From 3bda69fd26748971731371aa1ede593012f59c43 Mon Sep 17 00:00:00 2001 From: Julio Castillo Date: Mon, 12 May 2025 13:16:45 +0200 Subject: [PATCH] Map secops group to security by default (#3080) * Map secops group to security by default * Update readmes * Fix bootstrap inventories --- fast/stages/0-bootstrap/README.md | 2 +- fast/stages/0-bootstrap/variables.tf | 2 +- fast/stages/1-resman/README.md | 2 +- fast/stages/1-resman/variables-fast.tf | 4 ++-- tests/fast/stages/s0_bootstrap/simple.yaml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/fast/stages/0-bootstrap/README.md b/fast/stages/0-bootstrap/README.md index cf8bb882f..ea11baedc 100644 --- a/fast/stages/0-bootstrap/README.md +++ b/fast/stages/0-bootstrap/README.md @@ -693,7 +693,7 @@ FAST defines a simple mechanism to extend stage functionality via the use of [ad | [essential_contacts](variables.tf#L132) | Email used for essential contacts, unset if null. | string | | null | | | [factories_config](variables.tf#L138) | Configuration for the resource factories or external data. | object({…}) | | {} | | | [fast_addon](variables-addons.tf#L17) | FAST addons configurations for stages 1. Keys are used as short names for the add-on resources. | map(object({…})) | | {} | | -| [groups](variables.tf#L150) | Group names or IAM-format principals to grant organization-level permissions. If just the name is provided, the 'group:' principal and organization domain are interpolated. | object({…}) | | {} | | +| [groups](variables.tf#L150) | Group names or IAM-format principals to grant organization-level permissions. If just the name is provided, the 'group:' principal and organization domain are interpolated. | object({…}) | | {} | | | [iam](variables.tf#L167) | Organization-level custom IAM settings in role => [principal] format. | map(list(string)) | | {} | | | [iam_bindings_additive](variables.tf#L174) | Organization-level custom additive IAM bindings. Keys are arbitrary. | map(object({…})) | | {} | | | [iam_by_principals](variables.tf#L189) | Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid cycle errors. Merged internally with the `iam` variable. | map(list(string)) | | {} | | diff --git a/fast/stages/0-bootstrap/variables.tf b/fast/stages/0-bootstrap/variables.tf index 7db59afb2..8ba6c0d54 100644 --- a/fast/stages/0-bootstrap/variables.tf +++ b/fast/stages/0-bootstrap/variables.tf @@ -155,7 +155,7 @@ variable "groups" { gcp-devops = optional(string, "gcp-devops") gcp-network-admins = optional(string, "gcp-vpc-network-admins") gcp-organization-admins = optional(string, "gcp-organization-admins") - gcp-secops-admins = optional(string, "gcp-secops-admins") + gcp-secops-admins = optional(string, "gcp-security-admins") gcp-security-admins = optional(string, "gcp-security-admins") # aliased to gcp-devops as the checklist does not create it gcp-support = optional(string, "gcp-devops") diff --git a/fast/stages/1-resman/README.md b/fast/stages/1-resman/README.md index e4cebca19..d7eeff497 100644 --- a/fast/stages/1-resman/README.md +++ b/fast/stages/1-resman/README.md @@ -275,7 +275,7 @@ terraform apply | [fast_addon](variables-addons.tf#L17) | FAST addons configurations for stages 2. Keys are used as short names for the add-on resources. | map(object({…})) | | {} | | | [fast_stage_2](variables-stages.tf#L17) | FAST stages 2 configurations. | map(object({…})) | | {} | | | [fast_stage_3](variables-stages.tf#L114) | FAST stages 3 configurations. | map(object({…})) | | {} | | -| [groups](variables-fast.tf#L90) | Group names or IAM-format principals to grant organization-level permissions. If just the name is provided, the 'group:' principal and organization domain are interpolated. | object({…}) | | {} | 0-bootstrap | +| [groups](variables-fast.tf#L90) | Group names or IAM-format principals to grant organization-level permissions. If just the name is provided, the 'group:' principal and organization domain are interpolated. | object({…}) | | {} | 0-bootstrap | | [locations](variables-fast.tf#L106) | Optional locations for GCS, BigQuery, and logging buckets created here. | object({…}) | | {} | 0-bootstrap | | [org_policy_tags](variables-fast.tf#L150) | Organization policy tags. | object({…}) | | {} | 0-bootstrap | | [outputs_location](variables.tf#L31) | Enable writing provider, tfvars and CI/CD workflow files to local filesystem. Leave null to disable. | string | | null | | diff --git a/fast/stages/1-resman/variables-fast.tf b/fast/stages/1-resman/variables-fast.tf index ecc055c73..e9ad67698 100644 --- a/fast/stages/1-resman/variables-fast.tf +++ b/fast/stages/1-resman/variables-fast.tf @@ -1,5 +1,5 @@ /** - * Copyright 2024 Google LLC + * Copyright 2025 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -96,7 +96,7 @@ variable "groups" { gcp-devops = optional(string, "gcp-devops") gcp-network-admins = optional(string, "gcp-vpc-network-admins") gcp-organization-admins = optional(string, "gcp-organization-admins") - gcp-secops-admins = optional(string, "gcp-secops-admins") + gcp-secops-admins = optional(string, "gcp-security-admins") gcp-security-admins = optional(string, "gcp-security-admins") }) nullable = false diff --git a/tests/fast/stages/s0_bootstrap/simple.yaml b/tests/fast/stages/s0_bootstrap/simple.yaml index 5230b1bef..101637421 100644 --- a/tests/fast/stages/s0_bootstrap/simple.yaml +++ b/tests/fast/stages/s0_bootstrap/simple.yaml @@ -96,7 +96,7 @@ outputs: gcp-devops: group:gcp-devops@fast.example.com gcp-network-admins: group:gcp-vpc-network-admins@fast.example.com gcp-organization-admins: group:gcp-organization-admins@fast.example.com - gcp-secops-admins: group:gcp-secops-admins@fast.example.com + gcp-secops-admins: group:gcp-security-admins@fast.example.com gcp-security-admins: group:gcp-security-admins@fast.example.com gcp-support: group:gcp-support@example.com locations: