# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# TODO: data access logs

# yaml-language-server: $schema=../../../schemas/organization.schema.json

id: $defaults:organization/id
contacts:
  $email_addresses:gcp-organization-admins:
    - ALL
# conditional authoritative IAM bindings
iam_bindings:
  # these don't conflict with IAM / IAM by principal
  pf_org_policy_admin:
    role: roles/orgpolicy.policyAdmin
    members:
      - $iam_principals:service_accounts/iac-0/iac-pf-rw
    condition:
      expression: resource.matchTag('${organization.id}/context', 'project-factory')
      title: Project factory org policy admin
  pf_org_policy_viewer:
    role: roles/orgpolicy.policyViewer
    members:
      - $iam_principals:service_accounts/iac-0/iac-pf-ro
    condition:
      expression: resource.matchTag('${organization.id}/context', 'project-factory')
      title: Project factory org policy viewer
# authoritative IAM bindings by principal
iam_by_principals:
  $iam_principals:gcp-organization-admins:
    - roles/cloudasset.owner
    - roles/cloudsupport.admin
    - roles/cloudsupport.techSupportEditor
    - roles/compute.osAdminLogin
    - roles/compute.osLoginExternalUser
    - roles/compute.xpnAdmin
    - roles/orgpolicy.policyAdmin
    - roles/owner
    - roles/resourcemanager.folderAdmin
    - roles/resourcemanager.organizationAdmin
    - roles/resourcemanager.projectCreator
    - roles/resourcemanager.tagAdmin
    - roles/iam.workforcePoolAdmin
  $iam_principals:service_accounts/iac-0/iac-org-rw:
    - roles/accesscontextmanager.policyAdmin
    - roles/cloudasset.viewer
    - roles/essentialcontacts.admin
    - roles/iam.organizationRoleAdmin
    - roles/iam.workforcePoolAdmin
    - roles/logging.admin
    - roles/orgpolicy.policyAdmin
    - roles/resourcemanager.folderAdmin
    - roles/resourcemanager.organizationAdmin
    - roles/resourcemanager.projectCreator
    - roles/resourcemanager.projectMover
    - roles/resourcemanager.tagAdmin
    - roles/resourcemanager.tagUser
  $iam_principals:service_accounts/iac-0/iac-org-ro:
    - roles/cloudasset.viewer
    - roles/essentialcontacts.viewer
    - roles/iam.organizationRoleViewer
    - roles/iam.workforcePoolViewer
    - roles/logging.viewer
    - roles/orgpolicy.policyViewer
    - roles/resourcemanager.folderViewer
    - roles/resourcemanager.tagViewer
    - roles/serviceusage.serviceUsageViewer
    - $custom_roles:organization_admin_viewer
    - $custom_roles:tag_viewer
  $iam_principals:service_accounts/iac-0/iac-networking-rw:
    # uncomment for cooperative VPC-SC configurations
    # - roles/accesscontextmanager.policyEditor
    - roles/compute.orgFirewallPolicyAdmin
    - roles/compute.xpnAdmin
  $iam_principals:service_accounts/iac-0/iac-networking-ro:
    # uncomment for cooperative VPC-SC configurations
    # - roles/accesscontextmanager.policyReader
    - roles/compute.orgFirewallPolicyUser
    - roles/compute.viewer
  # uncomment for cooperative VPC-SC configurations
  # $iam_principals:service_accounts/iac-0/iac-pf-rw:
  #   - roles/accesscontextmanager.policyEditor
  # uncomment if you want to use Assured Workloads
  # $iam_principals:service_accounts/iac-0/iac-pf-rw:
  #   - roles/assuredworkloads.editor
  $iam_principals:service_accounts/iac-0/iac-security-rw:
    # uncomment for cooperative VPC-SC configurations
    # - roles/accesscontextmanager.policyEditor
    - roles/cloudasset.viewer
  $iam_principals:service_accounts/iac-0/iac-security-ro:
    # uncomment for cooperative VPC-SC configurations
    # - roles/accesscontextmanager.policyReader
    - roles/cloudasset.viewer
  $iam_principals:service_accounts/iac-0/iac-vpcsc-rw:
    - roles/accesscontextmanager.policyAdmin
    - roles/cloudasset.viewer
  $iam_principals:service_accounts/iac-0/iac-vpcsc-ro:
    - roles/accesscontextmanager.policyReader
    - roles/cloudasset.viewer
  # Uncomment if you want to use PAM.
  # $service_agents:pam:
  #   - roles/privilegedaccessmanager.serviceAgent
data_access_logs:
  sts.googleapis.com:
    ADMIN_READ: {}
logging:
  # disable_default_log_sink: false
  storage_location: $locations:primary
  sinks:
    audit-logs:
      # description: foo
      # exclusions: {}
      destination: $log_buckets:log-0/audit-logs
      filter: |
        log_id("cloudaudit.googleapis.com/activity") OR
        log_id("cloudaudit.googleapis.com/system_event") OR
        log_id("cloudaudit.googleapis.com/policy") OR
        log_id("cloudaudit.googleapis.com/access_transparency")
    iam:
      destination: $log_buckets:log-0/iam
      filter: |
        protoPayload.serviceName="iamcredentials.googleapis.com" OR
        protoPayload.serviceName="iam.googleapis.com" OR
        protoPayload.serviceName="sts.googleapis.com"
    vpc-sc:
      destination: $log_buckets:log-0/vpc-sc
      filter: |
        protoPayload.metadata.@type="type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata"
# authoritative IAM bindings by role
# these are internally merged with IAM by principal
iam:
  # reset default role on new organizations
  roles/billing.creator: []
