add iam support to compute-vm module (#95)

modules/compute-vm/README.md

@@ -155,6 +155,8 @@ module "instance-group" {
 | *encryption* | Encryption options. Only one of kms_key_self_link and disk_encryption_key_raw may be set. If needed, you can specify to encrypt or not the boot disk. | <code title="object&#40;&#123;&#10;encrypt_boot            &#61; bool&#10;disk_encryption_key_raw &#61; string&#10;kms_key_self_link       &#61; string&#10;&#125;&#41;">object({...})</code> |  | <code title="">null</code> |
 | *group* | Define this variable to create an instance group for instances. Disabled for template use. | <code title="object&#40;&#123;&#10;named_ports &#61; map&#40;number&#41;&#10;&#125;&#41;">object({...})</code> |  | <code title="">null</code> |
 | *hostname* | Instance FQDN name. | <code title="">string</code> |  | <code title="">null</code> |
+| *iam_members* | Map of member lists used to set authoritative bindings, keyed by role. Ignored for template use. | <code title="map&#40;list&#40;string&#41;&#41;">map(list(string))</code> |  | <code title="">{}</code> |
+| *iam_roles* | List of roles used to set authoritative bindings. Ignored for template use. | <code title="list&#40;string&#41;">list(string)</code> |  | <code title="">[]</code> |
 | *instance_count* | Number of instances to create (only for non-template usage). | <code title="">number</code> |  | <code title="">1</code> |
 | *instance_type* | Instance type. | <code title="">string</code> |  | <code title="">f1-micro</code> |
 | *labels* | Instance labels. | <code title="map&#40;string&#41;">map(string)</code> |  | <code title="">{}</code> |

modules/compute-vm/main.tf

@@ -25,6 +25,10 @@ locals {
     for pair in setproduct(keys(local.names), keys(local.attached_disks)) :
     "${pair[0]}-${pair[1]}" => { name = pair[0], disk_name = pair[1] }
   }
+  iam_roles = var.use_instance_template ? {} : {
+    for pair in setproduct(var.iam_roles, keys(local.names)) :
+    "${pair.0}/${pair.1}" => { role = pair.0, name = pair.1 }
+  }
   names = (
     var.use_instance_template
     ? { "${var.name}" = 0 }
@@ -164,6 +168,15 @@ resource "google_compute_instance" "default" {
 
 }
 
+resource "google_compute_instance_iam_binding" "default" {
+  for_each      = local.iam_roles
+  project       = var.project_id
+  zone          = var.zone
+  instance_name = each.value.name
+  role          = each.value.role
+  members       = lookup(var.iam_members, each.value.role, [])
+}
+
 resource "google_compute_instance_template" "default" {
   count            = var.use_instance_template ? 1 : 0
   project          = var.project_id

modules/compute-vm/variables.tf

@@ -84,6 +84,18 @@ variable "hostname" {
   default     = null
 }
 
+variable "iam_members" {
+  description = "Map of member lists used to set authoritative bindings, keyed by role. Ignored for template use."
+  type        = map(list(string))
+  default     = {}
+}
+
+variable "iam_roles" {
+  description = "List of roles used to set authoritative bindings. Ignored for template use."
+  type        = list(string)
+  default     = []
+}
+
 variable "instance_count" {
   description = "Number of instances to create (only for non-template usage)."
   type        = number

tests/modules/compute_vm/fixture/main.tf

@@ -30,4 +30,6 @@ module "test" {
   instance_count         = var.instance_count
   use_instance_template  = var.use_instance_template
   group                  = var.group
+  iam_roles              = var.iam_roles
+  iam_members            = var.iam_members
 }

tests/modules/compute_vm/fixture/variables.tf

@@ -19,6 +19,16 @@ variable "group" {
   default = null
 }
 
+variable "iam_members" {
+  type    = map(list(string))
+  default = {}
+}
+
+variable "iam_roles" {
+  type    = list(string)
+  default = []
+}
+
 variable "instance_count" {
   type    = number
   default = 1

tests/modules/compute_vm/test_plan.py

@@ -21,35 +21,58 @@ FIXTURES_DIR = os.path.join(os.path.dirname(__file__), 'fixture')
 
 
 def test_single_instance(plan_runner):
-  plan, resources = plan_runner(FIXTURES_DIR)
+  _, resources = plan_runner(FIXTURES_DIR)
   assert len(resources) == 1
   assert resources[0]['type'] == 'google_compute_instance'
 
 
 def test_multiple_instances(plan_runner):
-  plan, resources = plan_runner(FIXTURES_DIR, instance_count=2)
+  _, resources = plan_runner(FIXTURES_DIR, instance_count=2)
   assert len(resources) == 2
   assert set(r['type'] for r in resources) == set(['google_compute_instance'])
 
 
 def test_service_account(plan_runner):
-  plan, resources = plan_runner(FIXTURES_DIR, instance_count=2,
-                                service_account_create='true')
+  _, resources = plan_runner(FIXTURES_DIR, instance_count=2,
+                             service_account_create='true')
   assert len(resources) == 3
   assert 'google_service_account' in [r['type'] for r in resources]
 
 
 def test_template(plan_runner):
-  plan, resources = plan_runner(FIXTURES_DIR, use_instance_template='true')
+  _, resources = plan_runner(FIXTURES_DIR, use_instance_template='true')
   assert len(resources) == 1
   assert resources[0]['type'] == 'google_compute_instance_template'
   assert resources[0]['values']['name_prefix'] == 'test-'
 
 
 def test_group(plan_runner):
-  plan, resources = plan_runner(FIXTURES_DIR, instance_count=2,
-                                group='{named_ports={}}')
+  _, resources = plan_runner(FIXTURES_DIR, instance_count=2,
+                             group='{named_ports={}}')
   assert len(resources) == 3
   assert set(r['type'] for r in resources) == set([
       'google_compute_instance_group', 'google_compute_instance'
   ])
+
+
+def test_iam(plan_runner):
+  iam_roles = '["roles/compute.instanceAdmin", "roles/iam.serviceAccountUser"]'
+  iam_members = (
+      '{"roles/compute.instanceAdmin" = ["user:a@a.com", "user:b@a.com"],'
+      '"roles/iam.serviceAccountUser" = ["user:a@a.com"]}'
+  )
+  _, resources = plan_runner(
+      FIXTURES_DIR, instance_count=2, iam_roles=iam_roles, iam_members=iam_members)
+  assert len(resources) == 6
+  assert set(r['type'] for r in resources) == set([
+      'google_compute_instance', 'google_compute_instance_iam_binding'])
+  iam_bindings = dict(
+      (r['index'], r['values']['members']) for r in resources if r['type']
+      == 'google_compute_instance_iam_binding'
+  )
+  assert iam_bindings == {
+      'roles/compute.instanceAdmin/test-1': ['user:a@a.com', 'user:b@a.com'],
+      'roles/compute.instanceAdmin/test-2': ['user:a@a.com', 'user:b@a.com'],
+      'roles/iam.serviceAccountUser/test-1': ['user:a@a.com'],
+      'roles/iam.serviceAccountUser/test-2': ['user:a@a.com'],
+  }