monitoring: add write-only support for notification_channel sensitive_labels

[GraceAtwood]

Fixes hashicorp/terraform-provider-google#21855

Summary

Adds write-only (_wo) variants for all three sensitive label fields in google_monitoring_notification_channel:

• auth_token_wo / auth_token_wo_version (Slack)
• password_wo / password_wo_version (webhook_basicauth)
• service_key_wo / service_key_wo_version (PagerDuty)

These fields use WriteOnly: true which prevents secrets from being stored in Terraform state files, addressing a long-standing security concern.

Implementation

Users can now choose between:

• sensitive_labels.service_key - Hidden from plan output, but stored in state (backwards compatible)
• sensitive_labels.service_key_wo - Hidden from plan output AND not stored in state (Terraform >= 1.11)

This implementation follows the pattern from google_secret_manager_secret_version using write_only_legacy for manual field generation to avoid conflicts with the existing exactly_one_of constraints (see hashicorp/terraform-provider-google#24327).

Changes

1. NotificationChannel.yaml - Added 6 new fields with write_only_legacy: true
2. Encoder template - Updated to send both regular and _wo field values to API
3. Decoder template - Updated to remove _wo fields from state on read

Testing

• ✅ Code generation successful for both GA and beta providers
• ✅ Generated schema includes WriteOnly: true on _wo fields
• ✅ Encoder/decoder handle both field variants correctly
• ✅ Documentation generated with write-only notes

Release Note Template for Downstream PRs (will be copied)

monitoring: added write-only variants (`auth_token_wo`, `password_wo`, `service_key_wo`) for `google_monitoring_notification_channel` sensitive_labels, enabling secret management without storing values in state

---

🤖 Generated with Claude Code

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[github-actions]

Hello! I am a robot. Tests will require approval from a repository maintainer to run.

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@c2thorn, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[GraceAtwood]

Hey 👋 we're getting the CLA sorted out sorry!

[ramonvermeulen]

Hi @GraceAtwood,

Thanks a lot for working on this implementation!

Today I started working on a first implementation for hashicorp/terraform-provider-google#24327 in #15538, making it also possible to do this via write_only: true instead of using the write_only_legacy: true.

Hopefully we can get hashicorp/terraform-provider-google#24327 resolved soon! If this feature is really high-prio, please go ahead and use write_only_legacy: true. But if not, I would maybe wait a bit for #15538 to get merged, in which I will implement this exact feature at the same time of implementing the pointer based constraint groups.

[github-actions]

@c2thorn This PR has been waiting for review for 3 weekdays. Please take a look! Use the label disable-review-reminders to disable these notifications.

[github-actions]

@GoogleCloudPlatform/terraform-team @c2thorn This PR has been waiting for review for 1 week. Please take a look! Use the label disable-review-reminders to disable these notifications.

[c2thorn]

pausing reminders while waiting on #15538 and CLAs

[GraceAtwood]

@ramonvermeulen @c2thorn hey yall! Wrangled the lawyers to get our CCLA sorted out and signed with google -> anthropic!

Thanks for the responses! I made this PR because this limitation is causing us to emit a secret into tf state in an otherwise pretty secure set up. I'd prefer to send this fix sooner rather than later if possible, but I promise not to leave it at that and I'll subscribe to that other PR and come back to remove the write_only_legacy after #15538 merges

Also, looks like the CLA check doesn't like claude on the co-authored line so I'll drop that.

[c2thorn]

@BBBmau do you mind taking an initial pass at this new WO support? I'm not very familiar with the feature yet.

[BBBmau]

explcitily adding the write-only isn't needed. You can add write-only support by adding write_only: true on the desired field in this case: authToken

[ramonvermeulen]

@BBBmau @melinath see #15538 (comment), unfortunately this isn't fully supported yet for fields with constraint groups. The PR I linked solves the constraint group issues, but while writing tests I encountered some other issues, because it is a nested field and url_param_only is set to true for this specific sensetive_labels implementation. I will see what I can do, because the goal is to make write_only: true generation work for any type of write-only use-case.

[GraceAtwood]

Am I following correctly then that there's no change I need to make here?

[melinath]

We'll only want to move forward with one of the PRs, and we'll definitely want to use the new write_only rather than write_only_legacy.

I'd ideally like to separate the general "handling of nested write_only fields" changes from "handling of notification_channel sensitive labels" to make things easier to review / less risky.

Given these are both community contributions (thanks both of you!) we could go either way. Currently I'd be inclined to stick with @ramonvermeulen's PR since it's pretty far along, but I could be convinced otherwise.

[melinath]

@c2thorn @BBBmau what do you think?

[c2thorn]

Spoke offline with @melinath and we prefer to move forward with #15538 as it spans the changes made here but in the preferred way. We'll move that PR higher in prioritization. There are still things to work out, but there is a release freeze for the next two weeks anyway.

[c2thorn]

@GraceAtwood appreciate your patience and efforts on this PR. At this point this can be closed in favor of #15538.

[GraceAtwood]

Sounds good thanks! closed this one

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 3 files changed, 91 insertions(+), 24 deletions(-))
google-beta provider: Diff ( 3 files changed, 91 insertions(+), 24 deletions(-))
terraform-google-conversion: Diff ( 5 files changed, 71 insertions(+), 15 deletions(-))

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_monitoring_notification_channel (14 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_monitoring_notification_channel" "primary" {
  sensitive_labels {
    auth_token_wo          = # value needed
    auth_token_wo_version  = # value needed
    password_wo            = # value needed
    password_wo_version    = # value needed
    service_key_wo         = # value needed
    service_key_wo_version = # value needed
  }
}

Missing doc report (experimental)

The following resources have fields missing in documents.

• google_monitoring_notification_channel
  • Expected Document Path: /website/docs/r/monitoring_notification_channel.html.markdown
  • Fields: [sensitive_labels.auth_token_wo sensitive_labels.auth_token_wo_version sensitive_labels.password_wo sensitive_labels.password_wo_version sensitive_labels.service_key_wo sensitive_labels.service_key_wo_version]

[modular-magician]

Tests analytics

Total tests: 58
Passed tests: 55
Skipped tests: 3
Affected tests: 0

Click here to see the affected service packages

• monitoring

🟢 All tests passed!

View the build log

[GraceAtwood]

Just rebased main since this is kind of old now

[GraceAtwood]

Added acceptance tests and fixed documentation generation for the write-only fields per the Modular Magician's feedback.