Merge remote-tracking branch 'origin/master' into fast-dev
This commit is contained in:
Ludo
@@ -7,6 +7,7 @@
|
||||
- [Lifecycle rule](#lifecycle-rule)
|
||||
- [GCS notifications](#gcs-notifications)
|
||||
- [Object upload](#object-upload)
|
||||
- [IP Filter](#ip-filter)
|
||||
- [IAM](#iam)
|
||||
- [Tag Bindings](#tag-bindings)
|
||||
- [Managed Folders](#managed-folders)
|
||||
@@ -179,6 +180,32 @@ module "bucket" {
|
||||
# tftest modules=1 resources=2 inventory=object-upload.yaml e2e
|
||||
```
|
||||
|
||||
## IP Filter
|
||||
|
||||
```hcl
|
||||
module "bucket" {
|
||||
source = "./fabric/modules/gcs"
|
||||
project_id = var.project_id
|
||||
prefix = var.prefix
|
||||
name = "my-bucket"
|
||||
location = "EU"
|
||||
ip_filter = {
|
||||
allow_all_service_agent_access = false
|
||||
allow_cross_org_vpcs = false
|
||||
public_network_sources = [
|
||||
"8.8.8.8/32",
|
||||
"8.8.4.4/32"
|
||||
]
|
||||
vpc_network_sources = {
|
||||
"projects/my-project-id/global/networks/my-vpc" = [
|
||||
"10.0.0.0/8"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=1 inventory=ip-filter.yaml
|
||||
```
|
||||
|
||||
## IAM
|
||||
|
||||
IAM is managed via several variables that implement different features and levels of control:
|
||||
@@ -336,8 +363,8 @@ module "bucket" {
|
||||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [name](variables.tf#L221) | Bucket name suffix. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L279) | Bucket project id. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L232) | Bucket name suffix. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L290) | Bucket project id. | <code>string</code> | ✓ | |
|
||||
| [autoclass](variables.tf#L17) | Enable autoclass to automatically transition objects to appropriate storage classes based on their access pattern. If set to true, storage_class must be set to STANDARD. Defaults to false. | <code>bool</code> | | <code>null</code> |
|
||||
| [bucket_create](variables.tf#L23) | Create bucket. | <code>bool</code> | | <code>true</code> |
|
||||
| [cors](variables.tf#L29) | CORS configuration for the bucket. Defaults to null. | <code title="object({ origin = optional(list(string)) method = optional(list(string)) response_header = optional(list(string)) max_age_seconds = optional(number) })">object({…})</code> | | <code>null</code> |
|
||||
@@ -351,24 +378,25 @@ module "bucket" {
|
||||
| [iam_bindings](variables.tf#L82) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code title="map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_bindings_additive](variables.tf#L97) | Individual additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_by_principals](variables.tf#L112) | Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid cycle errors. Merged internally with the `iam` variable. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [labels](variables.tf#L119) | Labels to be attached to all buckets. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [lifecycle_rules](variables.tf#L125) | Bucket lifecycle rule. | <code title="map(object({ action = object({ type = string storage_class = optional(string) }) condition = object({ age = optional(number) created_before = optional(string) custom_time_before = optional(string) days_since_custom_time = optional(number) days_since_noncurrent_time = optional(number) matches_prefix = optional(list(string)) matches_storage_class = optional(list(string)) # STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE, DURABLE_REDUCED_AVAILABILITY matches_suffix = optional(list(string)) noncurrent_time_before = optional(string) num_newer_versions = optional(number) with_state = optional(string) # "LIVE", "ARCHIVED", "ANY" }) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [location](variables.tf#L174) | Bucket location. | <code>string</code> | | <code>null</code> |
|
||||
| [logging_config](variables.tf#L184) | Bucket logging configuration. | <code title="object({ log_bucket = string log_object_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [managed_folders](variables.tf#L193) | Managed folders to create within the bucket in {PATH => CONFIG} format. | <code title="map(object({ force_destroy = optional(bool, false) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [notification_config](variables.tf#L226) | GCS Notification configuration. | <code title="object({ enabled = bool payload_format = string sa_email = string topic_name = string create_topic = optional(object({ kms_key_id = optional(string) }), {}) event_types = optional(list(string)) custom_attributes = optional(map(string)) object_name_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [objects_to_upload](variables.tf#L243) | Objects to be uploaded to bucket. | <code title="map(object({ name = string metadata = optional(map(string)) content = optional(string) source = optional(string) cache_control = optional(string) content_disposition = optional(string) content_encoding = optional(string) content_language = optional(string) content_type = optional(string) event_based_hold = optional(bool) temporary_hold = optional(bool) detect_md5hash = optional(string) storage_class = optional(string) kms_key_name = optional(string) customer_encryption = optional(object({ encryption_algorithm = optional(string) encryption_key = string })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L269) | Optional prefix used to generate the bucket name. | <code>string</code> | | <code>null</code> |
|
||||
| [public_access_prevention](variables.tf#L284) | Prevents public access to the bucket. | <code>string</code> | | <code>null</code> |
|
||||
| [requester_pays](variables.tf#L294) | Enables Requester Pays on a storage bucket. | <code>bool</code> | | <code>null</code> |
|
||||
| [retention_policy](variables.tf#L300) | Bucket retention policy. | <code title="object({ retention_period = number is_locked = optional(bool) })">object({…})</code> | | <code>null</code> |
|
||||
| [rpo](variables.tf#L309) | Bucket recovery point objective. | <code>string</code> | | <code>null</code> |
|
||||
| [soft_delete_retention](variables.tf#L319) | The duration in seconds that soft-deleted objects in the bucket will be retained and cannot be permanently deleted. Set to 0 to override the default and disable. | <code>number</code> | | <code>null</code> |
|
||||
| [storage_class](variables.tf#L325) | Bucket storage class. | <code>string</code> | | <code>"STANDARD"</code> |
|
||||
| [tag_bindings](variables.tf#L335) | Tag bindings for this folder, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [uniform_bucket_level_access](variables.tf#L342) | Allow using object ACLs (false) or not (true, this is the recommended behavior) , defaults to true (which is the recommended practice, but not the behavior of storage API). | <code>bool</code> | | <code>true</code> |
|
||||
| [versioning](variables.tf#L348) | Enable versioning, defaults to false. | <code>bool</code> | | <code>null</code> |
|
||||
| [website](variables.tf#L354) | Bucket website. | <code title="object({ main_page_suffix = optional(string) not_found_page = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [ip_filter](variables.tf#L119) | The bucket's IP filter configuration. | <code title="object({ allow_cross_org_vpcs = optional(bool) allow_all_service_agent_access = optional(bool) public_network_sources = optional(list(string)) vpc_network_sources = optional(map(list(string)), {}) })">object({…})</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L130) | Labels to be attached to all buckets. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [lifecycle_rules](variables.tf#L136) | Bucket lifecycle rule. | <code title="map(object({ action = object({ type = string storage_class = optional(string) }) condition = object({ age = optional(number) created_before = optional(string) custom_time_before = optional(string) days_since_custom_time = optional(number) days_since_noncurrent_time = optional(number) matches_prefix = optional(list(string)) matches_storage_class = optional(list(string)) # STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE, DURABLE_REDUCED_AVAILABILITY matches_suffix = optional(list(string)) noncurrent_time_before = optional(string) num_newer_versions = optional(number) with_state = optional(string) # "LIVE", "ARCHIVED", "ANY" }) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [location](variables.tf#L185) | Bucket location. | <code>string</code> | | <code>null</code> |
|
||||
| [logging_config](variables.tf#L195) | Bucket logging configuration. | <code title="object({ log_bucket = string log_object_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [managed_folders](variables.tf#L204) | Managed folders to create within the bucket in {PATH => CONFIG} format. | <code title="map(object({ force_destroy = optional(bool, false) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [notification_config](variables.tf#L237) | GCS Notification configuration. | <code title="object({ enabled = bool payload_format = string sa_email = string topic_name = string create_topic = optional(object({ kms_key_id = optional(string) }), {}) event_types = optional(list(string)) custom_attributes = optional(map(string)) object_name_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [objects_to_upload](variables.tf#L254) | Objects to be uploaded to bucket. | <code title="map(object({ name = string metadata = optional(map(string)) content = optional(string) source = optional(string) cache_control = optional(string) content_disposition = optional(string) content_encoding = optional(string) content_language = optional(string) content_type = optional(string) event_based_hold = optional(bool) temporary_hold = optional(bool) detect_md5hash = optional(string) storage_class = optional(string) kms_key_name = optional(string) customer_encryption = optional(object({ encryption_algorithm = optional(string) encryption_key = string })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L280) | Optional prefix used to generate the bucket name. | <code>string</code> | | <code>null</code> |
|
||||
| [public_access_prevention](variables.tf#L295) | Prevents public access to the bucket. | <code>string</code> | | <code>null</code> |
|
||||
| [requester_pays](variables.tf#L305) | Enables Requester Pays on a storage bucket. | <code>bool</code> | | <code>null</code> |
|
||||
| [retention_policy](variables.tf#L311) | Bucket retention policy. | <code title="object({ retention_period = number is_locked = optional(bool) })">object({…})</code> | | <code>null</code> |
|
||||
| [rpo](variables.tf#L320) | Bucket recovery point objective. | <code>string</code> | | <code>null</code> |
|
||||
| [soft_delete_retention](variables.tf#L330) | The duration in seconds that soft-deleted objects in the bucket will be retained and cannot be permanently deleted. Set to 0 to override the default and disable. | <code>number</code> | | <code>null</code> |
|
||||
| [storage_class](variables.tf#L336) | Bucket storage class. | <code>string</code> | | <code>"STANDARD"</code> |
|
||||
| [tag_bindings](variables.tf#L346) | Tag bindings for this folder, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [uniform_bucket_level_access](variables.tf#L353) | Allow using object ACLs (false) or not (true, this is the recommended behavior) , defaults to true (which is the recommended practice, but not the behavior of storage API). | <code>bool</code> | | <code>true</code> |
|
||||
| [versioning](variables.tf#L359) | Enable versioning, defaults to false. | <code>bool</code> | | <code>null</code> |
|
||||
| [website](variables.tf#L365) | Bucket website. | <code title="object({ main_page_suffix = optional(string) not_found_page = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
Reference in New Issue
Block a user