Add AssuredWorkload support to the folder module (#2390)

* Feat: Add AssuredWorkload support to the folder module

* Formatting

* Use square brackets to access list items

* Docs gen after adding an example to the readme

* Reorder variables

* Formatting

* Reordering outputs, formatting

* Remove try where not needed. Add IAM into the AW example and tests

* Fix tests

* Enable Assured Workloads in E2E tests

* Add compliance_regime and partner enum fields validation

* Rewording validation message for compliance_regime, partner fields

* Sort the list of allowed values alphabetically

* Make the organization dependant on testing environment

* fix tests

* Disable E2E for Assured Workflow example.

This example requires Access Transparency enabled on org level, even
chosing different regime, we need to have `parent` and `organization`
within the same hierarchy, which is not currently the case and requires
more rework of the test framework.

---------

Co-authored-by: Wiktor Niesiobędzki <wiktorn@google.com>

modules/folder/main.tf

@@ -16,14 +16,28 @@
 
 locals {
   folder_id = (
-    var.folder_create
-    ? try(google_folder.folder[0].id, null)
-    : var.id
+    var.assured_workload_config == null
+    ? (
+      var.folder_create
+      ? try(google_folder.folder[0].id, null)
+      : var.id
+    )
+    : format("folders/%s", try(google_assured_workloads_workload.folder[0].resources[0].resource_id, ""))
+  )
+  aw_parent = (
+    # Assured Workload only accepls folder as a parent and uses organization as a parent when no value provided.
+    var.parent == null
+    ? null
+    : (
+      try(startswith(var.parent, "folders/"))
+      ? var.parent
+      : null
+    )
   )
 }
 
 resource "google_folder" "folder" {
-  count        = var.folder_create ? 1 : 0
+  count        = var.folder_create && var.assured_workload_config == null ? 1 : 0
   display_name = var.name
   parent       = var.parent
 }
@@ -48,3 +62,30 @@ resource "google_compute_firewall_policy_association" "default" {
   name              = var.firewall_policy.name
   firewall_policy   = var.firewall_policy.policy
 }
+
+resource "google_assured_workloads_workload" "folder" {
+  count                     = (var.assured_workload_config != null && var.folder_create) ? 1 : 0
+  compliance_regime         = var.assured_workload_config.compliance_regime
+  display_name              = var.assured_workload_config.display_name
+  location                  = var.assured_workload_config.location
+  organization              = var.assured_workload_config.organization
+  enable_sovereign_controls = var.assured_workload_config.enable_sovereign_controls
+  labels                    = var.assured_workload_config.labels
+  partner                   = var.assured_workload_config.partner
+  dynamic "partner_permissions" {
+    for_each = try(var.assured_workload_config.partner_permissions, null) == null ? [] : [""]
+    content {
+      assured_workloads_monitoring = var.assured_workload_config.partner_permissions.assured_workloads_monitoring
+      data_logs_viewer             = var.assured_workload_config.partner_permissions.data_logs_viewer
+      service_access_approver      = var.assured_workload_config.partner_permissions.service_access_approver
+    }
+  }
+
+  provisioned_resources_parent = local.aw_parent
+
+  resource_settings {
+    display_name  = var.name
+    resource_type = "CONSUMER_FOLDER"
+  }
+  violation_notifications_enabled = var.assured_workload_config.violation_notifications_enabled
+}