Allow manage existing SSM instance (#2595)
* added option to manage an existing SSM instance * switched depends on to try for instance iam * added resource instance keys * add instance keys to tests * changed label default to null * updated readme * replaced try functions with conditional expressions for IAM
This commit is contained in:
Liam Nesteroff
@@ -41,9 +41,7 @@ module "ssm_instance" {
|
||||
location = var.region
|
||||
kms_key = "projects/another-project-id/locations/${var.region}/keyRings/my-key-ring/cryptoKeys/my-key"
|
||||
repositories = {
|
||||
my-repository = {
|
||||
location = var.region
|
||||
}
|
||||
my-repository = {}
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=2 inventory=public-instance-with-cmek.yaml
|
||||
@@ -59,9 +57,7 @@ module "ssm_instance" {
|
||||
location = var.region
|
||||
ca_pool = "projects/another-project/locations/${var.region}/caPools/my-ca-pool"
|
||||
repositories = {
|
||||
my-repository = {
|
||||
location = var.region
|
||||
}
|
||||
my-repository = {}
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=2 inventory=private-instance.yaml
|
||||
@@ -82,7 +78,6 @@ module "ssm_instance" {
|
||||
}
|
||||
repositories = {
|
||||
my-repository = {
|
||||
location = var.region
|
||||
iam = {
|
||||
"roles/securesourcemanager.repoAdmin" = [
|
||||
"group:my-repo-admins@myorg.com"
|
||||
@@ -109,7 +104,6 @@ module "ssm_instance" {
|
||||
}
|
||||
repositories = {
|
||||
my-repository = {
|
||||
location = var.region
|
||||
iam_bindings_additive = {
|
||||
my-repository-admin = {
|
||||
role = "roles/securesourcemanager.repoAdmin"
|
||||
@@ -138,7 +132,6 @@ module "ssm_instance" {
|
||||
}
|
||||
repositories = {
|
||||
my-repository = {
|
||||
location = var.region
|
||||
iam_bindings = {
|
||||
my-repository-admin = {
|
||||
role = "roles/securesourcemanager.repoAdmin"
|
||||
@@ -157,16 +150,17 @@ module "ssm_instance" {
|
||||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [instance_id](variables.tf#L23) | Instance ID. | <code>string</code> | ✓ | |
|
||||
| [location](variables.tf#L40) | Location. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L45) | Project ID. | <code>string</code> | ✓ | |
|
||||
| [repositories](variables.tf#L50) | Repositories. | <code title="map(object({ description = optional(string) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ role = string members = list(string) })), {}) iam_bindings_additive = optional(map(object({ role = string member = string })), {}) initial_config = optional(object({ default_branch = optional(string) gitignores = optional(string) license = optional(string) readme = optional(string) })) location = string }))">map(object({…}))</code> | ✓ | |
|
||||
| [instance_id](variables.tf#L29) | Instance ID. | <code>string</code> | ✓ | |
|
||||
| [location](variables.tf#L46) | Location. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L51) | Project ID. | <code>string</code> | ✓ | |
|
||||
| [repositories](variables.tf#L56) | Repositories. | <code title="map(object({ description = optional(string) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ role = string members = list(string) })), {}) iam_bindings_additive = optional(map(object({ role = string member = string })), {}) initial_config = optional(object({ default_branch = optional(string) gitignores = optional(string) license = optional(string) readme = optional(string) })) }))">map(object({…}))</code> | ✓ | |
|
||||
| [ca_pool](variables.tf#L17) | CA pool. | <code>string</code> | | <code>null</code> |
|
||||
| [iam](variables-iam.tf#L17) | IAM bindings. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [iam_bindings](variables-iam.tf#L23) | IAM bindings. | <code title="map(object({ role = string members = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_bindings_additive](variables-iam.tf#L32) | IAM bindings. | <code title="map(object({ role = string member = string }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [kms_key](variables.tf#L28) | KMS key. | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L34) | Instance labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [instance_create](variables.tf#L23) | Create SSM Instance. When set to false, uses instance_id to reference existing SSM instance. | <code>bool</code> | | <code>true</code> |
|
||||
| [kms_key](variables.tf#L34) | KMS key. | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L40) | Instance labels. | <code>map(string)</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -29,31 +29,37 @@ locals {
|
||||
"${k1}.${k2}" => merge(v2, {
|
||||
repository = k1
|
||||
}) }]...)
|
||||
|
||||
iam_instance_values = {
|
||||
project = var.instance_create ? google_secure_source_manager_instance.instance[0].project : var.project_id
|
||||
location = var.instance_create ? google_secure_source_manager_instance.instance[0].location : var.location
|
||||
instance_id = var.instance_create ? google_secure_source_manager_instance.instance[0].instance_id : var.instance_id
|
||||
}
|
||||
}
|
||||
|
||||
resource "google_secure_source_manager_instance_iam_binding" "authoritative" {
|
||||
for_each = var.iam
|
||||
project = google_secure_source_manager_instance.instance.project
|
||||
location = google_secure_source_manager_instance.instance.location
|
||||
instance_id = google_secure_source_manager_instance.instance.instance_id
|
||||
project = local.iam_instance_values["project"]
|
||||
location = local.iam_instance_values["location"]
|
||||
instance_id = local.iam_instance_values["instance_id"]
|
||||
role = each.key
|
||||
members = each.value
|
||||
}
|
||||
|
||||
resource "google_secure_source_manager_instance_iam_binding" "bindings" {
|
||||
for_each = var.iam_bindings
|
||||
project = google_secure_source_manager_instance.instance.project
|
||||
location = google_secure_source_manager_instance.instance.location
|
||||
instance_id = google_secure_source_manager_instance.instance.instance_id
|
||||
project = local.iam_instance_values["project"]
|
||||
location = local.iam_instance_values["location"]
|
||||
instance_id = local.iam_instance_values["instance_id"]
|
||||
role = each.value.role
|
||||
members = each.value.members
|
||||
}
|
||||
|
||||
resource "google_secure_source_manager_instance_iam_member" "bindings" {
|
||||
for_each = var.iam_bindings_additive
|
||||
project = google_secure_source_manager_instance.instance.project
|
||||
location = google_secure_source_manager_instance.instance.location
|
||||
instance_id = google_secure_source_manager_instance.instance.instance_id
|
||||
project = local.iam_instance_values["project"]
|
||||
location = local.iam_instance_values["location"]
|
||||
instance_id = local.iam_instance_values["instance_id"]
|
||||
role = each.value.role
|
||||
member = each.value.member
|
||||
}
|
||||
|
||||
@@ -15,6 +15,7 @@
|
||||
*/
|
||||
|
||||
resource "google_secure_source_manager_instance" "instance" {
|
||||
count = var.instance_create ? 1 : 0
|
||||
instance_id = var.instance_id
|
||||
project = var.project_id
|
||||
location = var.location
|
||||
@@ -32,9 +33,10 @@ resource "google_secure_source_manager_instance" "instance" {
|
||||
resource "google_secure_source_manager_repository" "repositories" {
|
||||
for_each = var.repositories
|
||||
repository_id = each.key
|
||||
instance = google_secure_source_manager_instance.instance.name
|
||||
instance = try(google_secure_source_manager_instance.instance[0].name, "projects/${var.project_id}/locations/${var.location}/instances/${var.instance_id}")
|
||||
project = var.project_id
|
||||
location = each.value.location
|
||||
location = var.location
|
||||
description = each.value.description
|
||||
dynamic "initial_config" {
|
||||
for_each = each.value.initial_config == null ? [] : [""]
|
||||
content {
|
||||
|
||||
@@ -16,12 +16,12 @@
|
||||
|
||||
output "instance" {
|
||||
description = "Instance."
|
||||
value = google_secure_source_manager_instance.instance
|
||||
value = try(google_secure_source_manager_instance.instance[0], null)
|
||||
}
|
||||
|
||||
output "instance_id" {
|
||||
description = "Instance id."
|
||||
value = google_secure_source_manager_instance.instance.id
|
||||
value = try(google_secure_source_manager_instance.instance[0].id, null)
|
||||
}
|
||||
|
||||
output "repositories" {
|
||||
|
||||
@@ -20,6 +20,12 @@ variable "ca_pool" {
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "instance_create" {
|
||||
description = "Create SSM Instance. When set to false, uses instance_id to reference existing SSM instance."
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
|
||||
variable "instance_id" {
|
||||
description = "Instance ID."
|
||||
type = string
|
||||
@@ -34,7 +40,7 @@ variable "kms_key" {
|
||||
variable "labels" {
|
||||
description = "Instance labels."
|
||||
type = map(string)
|
||||
default = {}
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "location" {
|
||||
@@ -66,6 +72,5 @@ variable "repositories" {
|
||||
license = optional(string)
|
||||
readme = optional(string)
|
||||
}))
|
||||
location = string
|
||||
}))
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user