From 3a4938874bbd50d81e89812bd23e364926b9e05e Mon Sep 17 00:00:00 2001 From: Ludovico Magnocavallo Date: Thu, 5 Nov 2020 21:28:34 +0100 Subject: [PATCH] rename iam variables in pubsub module --- .../asset-inventory-feed-remediation/main.tf | 2 +- modules/pubsub/README.md | 8 +-- modules/pubsub/main.tf | 4 +- modules/pubsub/variables.tf | 12 ++-- tests/modules/pubsub/__init__.py | 13 +++++ tests/modules/pubsub/fixture/main.tf | 34 ++++++++++++ tests/modules/pubsub/fixture/variables.tf | 20 +++++++ tests/modules/pubsub/test_plan.py | 55 +++++++++++++++++++ 8 files changed, 135 insertions(+), 13 deletions(-) create mode 100644 tests/modules/pubsub/__init__.py create mode 100644 tests/modules/pubsub/fixture/main.tf create mode 100644 tests/modules/pubsub/fixture/variables.tf create mode 100644 tests/modules/pubsub/test_plan.py diff --git a/cloud-operations/asset-inventory-feed-remediation/main.tf b/cloud-operations/asset-inventory-feed-remediation/main.tf index 74e2bc2b4..17f486978 100644 --- a/cloud-operations/asset-inventory-feed-remediation/main.tf +++ b/cloud-operations/asset-inventory-feed-remediation/main.tf @@ -63,7 +63,7 @@ module "pubsub" { project_id = module.project.project_id name = var.name subscriptions = { "${var.name}-default" = null } - iam_members = { + iam = { "roles/pubsub.publisher" = [ "serviceAccount:${module.project.service_accounts.robots.cloudasset}" ] diff --git a/modules/pubsub/README.md b/modules/pubsub/README.md index 974fe42c4..16b927626 100644 --- a/modules/pubsub/README.md +++ b/modules/pubsub/README.md @@ -12,7 +12,7 @@ module "pubsub" { source = "./modules/pubsub" project_id = "my-project" name = "my-topic" - iam_members = { + iam = { "roles/pubsub.viewer" = ["group:foo@example.com"] "roles/pubsub.subscriber" = ["user:user1@example.com"] } @@ -76,7 +76,7 @@ module "pubsub" { test-1 = null test-1 = null } - subscription_iam_members = { + subscription_iam = { test-1 = { "roles/pubsub.subscriber" = ["user:user1@ludomagno.net"] } @@ -93,12 +93,12 @@ module "pubsub" { | project_id | Project used for resources. | string | ✓ | | | *dead_letter_configs* | Per-subscription dead letter policy configuration. | map(object({...})) | | {} | | *defaults* | Subscription defaults for options. | object({...}) | | ... | -| *iam_members* | IAM members for each topic role. | map(set(string)) | | {} | +| *iam* | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | | *kms_key* | KMS customer managed encryption key. | string | | null | | *labels* | Labels. | map(string) | | {} | | *push_configs* | Push subscription configurations. | map(object({...})) | | {} | | *regions* | List of regions used to set persistence policy. | list(string) | | [] | -| *subscription_iam_members* | IAM members for each subscription and role. | map(map(set(string))) | | {} | +| *subscription_iam* | IAM bindings for subscriptions in {SUBSCRIPTION => {ROLE => [MEMBERS]}} format. | map(map(list(string))) | | {} | | *subscriptions* | Topic subscriptions. Also define push configs for push subscriptions. If options is set to null subscription defaults will be used. Labels default to topic labels if set to null. | map(object({...})) | | {} | ## Outputs diff --git a/modules/pubsub/main.tf b/modules/pubsub/main.tf index 31caa2585..dd652e356 100644 --- a/modules/pubsub/main.tf +++ b/modules/pubsub/main.tf @@ -16,7 +16,7 @@ locals { sub_iam_members = flatten([ - for sub, roles in var.subscription_iam_members : [ + for sub, roles in var.subscription_iam : [ for role, members in roles : { sub = sub role = role @@ -50,7 +50,7 @@ resource "google_pubsub_topic" "default" { } resource "google_pubsub_topic_iam_binding" "default" { - for_each = var.iam_members + for_each = var.iam project = var.project_id topic = google_pubsub_topic.default.name role = each.key diff --git a/modules/pubsub/variables.tf b/modules/pubsub/variables.tf index e6b15083f..dd68354be 100644 --- a/modules/pubsub/variables.tf +++ b/modules/pubsub/variables.tf @@ -39,9 +39,9 @@ variable "defaults" { } } -variable "iam_members" { - description = "IAM members for each topic role." - type = map(set(string)) +variable "iam" { + description = "IAM bindings for topic in {ROLE => [MEMBERS]} format." + type = map(list(string)) default = {} } @@ -101,8 +101,8 @@ variable "subscriptions" { default = {} } -variable "subscription_iam_members" { - description = "IAM members for each subscription and role." - type = map(map(set(string))) +variable "subscription_iam" { + description = "IAM bindings for subscriptions in {SUBSCRIPTION => {ROLE => [MEMBERS]}} format." + type = map(map(list(string))) default = {} } diff --git a/tests/modules/pubsub/__init__.py b/tests/modules/pubsub/__init__.py new file mode 100644 index 000000000..6913f02e3 --- /dev/null +++ b/tests/modules/pubsub/__init__.py @@ -0,0 +1,13 @@ +# Copyright 2020 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. diff --git a/tests/modules/pubsub/fixture/main.tf b/tests/modules/pubsub/fixture/main.tf new file mode 100644 index 000000000..aa4468a61 --- /dev/null +++ b/tests/modules/pubsub/fixture/main.tf @@ -0,0 +1,34 @@ +/** + * Copyright 2020 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +module "test" { + source = "../../../../modules/pubsub" + project_id = "my-project" + regions = ["europe-west1"] + name = "test" + iam = { + "roles/pubsub.publisher" = ["user:me@example.com"] + } + subscriptions = { + test = null + } + subscription_iam = { + test = { + "roles/pubsub.subscriber" = ["user:me@example.com"] + } + } + labels = var.labels +} diff --git a/tests/modules/pubsub/fixture/variables.tf b/tests/modules/pubsub/fixture/variables.tf new file mode 100644 index 000000000..4e0e03964 --- /dev/null +++ b/tests/modules/pubsub/fixture/variables.tf @@ -0,0 +1,20 @@ +/** + * Copyright 2020 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +variable "labels" { + type = map(string) + default = {} +} diff --git a/tests/modules/pubsub/test_plan.py b/tests/modules/pubsub/test_plan.py new file mode 100644 index 000000000..424f481ca --- /dev/null +++ b/tests/modules/pubsub/test_plan.py @@ -0,0 +1,55 @@ +# Copyright 2020 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + + +import os +import pytest + + +FIXTURES_DIR = os.path.join(os.path.dirname(__file__), 'fixture') + + +@pytest.fixture +def resources(plan_runner): + _, resources = plan_runner(FIXTURES_DIR) + return resources + + +def test_resource_count(resources): + "Test number of resources created." + assert len(resources) == 4 + + +def test_iam(resources): + "Test IAM binding resources." + bindings = [r['values'] for r in resources if r['type'] + == 'google_pubsub_topic_iam_binding'] + assert len(bindings) == 1 + assert bindings[0]['role'] == 'roles/pubsub.publisher' + + +def test_subscriptions(resources): + "Test subscription resources." + subs = [r['values'] for r in resources if r['type'] + == 'google_pubsub_subscription'] + assert len(subs) == 1 + assert set(s['name'] for s in subs) == set(['test']) + + +def test_subscription_iam(resources): + "Test subscription IAM binding resources." + bindings = [r['values'] for r in resources if r['type'] + == 'google_pubsub_subscription_iam_binding'] + assert len(bindings) == 1 + assert set(b['role'] for b in bindings) == set(['roles/pubsub.subscriber'])