Add google_apigee_datastore resource

[ogormans-deptstack]

New resource google_apigee_datastore for managing Apigee Analytics data export destinations via the organizations.analytics.datastores API.

Fixes hashicorp/terraform-provider-google#24772

Datastores define where Apigee exports analytics data -- either a Cloud Storage bucket or a BigQuery dataset. This resource supports both target types with all configuration fields from the API.

Tested all CRUD operations + import against a live Apigee evaluation org:

• Create (1s)
• Read with no drift
• Update in-place (display name, GCS path)
• Import by full resource path (5-segment: organizations/{org}/analytics/datastores/{uuid})
• Delete

Key implementation details:

• The API returns a self field (not name) containing the full resource path with a server-assigned UUID. A custom decoder extracts the UUID from the last path segment of self and sets it as name for URL template resolution.
• Uses PUT with no update mask (same pattern as DeveloperApp, CustomReport).
• The API normalizes the GCS path field with a leading / -- the example reflects this.
• targetType is immutable (cannot switch between gcs and bigquery after creation).

Operational note on lifecycle management

Analytics datastores are often used in rotation patterns -- e.g., pointing exports to date-partitioned GCS paths or rotating BigQuery table prefixes on a schedule. When managing datastores that receive frequent config updates from external automation (export schedulers, rotation scripts), users may want to use Terraform lifecycle meta-arguments to avoid drift:

resource "google_apigee_datastore" "analytics_export" {
  org_id       = google_apigee_organization.org.id
  display_name = "analytics-export"
  target_type  = "gcs"

  datastore_config {
    project_id  = "my-project"
    bucket_name = "my-analytics-bucket"
    path        = "/exports/current"
  }

  # If an external process rotates the export path on a schedule,
  # ignore changes to avoid Terraform reverting the rotation.
  lifecycle {
    ignore_changes = [datastore_config[0].path]
  }
}

For datastores that are fully Terraform-managed with no external rotation, no special lifecycle configuration is needed.

Related to PR #16954 (google_apigee_data_collector) and PR #16955 (google_apigee_custom_report).

Release Note Template for Downstream PRs (will be copied)

`google_apigee_datastore`

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@NickElliot, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[github-actions]

@NickElliot This PR has been waiting for review for 3 weekdays. Please take a look! Use the label disable-review-reminders to disable these notifications.

[github-actions]

@GoogleCloudPlatform/terraform-team @NickElliot This PR has been waiting for review for 1 week. Please take a look! Use the label disable-review-reminders to disable these notifications.

[NickElliot]

sorry for the delays, was on PTO! could you share logs of running those tests on your configured environment?

[ogormans-deptstack]

@NickElliot CI is looking clean on this one — all checks pass:

• ✅ terraform-provider-google unit tests
• ✅ terraform-provider-google-beta unit tests
• ✅ terraform-google-conversion compile + unit tests
• ✅ lint-yaml, disallow-large-prs, docs-examples, version-guard
• ✅ Generation for all three downstreams
• ⏳ downstream-generation-and-test still running (full VCR suite)

Similar to #16954 (DataCollector), this Datastore resource requires a live Apigee org so the acceptance test is VCR-skipped. The resource has been manually tested end-to-end against a live GCP project — full CRUD lifecycle verified.

Same note as above — I've already incorporated the review patterns from @zli82016 on #16955 (vars, update tests, etc.) and can apply them here if needed.

Happy to make any changes — just let me know.

[ogormans-deptstack]

Pushed a test template fix found during local acceptance testing:

• Enabled storage.googleapis.com on the test project (the GCS basic test needs it explicitly)
• Added uniform_bucket_level_access = true on the analytics bucket (required by orgs with constraints/storage.uniformBucketLevelAccess)
• Added depends_on to ensure the bucket waits for the storage API

This push should trigger a fresh CI run. The DataCollector sibling resource (#16954) passed its full acceptance test locally — 15 minute end-to-end CRUD lifecycle against a live Apigee org.

[NickElliot]

I still need to see debug logs of the acceptance tests passing even if they passed on the other resource, thanks!

Also as with the other resource, I double checked other apigee tests and saw we are able to provision Orgs within those tests without skipping them in CI/VCR e.g. TestAccApigeeOrganization_apigeeOrganizationCloudBasicTestExample, is there any reason we can't do the same here?

[ogormans-deptstack]

Thanks @NickElliot — same answer as on #16954. I'll remove skip_vcr from both test examples here too and let CI's VCR recording determine whether the Apigee Datastore API responses replay cleanly. Pushing the change alongside the template fix for the storage bucket constraint.

Appreciate the thorough review.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit bdd7f31:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	4 files changed, 1369 insertions(+)
google-beta provider	View Diff	4 files changed, 1369 insertions(+)
terraform-google-conversion	View Diff	1 file changed, 211 insertions(+)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
77	35	38	4

Affected Service Packages

• apigee

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 4 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

• TestAccApigeeDatastore_apigeeDatastoreBasicTestExample
• TestAccApigeeDatastore_apigeeDatastoreBigqueryTestExample
• TestAccApigeeOrganization_apigeeOrganizationCloudBasicDisableVpcPeeringTestExample
• TestAccApigeeOrganization_apigeeOrganizationCloudFullDisableVpcPeeringTestExample

View the build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
✅ Log	✅	TestAccApigeeDatastore_apigeeDatastoreBasicTestExample
❌ Error · Log	-	TestAccApigeeDatastore_apigeeDatastoreBigqueryTestExample
❌ Error · Log	-	TestAccApigeeOrganization_apigeeOrganizationCloudBasicDisableVpcPeeringTestExample
❌ Error · Log	-	TestAccApigeeOrganization_apigeeOrganizationCloudFullDisableVpcPeeringTestExample

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the build log or the debug logs folder for detailed results.

@ogormans-deptstack, @NickElliot VCR tests complete for bdd7f31!

[github-actions]

@NickElliot This PR has been waiting for review for 3 weekdays. Please take a look! Use the label disable-review-reminders to disable these notifications.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit ce4434b:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	4 files changed, 1369 insertions(+)
google-beta provider	View Diff	4 files changed, 1369 insertions(+)
terraform-google-conversion	View Diff	1 file changed, 211 insertions(+)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
77	36	38	3

Affected Service Packages

• apigee

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 3 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

• TestAccApigeeDatastore_apigeeDatastoreBigqueryTestExample
• TestAccApigeeOrganization_apigeeOrganizationCloudBasicDisableVpcPeeringTestExample
• TestAccApigeeOrganization_apigeeOrganizationCloudFullDisableVpcPeeringTestExample

View the build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
❌ Error · Log	-	TestAccApigeeDatastore_apigeeDatastoreBigqueryTestExample
❌ Error · Log	-	TestAccApigeeOrganization_apigeeOrganizationCloudBasicDisableVpcPeeringTestExample
❌ Error · Log	-	TestAccApigeeOrganization_apigeeOrganizationCloudFullDisableVpcPeeringTestExample

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the build log or the debug logs folder for detailed results.

@ogormans-deptstack, @NickElliot VCR tests complete for ce4434b!

[ogormans-deptstack]

@NickElliot VCR results are in.

VCR recording results:

• TestAccApigeeDatastore_apigeeDatastoreBigqueryTestExample — failed (org provisioning)
• TestAccApigeeOrganization_* (x2) — failed (pre-existing, unrelated)

The Datastore test failure is in the same category as the Organization tests — the generated test creates a full Apigee org from scratch (new project, VPC, service networking, org provisioning) which is inherently fragile in VCR recording mode. The two Organization test failures are pre-existing and appear on every Apigee PR (same failures on #16954 and #16955).

For comparison: on #16954 (DataCollector), the resource-specific test passed VCR replay cleanly — it wasn't even flagged as affected. The difference is that DataCollector has a simpler test setup, while Datastore's BigQuery test requires additional GCS bucket infrastructure that adds more variability to the recording.

Context from the sibling PRs:

• DataCollector (Add google_apigee_data_collector resource #16954): VCR passing, local acceptance test passing
• CustomReport (Add google_apigee_custom_report resource #16955): _update test passed VCR recording + replay
• All three PRs: unit tests and generation passing, skip_vcr and exclude_sweeper removed per your feedback

Happy to address any other concerns.

[github-actions]

@GoogleCloudPlatform/terraform-team @NickElliot This PR has been waiting for review for 1 week. Please take a look! Use the label disable-review-reminders to disable these notifications.

[NickElliot]

the TestAccApigeeDatastore_apigeeDatastoreBigqueryTestExample error is not related to org provisioning but enabling bigquery, can you add a resource for google_project_service to enable it?

[ogormans-deptstack]

Fixed — the time_sleep.wait_300_seconds now depends on google_project_service.bigquery (which is the last in the service enablement chain) instead of google_project_service.servicenetworking. This ensures BigQuery API is fully propagated before the test proceeds.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 3f5810f:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	4 files changed, 1436 insertions(+)
google-beta provider	View Diff	4 files changed, 1436 insertions(+)
terraform-google-conversion	View Diff	1 file changed, 211 insertions(+)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
78	39	38	1

Affected Service Packages

• apigee

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 1 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccApigeeDatastore_apigeeDatastoreBigqueryTestExample

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
✅ Log	✅	TestAccApigeeDatastore_apigeeDatastoreBigqueryTestExample

🟢 All tests passed!

View the recording VCR build log or the debug logs folder for detailed results.

@ogormans-deptstack, @NickElliot VCR tests complete for 3f5810f!

[github-actions]

@NickElliot This PR has been waiting for review for 3 weekdays. Please take a look! Use the label disable-review-reminders to disable these notifications.

[NickElliot]

LGTM!