/converters/google/resources/resource_converters.go
@@ -51,6 +51,9 @@ func ResourceConverters() map[string][]ResourceConverter {
 		"google_spanner_database_iam_binding":              {resourceConverterSpannerDatabaseIamBinding()},
 		"google_spanner_database_iam_member":               {resourceConverterSpannerDatabaseIamMember()},
 		"google_spanner_instance":                          {resourceConverterSpannerInstance()},
+		"google_spanner_instance_iam_policy":               {resourceConverterSpannerInstanceIamPolicy()},
+		"google_spanner_instance_iam_binding":              {resourceConverterSpannerInstanceIamBinding()},
+		"google_spanner_instance_iam_member":               {resourceConverterSpannerInstanceIamMember()},
 		"google_project_service":                           {resourceConverterServiceUsage()},
 		"google_pubsub_subscription":                       {resourceConverterPubsubSubscription()},
 		"google_pubsub_topic":                              {resourceConverterPubsubTopic()},
diff --git a/converters/google/resources/spanner_instance_iam.go b/converters/google/resources/spanner_instance_iam.go
new file mode 100644
index 00000000..86dfe134
--- /dev/null
+++ b/converters/google/resources/spanner_instance_iam.go
@@ -0,0 +1,103 @@
+package google
+
+import "fmt"
+
+func resourceConverterSpannerInstanceIamPolicy() ResourceConverter {
+	return ResourceConverter{
+		AssetType:         "spanner.googleapis.com/Instance",
+		Convert:           GetSpannerInstanceIamPolicyCaiObject,
+		MergeCreateUpdate: MergeSpannerInstanceIamPolicy,
+	}
+}
+
+func resourceConverterSpannerInstanceIamBinding() ResourceConverter {
+	return ResourceConverter{
+		AssetType:         "spanner.googleapis.com/Instance",
+		Convert:           GetSpannerInstanceIamBindingCaiObject,
+		FetchFullResource: FetchSpannerInstanceIamPolicy,
+		MergeCreateUpdate: MergeSpannerInstanceIamBinding,
+		MergeDelete:       MergeSpannerInstanceIamBindingDelete,
+	}
+}
+
+func resourceConverterSpannerInstanceIamMember() ResourceConverter {
+	return ResourceConverter{
+		AssetType:         "spanner.googleapis.com/Instance",
+		Convert:           GetSpannerInstanceIamMemberCaiObject,
+		FetchFullResource: FetchSpannerInstanceIamPolicy,
+		MergeCreateUpdate: MergeSpannerInstanceIamMember,
+		MergeDelete:       MergeSpannerInstanceIamMemberDelete,
+	}
+}
+
+func GetSpannerInstanceIamPolicyCaiObject(d TerraformResourceData, config *Config) ([]Asset, error) {
+	return newSpannerInstanceIamAsset(d, config, expandIamPolicyBindings)
+}
+
+func GetSpannerInstanceIamBindingCaiObject(d TerraformResourceData, config *Config) ([]Asset, error) {
+	return newSpannerInstanceIamAsset(d, config, expandIamRoleBindings)
+}
+
+func GetSpannerInstanceIamMemberCaiObject(d TerraformResourceData, config *Config) ([]Asset, error) {
+	return newSpannerInstanceIamAsset(d, config, expandIamMemberBindings)
+}
+
+func MergeSpannerInstanceIamPolicy(existing, incoming Asset) Asset {
+	existing.IAMPolicy = incoming.IAMPolicy
+	return existing
+}
+
+func MergeSpannerInstanceIamBinding(existing, incoming Asset) Asset {
+	return mergeIamAssets(existing, incoming, mergeAuthoritativeBindings)
+}
+
+func MergeSpannerInstanceIamBindingDelete(existing, incoming Asset) Asset {
+	return mergeDeleteIamAssets(existing, incoming, mergeDeleteAuthoritativeBindings)
+}
+
+func MergeSpannerInstanceIamMember(existing, incoming Asset) Asset {
+	return mergeIamAssets(existing, incoming, mergeAdditiveBindings)
+}
+
+func MergeSpannerInstanceIamMemberDelete(existing, incoming Asset) Asset {
+	return mergeDeleteIamAssets(existing, incoming, mergeDeleteAdditiveBindings)
+}
+
+func newSpannerInstanceIamAsset(
+	d TerraformResourceData,
+	config *Config,
+	expandBindings func(d TerraformResourceData) ([]IAMBinding, error),
+) ([]Asset, error) {
+	bindings, err := expandBindings(d)
+	if err != nil {
+		return []Asset{}, fmt.Errorf("expanding bindings: %v", err)
+	}
+
+	name, err := assetName(d, config, "//spanner.googleapis.com/{{instance_id}}")
+	if err != nil {
+		return []Asset{}, err
+	}
+
+	return []Asset{{
+		Name: name,
+		Type: "spanner.googleapis.com/Instance",
+		IAMPolicy: &IAMPolicy{
+			Bindings: bindings,
+		},
+	}}, nil
+}
+
+func FetchSpannerInstanceIamPolicy(d TerraformResourceData, config *Config) (Asset, error) {
+	// Check if the identity field returns a value
+	if _, ok := d.GetOk("{{instance_id}}"); !ok {
+		return Asset{}, ErrEmptyIdentityField
+	}
+
+	return fetchIamPolicy(
+		NewSpannerInstanceIamUpdater,
+		d,
+		config,
+		"//spanner.googleapis.com/{{instance_id}}",
+		"spanner.googleapis.com/Instance",
+	)
+}


Test patch:
diff --git a/test/cli_test.go b/test/cli_test.go
index 5fd2a716..fcef7971 100644
--- a/test/cli_test.go
+++ b/test/cli_test.go
@@ -120,6 +120,9 @@ func TestCLI(t *testing.T) {
 		{name: "example_spanner_database_iam_binding"},
 		{name: "example_spanner_database_iam_member"},
 		{name: "example_spanner_database_iam_policy"},
+		{name: "example_spanner_instance_iam_binding"},
+		{name: "example_spanner_instance_iam_member"},
+		{name: "example_spanner_instance_iam_policy"},
 		{name: "example_sql_database_instance"},
 		{name: "example_storage_bucket"},
 		{name: "example_storage_bucket_iam_member_random_suffix"},
diff --git a/test/read_test.go b/test/read_test.go
index 01d3677b..d75e9d78 100644
--- a/test/read_test.go
+++ b/test/read_test.go
@@ -79,6 +79,9 @@ func TestReadPlannedAssetsCoverage(t *testing.T) {
 		{name: "example_spanner_database_iam_binding"},
 		{name: "example_spanner_database_iam_member"},
 		{name: "example_spanner_database_iam_policy"},
+		{name: "example_spanner_instance_iam_binding"},
+		{name: "example_spanner_instance_iam_member"},
+		{name: "example_spanner_instance_iam_policy"},
 		{name: "example_sql_database_instance"},
 		{name: "example_storage_bucket"},
 		{name: "example_storage_bucket_iam_member_random_suffix"},
diff --git a/testdata/templates/example_spanner_instance_iam_binding.json b/testdata/templates/example_spanner_instance_iam_binding.json
new file mode 100644
index 00000000..c1cc37e2
--- /dev/null
+++ b/testdata/templates/example_spanner_instance_iam_binding.json
@@ -0,0 +1,17 @@
+[
+  {
+    "name": "//spanner.googleapis.com/placeholder-BpLnfgDs",
+    "asset_type": "spanner.googleapis.com/Instance",
+    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
+    "iam_policy": {
+      "bindings": [
+        {
+          "role": "roles/compute.networkUser",
+          "members": [
+            "user:jane@example.com"
+          ]
+        }
+      ]
+    }
+  }
+]
diff --git a/testdata/templates/example_spanner_instance_iam_binding.tf b/testdata/templates/example_spanner_instance_iam_binding.tf
new file mode 100644
index 00000000..e7db4cb9
--- /dev/null
+++ b/testdata/templates/example_spanner_instance_iam_binding.tf
@@ -0,0 +1,37 @@
+/**
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+terraform {
+  required_providers {
+    google = {
+      source = "hashicorp/google"
+      version = "~> {{.Provider.version}}"
+    }
+  }
+}
+
+provider "google" {
+  {{if .Provider.credentials }}credentials = "{{.Provider.credentials}}"{{end}}
+}
+
+resource "google_spanner_instance_iam_binding" "instance" {
+  instance = "my-instance"
+  role     = "roles/compute.networkUser"
+
+  members = [
+    "user:jane@example.com",
+  ]
+}
diff --git a/testdata/templates/example_spanner_instance_iam_binding.tfplan.json b/testdata/templates/example_spanner_instance_iam_binding.tfplan.json
new file mode 100644
index 00000000..edca0192
--- /dev/null
+++ b/testdata/templates/example_spanner_instance_iam_binding.tfplan.json
@@ -0,0 +1,108 @@
+{
+  "format_version": "0.2",
+  "terraform_version": "1.0.10",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_spanner_instance_iam_binding.instance",
+          "mode": "managed",
+          "type": "google_spanner_instance_iam_binding",
+          "name": "instance",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 0,
+          "values": {
+            "condition": [],
+            "instance": "my-instance",
+            "members": [
+              "user:jane@example.com"
+            ],
+            "role": "roles/compute.networkUser"
+          },
+          "sensitive_values": {
+            "condition": [],
+            "members": [
+              false
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_spanner_instance_iam_binding.instance",
+      "mode": "managed",
+      "type": "google_spanner_instance_iam_binding",
+      "name": "instance",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "condition": [],
+          "instance": "my-instance",
+          "members": [
+            "user:jane@example.com"
+          ],
+          "role": "roles/compute.networkUser"
+        },
+        "after_unknown": {
+          "condition": [],
+          "etag": true,
+          "id": true,
+          "members": [
+            false
+          ],
+          "project": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "condition": [],
+          "members": [
+            false
+          ]
+        }
+      }
+    }
+  ],
+  "configuration": {
+    "provider_config": {
+      "google": {
+        "name": "google",
+        "expressions": {
+          "project": {
+            "constant_value": "{{.Provider.project}}"
+          }
+        }
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_spanner_instance_iam_binding.instance",
+          "mode": "managed",
+          "type": "google_spanner_instance_iam_binding",
+          "name": "instance",
+          "provider_config_key": "google",
+          "expressions": {
+            "instance": {
+              "constant_value": "my-instance"
+            },
+            "members": {
+              "constant_value": [
+                "user:jane@example.com"
+              ]
+            },
+            "role": {
+              "constant_value": "roles/compute.networkUser"
+            }
+          },
+          "schema_version": 0
+        }
+      ]
+    }
+  }
+}
diff --git a/testdata/templates/example_spanner_instance_iam_member.json b/testdata/templates/example_spanner_instance_iam_member.json
new file mode 100644
index 00000000..c1cc37e2
--- /dev/null
+++ b/testdata/templates/example_spanner_instance_iam_member.json
@@ -0,0 +1,17 @@
+[
+  {
+    "name": "//spanner.googleapis.com/placeholder-BpLnfgDs",
+    "asset_type": "spanner.googleapis.com/Instance",
+    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
+    "iam_policy": {
+      "bindings": [
+        {
+          "role": "roles/compute.networkUser",
+          "members": [
+            "user:jane@example.com"
+          ]
+        }
+      ]
+    }
+  }
+]
diff --git a/testdata/templates/example_spanner_instance_iam_member.tf b/testdata/templates/example_spanner_instance_iam_member.tf
new file mode 100644
index 00000000..60cf6bab
--- /dev/null
+++ b/testdata/templates/example_spanner_instance_iam_member.tf
@@ -0,0 +1,34 @@
+/**
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+terraform {
+  required_providers {
+    google = {
+      source = "hashicorp/google"
+      version = "~> {{.Provider.version}}"
+    }
+  }
+}
+
+provider "google" {
+  {{if .Provider.credentials }}credentials = "{{.Provider.credentials}}"{{end}}
+}
+
+resource "google_spanner_instance_iam_member" "instance" {
+  instance = "my-instance"
+  role     = "roles/compute.networkUser"
+  member   = "user:jane@example.com"
+}
diff --git a/testdata/templates/example_spanner_instance_iam_member.tfplan.json b/testdata/templates/example_spanner_instance_iam_member.tfplan.json
new file mode 100644
index 00000000..6f529373
--- /dev/null
+++ b/testdata/templates/example_spanner_instance_iam_member.tfplan.json
@@ -0,0 +1,93 @@
+{
+  "format_version": "0.2",
+  "terraform_version": "1.0.10",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_spanner_instance_iam_member.instance",
+          "mode": "managed",
+          "type": "google_spanner_instance_iam_member",
+          "name": "instance",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 0,
+          "values": {
+            "condition": [],
+            "instance": "my-instance",
+            "member": "user:jane@example.com",
+            "role": "roles/compute.networkUser"
+          },
+          "sensitive_values": {
+            "condition": []
+          }
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_spanner_instance_iam_member.instance",
+      "mode": "managed",
+      "type": "google_spanner_instance_iam_member",
+      "name": "instance",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "condition": [],
+          "instance": "my-instance",
+          "member": "user:jane@example.com",
+          "role": "roles/compute.networkUser"
+        },
+        "after_unknown": {
+          "condition": [],
+          "etag": true,
+          "id": true,
+          "project": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "condition": []
+        }
+      }
+    }
+  ],
+  "configuration": {
+    "provider_config": {
+      "google": {
+        "name": "google",
+        "expressions": {
+          "project": {
+            "constant_value": "{{.Provider.project}}"
+          }
+        }
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_spanner_instance_iam_member.instance",
+          "mode": "managed",
+          "type": "google_spanner_instance_iam_member",
+          "name": "instance",
+          "provider_config_key": "google",
+          "expressions": {
+            "instance": {
+              "constant_value": "my-instance"
+            },
+            "member": {
+              "constant_value": "user:jane@example.com"
+            },
+            "role": {
+              "constant_value": "roles/compute.networkUser"
+            }
+          },
+          "schema_version": 0
+        }
+      ]
+    }
+  }
+}
diff --git a/testdata/templates/example_spanner_instance_iam_policy.json b/testdata/templates/example_spanner_instance_iam_policy.json
new file mode 100644
index 00000000..f7beb4e4
--- /dev/null
+++ b/testdata/templates/example_spanner_instance_iam_policy.json
@@ -0,0 +1,17 @@
+[
+  {
+    "name": "//spanner.googleapis.com/placeholder-BpLnfgDs",
+    "asset_type": "spanner.googleapis.com/Instance",
+    "ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}",
+    "iam_policy": {
+      "bindings": [
+        {
+          "role": "roles/editor",
+          "members": [
+            "user:jane@example.com"
+          ]
+        }
+      ]
+    }
+  }
+]
diff --git a/testdata/templates/example_spanner_instance_iam_policy.tf b/testdata/templates/example_spanner_instance_iam_policy.tf
new file mode 100644
index 00000000..70bbe732
--- /dev/null
+++ b/testdata/templates/example_spanner_instance_iam_policy.tf
@@ -0,0 +1,44 @@
+/**
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+terraform {
+  required_providers {
+    google = {
+      source = "hashicorp/google"
+      version = "~> {{.Provider.version}}"
+    }
+  }
+}
+
+provider "google" {
+  {{if .Provider.credentials }}credentials = "{{.Provider.credentials}}"{{end}}
+}
+
+resource "google_spanner_instance_iam_policy" "instance" {
+  instance    = "my-instance"
+  policy_data = jsonencode(
+    {
+      bindings = [
+        {
+          members = [
+            "user:jane@example.com",
+          ]
+          role = "roles/editor"
+        }
+      ]
+    }
+  )
+}
diff --git a/testdata/templates/example_spanner_instance_iam_policy.tfplan.json b/testdata/templates/example_spanner_instance_iam_policy.tfplan.json
new file mode 100644
index 00000000..a4c72312
--- /dev/null
+++ b/testdata/templates/example_spanner_instance_iam_policy.tfplan.json
@@ -0,0 +1,79 @@
+{
+  "format_version": "0.2",
+  "terraform_version": "1.0.10",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_spanner_instance_iam_policy.instance",
+          "mode": "managed",
+          "type": "google_spanner_instance_iam_policy",
+          "name": "instance",
+          "provider_name": "registry.terraform.io/hashicorp/google",
+          "schema_version": 0,
+          "values": {
+            "instance": "my-instance",
+            "policy_data": "{\"bindings\":[{\"members\":[\"user:jane@example.com\"],\"role\":\"roles/editor\"}]}"
+          },
+          "sensitive_values": {}
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "google_spanner_instance_iam_policy.instance",
+      "mode": "managed",
+      "type": "google_spanner_instance_iam_policy",
+      "name": "instance",
+      "provider_name": "registry.terraform.io/hashicorp/google",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "instance": "my-instance",
+          "policy_data": "{\"bindings\":[{\"members\":[\"user:jane@example.com\"],\"role\":\"roles/editor\"}]}"
+        },
+        "after_unknown": {
+          "etag": true,
+          "id": true,
+          "project": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {}
+      }
+    }
+  ],
+  "configuration": {
+    "provider_config": {
+      "google": {
+        "name": "google",
+        "expressions": {
+          "project": {
+            "constant_value": "{{.Provider.project}}"
+          }
+        }
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "google_spanner_instance_iam_policy.instance",
+          "mode": "managed",
+          "type": "google_spanner_instance_iam_policy",
+          "name": "instance",
+          "provider_config_key": "google",
+          "expressions": {
+            "instance": {
+              "constant_value": "my-instance"
+            },
+            "policy_data": {}
+          },
+          "schema_version": 0
+        }
+      ]
+    }
+  }
+}