From db1c688742400fa191adf9099a6ef84b744ba168 Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Wed, 25 Feb 2026 15:26:47 -0500 Subject: [PATCH 01/19] Update ManagedZone.yaml to include iam_conditions_request_type: 'QUERY_PARAM_NESTED' included iam_conditions_request_type: 'QUERY_PARAM_NESTED' I think that QUERY_PARAM_NESTED is appropriate here because of the GetIamPolicyRequest --- mmv1/products/dns/ManagedZone.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/mmv1/products/dns/ManagedZone.yaml b/mmv1/products/dns/ManagedZone.yaml index 7781d6e75e08..183ef0dfa59b 100644 --- a/mmv1/products/dns/ManagedZone.yaml +++ b/mmv1/products/dns/ManagedZone.yaml @@ -33,6 +33,7 @@ iam_policy: method_name_separator: ':' fetch_iam_policy_verb: 'POST' parent_resource_attribute: 'managed_zone' + iam_conditions_request_type: 'QUERY_PARAM_NESTED' example_config_body: 'templates/terraform/iam/iam_attributes.go.tmpl' import_format: - 'projects/{{project}}/managedZones/{{managed_zone}}' From 786d577ff13894944e46262c20168b222f2d8542 Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Wed, 25 Feb 2026 15:44:10 -0500 Subject: [PATCH 02/19] Create dns_managed_zone_iam_condition.tf.tmpl add example fort he conditions --- .../dns_managed_zone_iam_condition.tf.tmpl | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl diff --git a/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl b/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl new file mode 100644 index 000000000000..a1ca34382013 --- /dev/null +++ b/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl @@ -0,0 +1,23 @@ +resource "google_dns_managed_zone" "default" { + name = "example-zone" + dns_name = "example-${random_id.rnd.hex}.com." + description = "Example zone for IAM conditions" +} + +resource "google_dns_managed_zone_iam_member" "condition_test" { + project = google_dns_managed_zone.default.project + managed_zone = google_dns_managed_zone.default.name + role = "roles/dns.admin" + member = "user:admin@example.com" + + condition { + title = "Exact Record Match" + description = "Allow modifying only api.example.com. A records" + # Mandatory pass-through clause for parent Managed Zone checks + expression = <<-EOT + (resource.type == 'dns.googleapis.com/ResourceRecordSet' && + resource.name.endsWith('/rrsets/api.example-${random_id.rnd.hex}.com./A')) || + (resource.type != 'dns.googleapis.com/ResourceRecordSet') + EOT + } +} From b772b6f7b7bb5851b114f2a224f19d989be1f06c Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Wed, 25 Feb 2026 15:48:28 -0500 Subject: [PATCH 03/19] Update ManagedZone.yaml Resolve conflicts --- mmv1/products/dns/ManagedZone.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/mmv1/products/dns/ManagedZone.yaml b/mmv1/products/dns/ManagedZone.yaml index 7e3dc18b0f0b..1e6a7d4cd8a0 100644 --- a/mmv1/products/dns/ManagedZone.yaml +++ b/mmv1/products/dns/ManagedZone.yaml @@ -34,7 +34,6 @@ iam_policy: fetch_iam_policy_verb: 'POST' parent_resource_attribute: 'managed_zone' iam_conditions_request_type: 'QUERY_PARAM_NESTED' - example_config_body: 'templates/terraform/iam/iam_attributes.go.tmpl' import_format: - 'projects/{{project}}/managedZones/{{managed_zone}}' - '{{project}}/{{managed_zone}}' From a85d40c4d15088b3b3150dbc70680fea24fe9134 Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Wed, 25 Feb 2026 15:59:32 -0500 Subject: [PATCH 04/19] Update ManagedZone.yaml add usage of template to managedzone.yaml --- mmv1/products/dns/ManagedZone.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mmv1/products/dns/ManagedZone.yaml b/mmv1/products/dns/ManagedZone.yaml index 1e6a7d4cd8a0..2205824f1938 100644 --- a/mmv1/products/dns/ManagedZone.yaml +++ b/mmv1/products/dns/ManagedZone.yaml @@ -125,6 +125,10 @@ examples: dns_name: 'services.example.com.' test_vars_overrides: 'dns_name': '"services.example.com-" + acctest.RandString(t, 10) + "."' + - name: 'dns_managed_zone_iam_condition' + primary_resource_id: 'default' + vars: + managed_zone_name: 'example-zone' virtual_fields: - name: 'force_destroy' description: 'Set this true to delete all records in the zone.' From 3eea375116886d7d3f30f69b60abdc94271aa66a Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Wed, 25 Feb 2026 16:00:12 -0500 Subject: [PATCH 05/19] Update dns_managed_zone_iam_condition.tf.tmpl add managed zone var to template --- .../terraform/examples/dns_managed_zone_iam_condition.tf.tmpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl b/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl index a1ca34382013..8d2c5ccacb93 100644 --- a/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl +++ b/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl @@ -1,5 +1,5 @@ resource "google_dns_managed_zone" "default" { - name = "example-zone" + name = "{{index $.Vars "managed_zone_name"}}" dns_name = "example-${random_id.rnd.hex}.com." description = "Example zone for IAM conditions" } From 96e4e5ffa95f85d759962dcfba340a285fe8bbcf Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Wed, 25 Feb 2026 16:34:21 -0500 Subject: [PATCH 06/19] Update ManagedZone.yaml randomize dns name in tests --- mmv1/products/dns/ManagedZone.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mmv1/products/dns/ManagedZone.yaml b/mmv1/products/dns/ManagedZone.yaml index 2205824f1938..ecfc7a96973b 100644 --- a/mmv1/products/dns/ManagedZone.yaml +++ b/mmv1/products/dns/ManagedZone.yaml @@ -128,7 +128,10 @@ examples: - name: 'dns_managed_zone_iam_condition' primary_resource_id: 'default' vars: + dns_name: 'example.com.' managed_zone_name: 'example-zone' + test_vars_overrides: + 'dns_name': '"consitions.example.com-" + acctest.RandString(t, 10) + "."' virtual_fields: - name: 'force_destroy' description: 'Set this true to delete all records in the zone.' From 8570a2c710f3696ed4812ded270628f000315671 Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Wed, 25 Feb 2026 16:36:33 -0500 Subject: [PATCH 07/19] Update dns_managed_zone_iam_condition.tf.tmpl use randomized dns name in tests --- .../terraform/examples/dns_managed_zone_iam_condition.tf.tmpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl b/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl index 8d2c5ccacb93..9c928f372e14 100644 --- a/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl +++ b/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl @@ -1,6 +1,6 @@ resource "google_dns_managed_zone" "default" { name = "{{index $.Vars "managed_zone_name"}}" - dns_name = "example-${random_id.rnd.hex}.com." + dns_name = "{{index $.Vars "dns_name"}}" description = "Example zone for IAM conditions" } @@ -16,7 +16,7 @@ resource "google_dns_managed_zone_iam_member" "condition_test" { # Mandatory pass-through clause for parent Managed Zone checks expression = <<-EOT (resource.type == 'dns.googleapis.com/ResourceRecordSet' && - resource.name.endsWith('/rrsets/api.example-${random_id.rnd.hex}.com./A')) || + resource.name.endsWith('/rrsets/api.{{index $.Vars "dns_name"}}/A')) || (resource.type != 'dns.googleapis.com/ResourceRecordSet') EOT } From 0434c21e121a072e2fa20da1df3bc8cf25551b65 Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Wed, 25 Feb 2026 16:39:35 -0500 Subject: [PATCH 08/19] Update ManagedZone.yaml fix typo --- mmv1/products/dns/ManagedZone.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mmv1/products/dns/ManagedZone.yaml b/mmv1/products/dns/ManagedZone.yaml index ecfc7a96973b..93b9a1d8cf4b 100644 --- a/mmv1/products/dns/ManagedZone.yaml +++ b/mmv1/products/dns/ManagedZone.yaml @@ -131,7 +131,7 @@ examples: dns_name: 'example.com.' managed_zone_name: 'example-zone' test_vars_overrides: - 'dns_name': '"consitions.example.com-" + acctest.RandString(t, 10) + "."' + 'dns_name': '"conditions.example.com-" + acctest.RandString(t, 10) + "."' virtual_fields: - name: 'force_destroy' description: 'Set this true to delete all records in the zone.' From c87b796fb30cc2f127f35afa6b89b7dd62c6e9e4 Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Tue, 10 Mar 2026 14:08:43 -0400 Subject: [PATCH 09/19] Update ManagedZone.yaml and add update_mask: true to allow version 3 in policy --- mmv1/products/dns/ManagedZone.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/mmv1/products/dns/ManagedZone.yaml b/mmv1/products/dns/ManagedZone.yaml index 1c75f759b580..c999067b2b2d 100644 --- a/mmv1/products/dns/ManagedZone.yaml +++ b/mmv1/products/dns/ManagedZone.yaml @@ -29,6 +29,7 @@ timeouts: insert_minutes: 20 update_minutes: 20 delete_minutes: 20 +update_mask: true iam_policy: method_name_separator: ':' fetch_iam_policy_verb: 'POST' From 3b71b7c56c1d58b591e45bbc84d3b916bcfe5c41 Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Tue, 10 Mar 2026 14:22:55 -0400 Subject: [PATCH 10/19] Update ManagedZone.yaml remove update_mask - at the resource level it won't help --- mmv1/products/dns/ManagedZone.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/mmv1/products/dns/ManagedZone.yaml b/mmv1/products/dns/ManagedZone.yaml index c999067b2b2d..1c75f759b580 100644 --- a/mmv1/products/dns/ManagedZone.yaml +++ b/mmv1/products/dns/ManagedZone.yaml @@ -29,7 +29,6 @@ timeouts: insert_minutes: 20 update_minutes: 20 delete_minutes: 20 -update_mask: true iam_policy: method_name_separator: ':' fetch_iam_policy_verb: 'POST' From bb5d1a00744ac3e9f94411200a85619e3acce983 Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Tue, 10 Mar 2026 17:09:49 -0400 Subject: [PATCH 11/19] Update the API Endpoint in ManagedZone.yaml The v1beta2 API requires all method paths to begin with dns//projects/ to maintain compatibility with legacy documentation . However, per-resource IAM methods (like setIamPolicy) require a different path format (dns//{+resource}) that breaks this requirement. --- mmv1/products/dns/ManagedZone.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mmv1/products/dns/ManagedZone.yaml b/mmv1/products/dns/ManagedZone.yaml index 1c75f759b580..0cec756d4f6f 100644 --- a/mmv1/products/dns/ManagedZone.yaml +++ b/mmv1/products/dns/ManagedZone.yaml @@ -34,7 +34,9 @@ iam_policy: fetch_iam_policy_verb: 'POST' parent_resource_attribute: 'managed_zone' iam_conditions_request_type: 'QUERY_PARAM_NESTED' + base_url: 'projects/{{project}}/locations/global/managedZones/{{managed_zone}}' import_format: + - 'projects/{{project}}/locations/global/managedZones/{{managed_zone}}' - 'projects/{{project}}/managedZones/{{managed_zone}}' - '{{project}}/{{managed_zone}}' custom_code: From 84d1e1fbcf6af9ae0a1ea0c17f221468ee56ed2e Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Wed, 11 Mar 2026 11:03:38 -0400 Subject: [PATCH 12/19] Update ManagedZone.yaml remove the base_url override it does not work as expected --- mmv1/products/dns/ManagedZone.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/mmv1/products/dns/ManagedZone.yaml b/mmv1/products/dns/ManagedZone.yaml index 0cec756d4f6f..1c75f759b580 100644 --- a/mmv1/products/dns/ManagedZone.yaml +++ b/mmv1/products/dns/ManagedZone.yaml @@ -34,9 +34,7 @@ iam_policy: fetch_iam_policy_verb: 'POST' parent_resource_attribute: 'managed_zone' iam_conditions_request_type: 'QUERY_PARAM_NESTED' - base_url: 'projects/{{project}}/locations/global/managedZones/{{managed_zone}}' import_format: - - 'projects/{{project}}/locations/global/managedZones/{{managed_zone}}' - 'projects/{{project}}/managedZones/{{managed_zone}}' - '{{project}}/{{managed_zone}}' custom_code: From 2f881b5509eeaeed2259dcc162b9693ab21f30fb Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Wed, 11 Mar 2026 11:22:26 -0400 Subject: [PATCH 13/19] Update iam_policy.go Add an UpdateMask field to the IamPolicy struct to allow resources to opt-in to sending the mask. --- mmv1/api/resource/iam_policy.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mmv1/api/resource/iam_policy.go b/mmv1/api/resource/iam_policy.go index 0f8d7f1017a0..c1d2fc212707 100644 --- a/mmv1/api/resource/iam_policy.go +++ b/mmv1/api/resource/iam_policy.go @@ -99,6 +99,10 @@ type IamPolicy struct { // How the API supports IAM conditions IamConditionsRequestType string `yaml:"iam_conditions_request_type,omitempty"` + // [Optional] Whether to include an updateMask in the setIamPolicy request. + // Mandatory for older APIs like DNS to support IAM conditions. + UpdateMask bool `yaml:"update_mask,omitempty"` + // Allows us to override the base_url of the resource. This is required for Cloud Run as the // IAM resources use an entirely different base URL from the actual resource BaseUrl string `yaml:"base_url,omitempty"` From f34cbff1e0e2483cfd7e2749673220e1af208321 Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Wed, 11 Mar 2026 11:25:16 -0400 Subject: [PATCH 14/19] Update iam_policy.go.tmpl Modify the template to inject "updateMask": "bindings,etag,version" into the request body when UpdateMask is true. --- mmv1/templates/terraform/iam_policy.go.tmpl | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/mmv1/templates/terraform/iam_policy.go.tmpl b/mmv1/templates/terraform/iam_policy.go.tmpl index 22b21fa5dc59..f7aee9562903 100644 --- a/mmv1/templates/terraform/iam_policy.go.tmpl +++ b/mmv1/templates/terraform/iam_policy.go.tmpl @@ -293,6 +293,10 @@ func (u *{{ $.ResourceName }}IamUpdater) SetResourceIamPolicy(policy *cloudresou {{ if and $.IamPolicy $.IamPolicy.WrappedPolicyObj -}} obj := make(map[string]interface{}) obj["policy"] = json + {{- if $.IamPolicy.UpdateMask }} + // Core APIs require the mask to acknowledge policy version 3 (conditions) + obj["updateMask"] = "bindings,etag,version" + {{- end }} {{- else }} obj := json {{- end }} @@ -356,4 +360,4 @@ func (u *{{ $.ResourceName }}IamUpdater) GetMutexKey() string { func (u *{{ $.ResourceName }}IamUpdater) DescribeResource() string { return fmt.Sprintf("{{ lower $.ProductMetadata.Name }} {{ lower $.Name }} %q", u.GetResourceId()) -} \ No newline at end of file +} From 643e2813c7fc43b6cbf49763b85700487942d765 Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Wed, 11 Mar 2026 11:26:11 -0400 Subject: [PATCH 15/19] Update ManagedZone.yaml enable update mask --- mmv1/products/dns/ManagedZone.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/mmv1/products/dns/ManagedZone.yaml b/mmv1/products/dns/ManagedZone.yaml index 1c75f759b580..047522b9481f 100644 --- a/mmv1/products/dns/ManagedZone.yaml +++ b/mmv1/products/dns/ManagedZone.yaml @@ -34,6 +34,7 @@ iam_policy: fetch_iam_policy_verb: 'POST' parent_resource_attribute: 'managed_zone' iam_conditions_request_type: 'QUERY_PARAM_NESTED' + update_mask: true import_format: - 'projects/{{project}}/managedZones/{{managed_zone}}' - '{{project}}/{{managed_zone}}' From 706259546ce8eea498c352c93de68fc4b0e52ba9 Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Wed, 11 Mar 2026 12:25:04 -0400 Subject: [PATCH 16/19] Update ManagedZone.yaml According to IAM internal documentation, conditional bindings are strictly prohibited for legacy "Basic" roles, which include roles/owner, roles/editor, and roles/viewer --- mmv1/products/dns/ManagedZone.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/mmv1/products/dns/ManagedZone.yaml b/mmv1/products/dns/ManagedZone.yaml index 047522b9481f..e0526971498d 100644 --- a/mmv1/products/dns/ManagedZone.yaml +++ b/mmv1/products/dns/ManagedZone.yaml @@ -34,6 +34,7 @@ iam_policy: fetch_iam_policy_verb: 'POST' parent_resource_attribute: 'managed_zone' iam_conditions_request_type: 'QUERY_PARAM_NESTED' + allowed_iam_role: 'roles/dns.admin' update_mask: true import_format: - 'projects/{{project}}/managedZones/{{managed_zone}}' From 89f432b74231a9a236aa2a8272935948e1fb7826 Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Wed, 11 Mar 2026 13:56:54 -0400 Subject: [PATCH 17/19] Update dns_managed_zone_iam_condition.tf.tmpl Change the expression in dns_managed_zone_iam_condition.tf.tmpl to a single-line string to avoid newline-related parsing errors --- .../examples/dns_managed_zone_iam_condition.tf.tmpl | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl b/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl index 9c928f372e14..ad20cb20666f 100644 --- a/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl +++ b/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl @@ -14,10 +14,6 @@ resource "google_dns_managed_zone_iam_member" "condition_test" { title = "Exact Record Match" description = "Allow modifying only api.example.com. A records" # Mandatory pass-through clause for parent Managed Zone checks - expression = <<-EOT - (resource.type == 'dns.googleapis.com/ResourceRecordSet' && - resource.name.endsWith('/rrsets/api.{{index $.Vars "dns_name"}}/A')) || - (resource.type != 'dns.googleapis.com/ResourceRecordSet') - EOT + expression = "(resource.type == 'dns.googleapis.com/ResourceRecordSet' && resource.name.endsWith('/rrsets/api.{{index $.Vars "dns_name"}}/A')) || (resource.type != 'dns.googleapis.com/ResourceRecordSet')" } } From b9f03af70fcba1c9851a3ab9ff8da8fb6f217ff8 Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Wed, 11 Mar 2026 15:31:18 -0400 Subject: [PATCH 18/19] Update dns_managed_zone_iam_condition.tf.tmpl try to use admin@hashicorptest.com instead of made up account --- .../terraform/examples/dns_managed_zone_iam_condition.tf.tmpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl b/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl index ad20cb20666f..c376eb957253 100644 --- a/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl +++ b/mmv1/templates/terraform/examples/dns_managed_zone_iam_condition.tf.tmpl @@ -8,7 +8,7 @@ resource "google_dns_managed_zone_iam_member" "condition_test" { project = google_dns_managed_zone.default.project managed_zone = google_dns_managed_zone.default.name role = "roles/dns.admin" - member = "user:admin@example.com" + member = "user:admin@hashicorptest.com" condition { title = "Exact Record Match" From 7a9f7b4f6414af256673aa612bedaef157317a2b Mon Sep 17 00:00:00 2001 From: shellyvilenko <144919183+shellyvilenko@users.noreply.github.com> Date: Thu, 12 Mar 2026 11:32:48 -0400 Subject: [PATCH 19/19] Update iam_policy.go try to fix formatting --- mmv1/api/resource/iam_policy.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mmv1/api/resource/iam_policy.go b/mmv1/api/resource/iam_policy.go index c1d2fc212707..5746e7e0b764 100644 --- a/mmv1/api/resource/iam_policy.go +++ b/mmv1/api/resource/iam_policy.go @@ -102,7 +102,7 @@ type IamPolicy struct { // [Optional] Whether to include an updateMask in the setIamPolicy request. // Mandatory for older APIs like DNS to support IAM conditions. UpdateMask bool `yaml:"update_mask,omitempty"` - + // Allows us to override the base_url of the resource. This is required for Cloud Run as the // IAM resources use an entirely different base URL from the actual resource BaseUrl string `yaml:"base_url,omitempty"`