cloudsecuritycompliace: replace organization with parent to support PLE

[priyankksingh]

Description

This PR introduces Project Level Enablement (PLE) support for Cloud Security Compliance resources. Previously, these resources were strictly bound to the organization level. This change allows users to create and manage controls, frameworks, and deployments at the project level as well.

Key Changes:

• Introduced parent: Replaced the hardcoded organization parameter with a flexible parent parameter across CloudControl, Framework, and FrameworkDeployment.
• Backward Compatibility: The organization field is now marked as deprecated, but old configurations remain fully supported.
  • Added exactly_one_of: [parent, organization] with both fields marked as optional: true to allow seamless migration.
  • Added a pre_create custom code hook (cloudsecuritycompliance_set_parent.go.tmpl) to automatically construct the parent string for users who only provide organization.
  • Preserved the Terraform Identity Schema by keeping the legacy organizations/{{%organization}}/... format as the first entry in import_format, ensuring no state corruption for existing users.
• Perpetual Diff Fix: Added diff_suppress_func: 'tpgresource.CompareResourceNames' to targetResourceConfig.existingTargetResource in FrameworkDeployment.yaml to prevent state drift when the API normalizes between project IDs and project numbers.
• Expanded Testing: Added comprehensive Terraform acceptance tests demonstrating project-level configurations, folder-level deployments, and targeting specific applications like App Hub.

Release Note Template for Downstream PRs

See Write release notes for guidance.

cloudsecuritycompliance: added support for project parent to `google_cloud_security_compliance_cloud_control`, `google_cloud_security_compliance_framework`, and `google_cloud_security_compliance_framework_deployment` via the new `parent` field. The `organization` field has been deprecated.

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@slevenick, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[priyankksingh]

@slevenick Can you please review the PR.

[slevenick]

We can't remove a field like organization on these resources as it will be a breaking change for users who have current configurations that use it.

We can discuss other options to achieve the goals here

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 96969a5:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	14 files changed, 1481 insertions(+), 186 deletions(-)
google-beta provider	View Diff	14 files changed, 1481 insertions(+), 186 deletions(-)
terraform-google-conversion	View Diff	3 files changed, 24 insertions(+), 13 deletions(-)
Open in Cloud Shell	View Diff	8 files changed, 418 insertions(+)

Breaking Change(s) Detected

The following breaking change(s) were detected within your pull request.

• Field organization within resource google_cloud_security_compliance_framework_deployment was either removed or renamed - reference
• Field parent added as required on pre-existing resource google_cloud_security_compliance_framework_deployment - reference

If you believe this detection to be incorrect please raise the concern with your reviewer.
If you intend to make this change you will need to wait for a major release window.
An override-breaking-change label can be added to allow merging.

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_cloud_security_compliance_cloud_control (4 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_cloud_security_compliance_cloud_control" "primary" {
  organization = # value needed
}

Resource: google_cloud_security_compliance_framework (10 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_cloud_security_compliance_framework" "primary" {
  organization = # value needed
}

Test report

Analytics

Total Tests	Passed	Skipped	Affected
12	2	0	10

Affected Service Packages

• cloudsecuritycompliance

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 10 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccCloudSecurityComplianceCloudControl_cloudsecuritycomplianceCloudcontrolOrgBasicExample
• TestAccCloudSecurityComplianceCloudControl_cloudsecuritycomplianceCloudcontrolProjectBasicExample
• TestAccCloudSecurityComplianceFrameworkDeployment_cloudsecuritycomplianceFrameworkDeploymentFolderCreationExample
• TestAccCloudSecurityComplianceFrameworkDeployment_cloudsecuritycomplianceFrameworkDeploymentOrgBasicExample
• TestAccCloudSecurityComplianceFrameworkDeployment_cloudsecuritycomplianceFrameworkDeploymentOrgProjectBasicExample
• TestAccCloudSecurityComplianceFrameworkDeployment_cloudsecuritycomplianceFrameworkDeploymentProjectApplicationBasicExample
• TestAccCloudSecurityComplianceFrameworkDeployment_cloudsecuritycomplianceFrameworkDeploymentProjectBasicExample
• TestAccCloudSecurityComplianceFrameworkDeployment_cloudsecuritycomplianceFrameworkDeploymentProjectCreationExample
• TestAccCloudSecurityComplianceFramework_cloudsecuritycomplianceFrameworkOrgBasicExample
• TestAccCloudSecurityComplianceFramework_cloudsecuritycomplianceFrameworkProjectBasicExample

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
✅ Log	✅	TestAccCloudSecurityComplianceCloudControl_cloudsecuritycomplianceCloudcontrolOrgBasicExample
✅ Log	✅	TestAccCloudSecurityComplianceCloudControl_cloudsecuritycomplianceCloudcontrolProjectBasicExample
✅ Log	✅	TestAccCloudSecurityComplianceFrameworkDeployment_cloudsecuritycomplianceFrameworkDeploymentFolderCreationExample
✅ Log	✅	TestAccCloudSecurityComplianceFrameworkDeployment_cloudsecuritycomplianceFrameworkDeploymentOrgBasicExample
✅ Log	✅	TestAccCloudSecurityComplianceFrameworkDeployment_cloudsecuritycomplianceFrameworkDeploymentOrgProjectBasicExample
✅ Log	✅	TestAccCloudSecurityComplianceFrameworkDeployment_cloudsecuritycomplianceFrameworkDeploymentProjectApplicationBasicExample
✅ Log	✅	TestAccCloudSecurityComplianceFrameworkDeployment_cloudsecuritycomplianceFrameworkDeploymentProjectBasicExample
✅ Log	✅	TestAccCloudSecurityComplianceFrameworkDeployment_cloudsecuritycomplianceFrameworkDeploymentProjectCreationExample
✅ Log	✅	TestAccCloudSecurityComplianceFramework_cloudsecuritycomplianceFrameworkOrgBasicExample
✅ Log	✅	TestAccCloudSecurityComplianceFramework_cloudsecuritycomplianceFrameworkProjectBasicExample

🟢 All tests passed!

View the recording VCR build log or the debug logs folder for detailed results.

@priyankksingh VCR tests complete for 96969a5!

[slevenick]

Per offline comms, dismissing review until it's fully implemented

[priyankksingh]

@slevenick PR is ready for review. I have tested locally for all the 3 resources with old and new schema changes.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 5dc0f55:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	14 files changed, 2523 insertions(+), 199 deletions(-)
google-beta provider	View Diff	14 files changed, 2523 insertions(+), 199 deletions(-)
terraform-google-conversion	View Diff	3 files changed, 24 insertions(+), 13 deletions(-)
Open in Cloud Shell	View Diff	8 files changed, 418 insertions(+)

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_cloud_security_compliance_framework_deployment (7 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_cloud_security_compliance_framework_deployment" "primary" {
  organization = # value needed
}

Test report

Analytics

Total Tests	Passed	Skipped	Affected
15	10	0	5

Affected Service Packages

• cloudsecuritycompliance

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 5 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccCloudSecurityComplianceCloudControl_cloudsecuritycomplianceCloudcontrolOrgBasicBackwardExample
• TestAccCloudSecurityComplianceCloudControl_update
• TestAccCloudSecurityComplianceFrameworkDeployment_cloudsecuritycomplianceFrameworkDeploymentOrgBasicBackwardExample
• TestAccCloudSecurityComplianceFramework_cloudsecuritycomplianceFrameworkOrgBasicBackwardExample
• TestAccCloudSecurityComplianceFramework_update

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
✅ Log	✅	TestAccCloudSecurityComplianceCloudControl_cloudsecuritycomplianceCloudcontrolOrgBasicBackwardExample
✅ Log	✅	TestAccCloudSecurityComplianceCloudControl_update
✅ Log	✅	TestAccCloudSecurityComplianceFrameworkDeployment_cloudsecuritycomplianceFrameworkDeploymentOrgBasicBackwardExample
✅ Log	✅	TestAccCloudSecurityComplianceFramework_update
❌ Error · Log	-	TestAccCloudSecurityComplianceFramework_cloudsecuritycomplianceFrameworkOrgBasicBackwardExample

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@priyankksingh, @slevenick VCR tests complete for 5dc0f55!

[slevenick]

Add tests for all of these resources that switch from specifying organization to parent and ensuring there are no changes

[slevenick]

How does this work if parent is undefined?