kms · project | |
-| [core-prod.tf](./core-prod.tf) | None | kms · project | |
+| [core-dev.tf](./core-dev.tf) | None | certificate-authority-service · kms · project | google_certificate_manager_trust_config · google_network_security_tls_inspection_policy |
+| [core-prod.tf](./core-prod.tf) | None | certificate-authority-service · kms · project | google_certificate_manager_trust_config · google_network_security_tls_inspection_policy |
| [main.tf](./main.tf) | Module-level locals and resources. | folder | |
| [outputs.tf](./outputs.tf) | Module outputs. | | google_storage_bucket_object · local_file |
| [variables-fast.tf](./variables-fast.tf) | None | | |
@@ -184,15 +284,21 @@ The script will create one keyring for each specified location and keys on each
| [folder_ids](variables-fast.tf#L38) | Folder name => id mappings, the 'security' folder name must exist. | object({…}) | ✓ | | 1-resman |
| [organization](variables-fast.tf#L46) | Organization details. | object({…}) | ✓ | | 0-bootstrap |
| [prefix](variables-fast.tf#L56) | Prefix used for resources that need unique names. Use a maximum of 9 chars for organizations, and 11 chars for tenants. | string | ✓ | | 0-bootstrap |
-| [service_accounts](variables-fast.tf#L66) | Automation service accounts that can assign the encrypt/decrypt roles on keys. | object({…}) | ✓ | | 1-resman |
-| [essential_contacts](variables.tf#L17) | Email used for essential contacts, unset if null. | string | | null | |
-| [kms_keys](variables.tf#L23) | KMS keys to create, keyed by name. | map(object({…})) | | {} | |
-| [outputs_location](variables.tf#L62) | Path where providers, tfvars files, and lists for the following stages are written. Leave empty to disable. | string | | null | |
+| [service_accounts](variables-fast.tf#L66) | Automation service accounts that can assign the encrypt/decrypt roles on keys. | object({…}) | ✓ | | 1-resman |
+| [cas_configs](variables.tf#L18) | The CAS CAs to add to each environment. | object({…}) | | {…} | |
+| [essential_contacts](variables.tf#L179) | Email used for essential contacts, unset if null. | string | | null | |
+| [kms_keys](variables.tf#L185) | KMS keys to create, keyed by name. | map(object({…})) | | {} | |
+| [ngfw_tls_configs](variables.tf#L224) | The CAS and trust configurations key names to be used for NGFW Enterprise. | object({…}) | | {…} | |
+| [outputs_location](variables.tf#L250) | Path where providers, tfvars files, and lists for the following stages are written. Leave empty to disable. | string | | null | |
+| [trust_configs](variables.tf#L256) | The trust configs grouped by environment. | object({…}) | | {…} | |
## Outputs
| name | description | sensitive | consumers |
|---|---|:---:|---|
-| [kms_keys](outputs.tf#L55) | KMS key ids. | | |
-| [tfvars](outputs.tf#L60) | Terraform variable files for the following stages. | ✓ | |
+| [cas_configs](outputs.tf#L99) | Certificate Authority Service configurations. | | |
+| [kms_keys](outputs.tf#L104) | KMS key ids. | | |
+| [ngfw_tls_configs](outputs.tf#L109) | The NGFW Enterprise configurations. | | |
+| [tfvars](outputs.tf#L114) | Terraform variable files for the following stages. | ✓ | |
+| [trust_config_ids](outputs.tf#L120) | Certificate Manager trust-config ids. | | |
diff --git a/fast/stages/2-security/core-dev.tf b/fast/stages/2-security/core-dev.tf
index b44aca42d..9ac7d417f 100644
--- a/fast/stages/2-security/core-dev.tf
+++ b/fast/stages/2-security/core-dev.tf
@@ -1,5 +1,5 @@
/**
- * Copyright 2023 Google LLC
+ * Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -15,6 +15,18 @@
*/
locals {
+ # Extract NGFW locations from dev CAS
+ ngfw_dev_locations = toset([
+ for k, v in var.cas_configs.dev
+ : v.location
+ if contains(var.ngfw_tls_configs.keys.dev.cas, k)
+ ])
+ ngfw_dev_sa_agent_cas_iam_bindings_additive = {
+ nsec_dev_agent_sa_binding = {
+ member = module.dev-sec-project.service_agents["networksecurity"].iam_email
+ role = "roles/privateca.certificateManager"
+ }
+ }
dev_kms_restricted_admins = [
for sa in distinct(compact([
var.service_accounts.data-platform-dev,
@@ -54,3 +66,75 @@ module "dev-sec-kms" {
}
keys = local.kms_locations_keys[each.key]
}
+
+module "dev-cas" {
+ for_each = var.cas_configs.dev
+ source = "../../../modules/certificate-authority-service"
+ project_id = module.dev-sec-project.project_id
+ ca_configs = each.value.ca_configs
+ ca_pool_config = each.value.ca_pool_config
+ iam = each.value.iam
+ iam_bindings = each.value.iam_bindings
+ iam_bindings_additive = (
+ contains(var.ngfw_tls_configs.keys.dev.cas, each.key)
+ ? merge(local.ngfw_dev_sa_agent_cas_iam_bindings_additive, each.value.iam_bindings_additive)
+ : each.value.iam_bindings_additive
+ )
+ iam_by_principals = each.value.iam_by_principals
+ location = each.value.location
+}
+
+resource "google_certificate_manager_trust_config" "dev_trust_configs" {
+ for_each = var.trust_configs.dev
+ name = each.key
+ project = module.dev-sec-project.project_id
+ description = each.value.description
+ location = each.value.location
+
+ dynamic "allowlisted_certificates" {
+ for_each = each.value.allowlisted_certificates
+ content {
+ pem_certificate = file(allowlisted_certificates.value)
+ }
+ }
+
+ dynamic "trust_stores" {
+ for_each = each.value.trust_stores
+ content {
+ dynamic "intermediate_cas" {
+ for_each = trust_stores.value.intermediate_cas
+ content {
+ pem_certificate = file(intermediate_cas.value)
+ }
+ }
+ dynamic "trust_anchors" {
+ for_each = trust_stores.value.trust_anchors
+ content {
+ pem_certificate = file(trust_anchors.value)
+ }
+ }
+ }
+ }
+}
+
+resource "google_network_security_tls_inspection_policy" "ngfw_dev_tls_ips" {
+ for_each = (
+ var.ngfw_tls_configs.tls_inspection.enabled
+ ? local.ngfw_dev_locations : toset([])
+ )
+ name = "${var.prefix}-dev-tls-ip-0"
+ project = module.dev-sec-project.project_id
+ location = each.key
+ ca_pool = try([
+ for k, v in module.dev-cas
+ : v.ca_pool_id
+ if v.ca_pool.location == each.key && contains(var.ngfw_tls_configs.keys.dev.cas, k)
+ ][0], null)
+ exclude_public_ca_set = var.ngfw_tls_configs.tls_inspection.exclude_public_ca_set
+ min_tls_version = var.ngfw_tls_configs.tls_inspection.min_tls_version
+ trust_config = try([
+ for k, v in google_certificate_manager_trust_config.dev_trust_configs
+ : v.id
+ if v.location == each.key
+ ][0], null)
+}
diff --git a/fast/stages/2-security/core-prod.tf b/fast/stages/2-security/core-prod.tf
index 393627a47..c98fe7028 100644
--- a/fast/stages/2-security/core-prod.tf
+++ b/fast/stages/2-security/core-prod.tf
@@ -1,5 +1,5 @@
/**
- * Copyright 2023 Google LLC
+ * Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -15,6 +15,18 @@
*/
locals {
+ # Extract NGFW locations from prod CAS
+ ngfw_prod_locations = toset([
+ for k, v in var.cas_configs.prod
+ : v.location
+ if contains(var.ngfw_tls_configs.keys.prod.cas, k)
+ ])
+ ngfw_prod_sa_agent_cas_iam_bindings_additive = {
+ nsec_prod_agent_sa_binding = {
+ member = module.prod-sec-project.service_agents["networksecurity"].iam_email
+ role = "roles/privateca.certificateManager"
+ }
+ }
prod_kms_restricted_admins = [
for sa in distinct(compact([
var.service_accounts.data-platform-prod,
@@ -53,3 +65,76 @@ module "prod-sec-kms" {
}
keys = local.kms_locations_keys[each.key]
}
+
+module "prod-cas" {
+ for_each = var.cas_configs.prod
+ source = "../../../modules/certificate-authority-service"
+ project_id = module.prod-sec-project.project_id
+ ca_configs = each.value.ca_configs
+ ca_pool_config = each.value.ca_pool_config
+ iam = each.value.iam
+ iam_bindings = each.value.iam_bindings
+ iam_bindings_additive = (
+ contains(var.ngfw_tls_configs.keys.prod.cas, each.key)
+ ? merge(local.ngfw_prod_sa_agent_cas_iam_bindings_additive, each.value.iam_bindings_additive)
+ : each.value.iam_bindings_additive
+ )
+ iam_by_principals = each.value.iam_by_principals
+ location = each.value.location
+}
+
+resource "google_certificate_manager_trust_config" "prod_trust_configs" {
+ for_each = var.trust_configs.prod
+ name = each.key
+ project = module.prod-sec-project.project_id
+ description = each.value.description
+ location = each.value.location
+
+ dynamic "allowlisted_certificates" {
+ for_each = each.value.allowlisted_certificates
+ content {
+ pem_certificate = file(allowlisted_certificates.value)
+ }
+ }
+
+ dynamic "trust_stores" {
+ for_each = each.value.trust_stores
+ content {
+ dynamic "intermediate_cas" {
+ for_each = trust_stores.value.intermediate_cas
+ content {
+ pem_certificate = file(intermediate_cas.value)
+ }
+ }
+ dynamic "trust_anchors" {
+ for_each = trust_stores.value.trust_anchors
+ content {
+ pem_certificate = file(trust_anchors.value)
+ }
+ }
+ }
+ }
+}
+
+resource "google_network_security_tls_inspection_policy" "ngfw_prod_tls_ips" {
+ for_each = (
+ var.ngfw_tls_configs.tls_inspection.enabled
+ ? local.ngfw_prod_locations : toset([])
+ )
+ name = "${var.prefix}-prod-tls-ip-0"
+ project = module.prod-sec-project.project_id
+ location = each.key
+ ca_pool = try([
+ for k, v in module.prod-cas
+ : v.ca_pool_id
+ if v.ca_pool.location == each.key && contains(var.ngfw_tls_configs.keys.prod.cas, k)
+ ][0], null)
+ exclude_public_ca_set = var.ngfw_tls_configs.tls_inspection.exclude_public_ca_set
+ min_tls_version = var.ngfw_tls_configs.tls_inspection.min_tls_version
+ trust_config = try([
+ for k, v in google_certificate_manager_trust_config.prod_trust_configs
+ : v.id
+ if v.location == each.key
+ ][0], null)
+}
+
diff --git a/fast/stages/2-security/diagram.png b/fast/stages/2-security/diagram.png
index f7cd1f8ce..a92ca897a 100644
Binary files a/fast/stages/2-security/diagram.png and b/fast/stages/2-security/diagram.png differ
diff --git a/fast/stages/2-security/main.tf b/fast/stages/2-security/main.tf
index a72bd7b78..ba9b6d8a4 100644
--- a/fast/stages/2-security/main.tf
+++ b/fast/stages/2-security/main.tf
@@ -1,5 +1,5 @@
/**
- * Copyright 2023 Google LLC
+ * Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -33,7 +33,6 @@ locals {
)
}
}
-
# list of locations with keys
kms_locations = distinct(flatten([
for k, v in var.kms_keys : v.locations
@@ -48,7 +47,11 @@ locals {
}
}
project_services = [
+ "certificatemanager.googleapis.com",
"cloudkms.googleapis.com",
+ "networkmanagement.googleapis.com",
+ "networksecurity.googleapis.com",
+ "privateca.googleapis.com",
"secretmanager.googleapis.com",
"stackdriver.googleapis.com"
]
diff --git a/fast/stages/2-security/outputs.tf b/fast/stages/2-security/outputs.tf
index 16884b066..9fdd12783 100644
--- a/fast/stages/2-security/outputs.tf
+++ b/fast/stages/2-security/outputs.tf
@@ -1,5 +1,5 @@
/**
- * Copyright 2022 Google LLC
+ * Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -33,9 +33,53 @@ locals {
]
])
)
+ cas_configs = {
+ dev = {
+ for k, v in module.dev-cas
+ : k => {
+ ca_pool_id = v.ca_pool_id
+ ca_ids = v.ca_ids
+ location = v.ca_pool.location
+ }
+ }
+ prod = {
+ for k, v in module.prod-cas
+ : k => {
+ ca_pool_id = v.ca_pool_id
+ ca_ids = v.ca_ids
+ location = v.ca_pool.location
+ }
+ }
+ }
+ ngfw_tls_configs = {
+ tls_enabled = var.ngfw_tls_configs.tls_inspection.enabled
+ tls_ip_ids_by_region = {
+ dev = {
+ for k, v in google_network_security_tls_inspection_policy.ngfw_dev_tls_ips
+ : v.location => v.id
+ }
+ prod = {
+ for k, v in google_network_security_tls_inspection_policy.ngfw_prod_tls_ips
+ : v.location => v.id
+ }
+ }
+ }
output_kms_keys = { for k in local._output_kms_keys : k.key => k.id }
tfvars = {
- kms_keys = local.output_kms_keys
+ cas_configs = local.cas_configs
+ kms_keys = local.output_kms_keys
+ ngfw_tls_configs = local.ngfw_tls_configs
+ trust_config_ids = local.trust_config_ids
+ }
+ trust_config_ids = {
+ dev = {
+ for k, v in google_certificate_manager_trust_config.dev_trust_configs
+ : k => v.id
+ }
+ prod = {
+ for k, v in google_certificate_manager_trust_config.prod_trust_configs
+ : k => v.id
+ }
}
}
@@ -52,13 +96,28 @@ resource "google_storage_bucket_object" "tfvars" {
content = jsonencode(local.tfvars)
}
+output "cas_configs" {
+ description = "Certificate Authority Service configurations."
+ value = local.cas_configs
+}
+
output "kms_keys" {
description = "KMS key ids."
value = local.output_kms_keys
}
+output "ngfw_tls_configs" {
+ description = "The NGFW Enterprise configurations."
+ value = local.ngfw_tls_configs
+}
+
output "tfvars" {
description = "Terraform variable files for the following stages."
sensitive = true
value = local.tfvars
}
+
+output "trust_config_ids" {
+ description = "Certificate Manager trust-config ids."
+ value = local.trust_config_ids
+}
diff --git a/fast/stages/2-security/variables-fast.tf b/fast/stages/2-security/variables-fast.tf
index 96288b0e2..7d6259920 100644
--- a/fast/stages/2-security/variables-fast.tf
+++ b/fast/stages/2-security/variables-fast.tf
@@ -69,6 +69,8 @@ variable "service_accounts" {
type = object({
data-platform-dev = string
data-platform-prod = string
+ nsec = string
+ nsec-r = string
project-factory = string
project-factory-dev = string
project-factory-prod = string
diff --git a/fast/stages/2-security/variables.tf b/fast/stages/2-security/variables.tf
index dee73646f..e4c3a3623 100644
--- a/fast/stages/2-security/variables.tf
+++ b/fast/stages/2-security/variables.tf
@@ -14,6 +14,168 @@
* limitations under the License.
*/
+# Refer
+variable "cas_configs" {
+ description = "The CAS CAs to add to each environment."
+ type = object({
+ dev = optional(map(object({
+ ca_configs = map(object({
+ deletion_protection = optional(string, true)
+ type = optional(string, "SELF_SIGNED")
+ is_ca = optional(bool, true)
+ lifetime = optional(string, null)
+ pem_ca_certificate = optional(string, null)
+ ignore_active_certificates_on_deletion = optional(bool, false)
+ skip_grace_period = optional(bool, true)
+ labels = optional(map(string), null)
+ gcs_bucket = optional(string, null)
+ key_spec = optional(object({
+ algorithm = optional(string, "RSA_PKCS1_2048_SHA256")
+ kms_key_id = optional(string, null)
+ }), {})
+ key_usage = optional(object({
+ cert_sign = optional(bool, true)
+ client_auth = optional(bool, false)
+ code_signing = optional(bool, false)
+ content_commitment = optional(bool, false)
+ crl_sign = optional(bool, true)
+ data_encipherment = optional(bool, false)
+ decipher_only = optional(bool, false)
+ digital_signature = optional(bool, false)
+ email_protection = optional(bool, false)
+ encipher_only = optional(bool, false)
+ key_agreement = optional(bool, false)
+ key_encipherment = optional(bool, true)
+ ocsp_signing = optional(bool, false)
+ server_auth = optional(bool, true)
+ time_stamping = optional(bool, false)
+ }), {})
+ subject = optional(object({
+ common_name = string
+ organization = string
+ country_code = optional(string)
+ locality = optional(string)
+ organizational_unit = optional(string)
+ postal_code = optional(string)
+ province = optional(string)
+ street_address = optional(string)
+ }), {
+ common_name = "test.example.com"
+ organization = "Test Example"
+ })
+ subject_alt_name = optional(object({
+ dns_names = optional(list(string), null)
+ email_addresses = optional(list(string), null)
+ ip_addresses = optional(list(string), null)
+ uris = optional(list(string), null)
+ }), null)
+ subordinate_config = optional(object({
+ root_ca_id = optional(string)
+ pem_issuer_certificates = optional(list(string))
+ }), null)
+ }))
+ ca_pool_config = object({
+ ca_pool_id = optional(string, null)
+ name = optional(string, null)
+ tier = optional(string, "DEVOPS")
+ })
+ location = string
+ iam = optional(map(list(string)), {})
+ iam_bindings = optional(map(any), {})
+ iam_bindings_additive = optional(map(any), {})
+ iam_by_principals = optional(map(list(string)), {})
+ })), {})
+ prod = optional(map(object({
+ ca_configs = map(object({
+ deletion_protection = optional(string, true)
+ type = optional(string, "SELF_SIGNED")
+ is_ca = optional(bool, true)
+ lifetime = optional(string, null)
+ pem_ca_certificate = optional(string, null)
+ ignore_active_certificates_on_deletion = optional(bool, false)
+ skip_grace_period = optional(bool, true)
+ labels = optional(map(string), null)
+ gcs_bucket = optional(string, null)
+ key_spec = optional(object({
+ algorithm = optional(string, "RSA_PKCS1_2048_SHA256")
+ kms_key_id = optional(string, null)
+ }), {})
+ key_usage = optional(object({
+ cert_sign = optional(bool, true)
+ client_auth = optional(bool, false)
+ code_signing = optional(bool, false)
+ content_commitment = optional(bool, false)
+ crl_sign = optional(bool, true)
+ data_encipherment = optional(bool, false)
+ decipher_only = optional(bool, false)
+ digital_signature = optional(bool, false)
+ email_protection = optional(bool, false)
+ encipher_only = optional(bool, false)
+ key_agreement = optional(bool, false)
+ key_encipherment = optional(bool, true)
+ ocsp_signing = optional(bool, false)
+ server_auth = optional(bool, true)
+ time_stamping = optional(bool, false)
+ }), {})
+ subject = optional(object({
+ common_name = string
+ organization = string
+ country_code = optional(string)
+ locality = optional(string)
+ organizational_unit = optional(string)
+ postal_code = optional(string)
+ province = optional(string)
+ street_address = optional(string)
+ }), {
+ common_name = "test.example.com"
+ organization = "Test Example"
+ })
+ subject_alt_name = optional(object({
+ dns_names = optional(list(string), null)
+ email_addresses = optional(list(string), null)
+ ip_addresses = optional(list(string), null)
+ uris = optional(list(string), null)
+ }), null)
+ subordinate_config = optional(object({
+ root_ca_id = optional(string)
+ pem_issuer_certificates = optional(list(string))
+ }), null)
+ }))
+ ca_pool_config = object({
+ ca_pool_id = optional(string, null)
+ name = optional(string, null)
+ tier = optional(string, "DEVOPS")
+ })
+ location = string
+ iam = optional(map(list(string)), {})
+ iam_bindings = optional(map(object({
+ members = list(string)
+ role = string
+ condition = optional(object({
+ expression = string
+ title = string
+ description = optional(string)
+ }))
+ })), {})
+ iam_bindings_additive = optional(map(object({
+ member = string
+ role = string
+ condition = optional(object({
+ expression = string
+ title = string
+ description = optional(string)
+ }))
+ })), {})
+ iam_by_principals = optional(map(list(string)), {})
+ })), {})
+ })
+ nullable = false
+ default = {
+ dev = {}
+ prod = {}
+ }
+}
+
variable "essential_contacts" {
description = "Email used for essential contacts, unset if null."
type = string
@@ -59,8 +221,63 @@ variable "kms_keys" {
nullable = false
}
+variable "ngfw_tls_configs" {
+ description = "The CAS and trust configurations key names to be used for NGFW Enterprise."
+ type = object({
+ keys = optional(object({
+ dev = optional(object({
+ cas = optional(list(string), ["ngfw-dev-cas-0"])
+ trust_configs = optional(list(string), ["ngfw-dev-tc-0"])
+ }), {})
+ prod = optional(object({
+ cas = optional(list(string), ["ngfw-prod-cas-0"])
+ trust_configs = optional(list(string), ["ngfw-prod-tc-0"])
+ }), {})
+ }), {})
+ tls_inspection = optional(object({
+ enabled = optional(bool, false)
+ exclude_public_ca_set = optional(bool, false)
+ min_tls_version = optional(string, "TLS_1_0")
+ }), {})
+ })
+ nullable = false
+ default = {
+ dev = {}
+ prod = {}
+ }
+}
+
variable "outputs_location" {
description = "Path where providers, tfvars files, and lists for the following stages are written. Leave empty to disable."
type = string
default = null
}
+
+variable "trust_configs" {
+ description = "The trust configs grouped by environment."
+ type = object({
+ dev = optional(map(object({
+ description = optional(string)
+ location = string
+ allowlisted_certificates = optional(map(string), {})
+ trust_stores = optional(map(object({
+ intermediate_cas = optional(map(string), {})
+ trust_anchors = optional(map(string), {})
+ })), {})
+ })))
+ prod = optional(map(object({
+ description = optional(string)
+ location = string
+ allowlisted_certificates = optional(map(string), {})
+ trust_stores = optional(map(object({
+ intermediate_cas = optional(map(string), {})
+ trust_anchors = optional(map(string), {})
+ })), {})
+ })))
+ })
+ nullable = false
+ default = {
+ dev = {}
+ prod = {}
+ }
+}
diff --git a/fast/stages/3-network-security/README.md b/fast/stages/3-network-security/README.md
index 6e9a51905..cf52c977c 100644
--- a/fast/stages/3-network-security/README.md
+++ b/fast/stages/3-network-security/README.md
@@ -37,6 +37,8 @@ The following diagram is a high level reference of the resources created and man
- We use global network firewall policies, as legacy VPC firewall rules are not compatible with NGFW Enterprise. These policies coexist with the legacy VPC firewall rules that we create in the netwroking stage.
- For your convenience, firewall policy rules leverage factories, so that you can define firewall policy rules using yaml files. The path of these files is configurable. Look in the [Customization](#customizations) section for more details.
- NGFW Enterprise endpoints are org-level resources that need to reference a quota project for billing purposes. By default, we create a dedicated `xxx-net-ngfw-0` quota project. Anyway, you can choose to leverage an existing project. Look in the [Customization](#customizations) section for more details.
+- Firewall endpoint associations in this stage can reference TLS inspection policies created in the [2-security stage](../2-security/README.md). More info in the customization section of this document.
+- While TLS inspection policies are created in the [2-security stage](../2-security/README.md), FAST still allows the service accounts of this stage and the `gcp-network-admins` group to create and manage them anywhere in the organization.
## How to run this stage
@@ -137,6 +139,10 @@ ngfw_enterprise_config = {
}
```
+You can optionally enable TLS inspection in stage [2-security](../2-security/README.md).
+Ingesting outputs from [stage 2-security](../2-security/README.md), this stage will configure TLS inspection in NGFW Enterprise and will reference the CAs and the trust-configs you created in [stage 2-security](../2-security/README.md).
+Make sure the CAs and the trusted configs created for NGFW Enterprise in the [2-security stage](../2-security/README.md) match the region where you defined your zonal firewall endpoints.
+
## Files
@@ -156,12 +162,13 @@ ngfw_enterprise_config = {
|---|---|:---:|:---:|:---:|:---:|
| [billing_account](variables-fast.tf#L17) | Billing account id. If billing account is not part of the same org set `is_org_level` to false. | object({…}) | ✓ | | 0-bootstrap |
| [folder_ids](variables-fast.tf#L30) | Folders to be used for the networking resources in folders/nnnnnnnnnnn format. If null, folder will be created. | object({…}) | ✓ | | 1-resman |
-| [organization](variables-fast.tf#L52) | Organization details. | object({…}) | ✓ | | 00-globals |
-| [prefix](variables-fast.tf#L62) | Prefix used for resources that need unique names. Use a maximum of 9 chars for organizations, and 11 chars for tenants. | string | ✓ | | 0-bootstrap |
-| [vpc_self_links](variables-fast.tf#L72) | Self link for the shared VPC. | object({…}) | ✓ | | 2-networking |
+| [organization](variables-fast.tf#L72) | Organization details. | object({…}) | ✓ | | 00-globals |
+| [prefix](variables-fast.tf#L82) | Prefix used for resources that need unique names. Use a maximum of 9 chars for organizations, and 11 chars for tenants. | string | ✓ | | 0-bootstrap |
+| [vpc_self_links](variables-fast.tf#L92) | Self link for the shared VPC. | object({…}) | ✓ | | 2-networking |
| [factories_config](variables.tf#L17) | Configuration for network resource factories. | object({…}) | | {…} | |
| [host_project_ids](variables-fast.tf#L41) | Host project for the shared VPC. | object({…}) | | {} | 2-networking |
| [ngfw_enterprise_config](variables.tf#L35) | NGFW Enterprise configuration. | object({…}) | | {…} | |
+| [ngfw_tls_configs](variables-fast.tf#L52) | The NGFW Enterprise TLS configurations. | object({…}) | | {…} | 2-security |
## Outputs
diff --git a/fast/stages/3-network-security/data/firewall-policy-rules/dev/egress.yaml b/fast/stages/3-network-security/data/firewall-policy-rules/dev/egress.yaml
index 698e450b6..b193b872c 100644
--- a/fast/stages/3-network-security/data/firewall-policy-rules/dev/egress.yaml
+++ b/fast/stages/3-network-security/data/firewall-policy-rules/dev/egress.yaml
@@ -20,3 +20,5 @@ egress-inspect-internet:
- "0.0.0.0/0"
action: "apply_security_profile_group"
security_profile_group: "dev"
+ # Uncomment the line below to enable TLS inspection for this egress rule
+ # tls_inspect: true
diff --git a/fast/stages/3-network-security/data/firewall-policy-rules/dev/ingress.yaml b/fast/stages/3-network-security/data/firewall-policy-rules/dev/ingress.yaml
index 00add135c..7feca48e6 100644
--- a/fast/stages/3-network-security/data/firewall-policy-rules/dev/ingress.yaml
+++ b/fast/stages/3-network-security/data/firewall-policy-rules/dev/ingress.yaml
@@ -1,10 +1,9 @@
# skip boilerplate check
---
-# start of document (---) avoids errors if the file only contains comments
# yaml-language-server: $schema=../../../schemas/firewall-policy-rules.schema.json
-# sample NGFW Enterprise ingress rules
+# Sample NGFW Enterprise ingress rules to uncomment and customize as needed
# ingress-allow-inspect-cross:
# description: "Allow and inspect cross-env traffic from prod."
@@ -14,6 +13,7 @@
# - prod (to be defined)
# action: "apply_security_profile_group"
# security_profile_group: "dev"
+# tls_inspect: true
# ingress-allow-inspect-intra:
# description: "Allow and inspect same-env (intra-vpc) traffic."
@@ -23,3 +23,4 @@
# - dev (to be defined)
# action: "apply_security_profile_group"
# security_profile_group: "dev"
+# tls_inspect: true
diff --git a/fast/stages/3-network-security/data/firewall-policy-rules/prod/egress.yaml b/fast/stages/3-network-security/data/firewall-policy-rules/prod/egress.yaml
index 397acebe2..527428a19 100644
--- a/fast/stages/3-network-security/data/firewall-policy-rules/prod/egress.yaml
+++ b/fast/stages/3-network-security/data/firewall-policy-rules/prod/egress.yaml
@@ -16,3 +16,5 @@ egress-inspect-internet:
- "0.0.0.0/0"
action: "apply_security_profile_group"
security_profile_group: "prod"
+ # Uncomment the line below to enable TLS inspection for this egress rule
+ # tls_inspect: true
diff --git a/fast/stages/3-network-security/data/firewall-policy-rules/prod/ingress.yaml b/fast/stages/3-network-security/data/firewall-policy-rules/prod/ingress.yaml
index e0aa293c5..96f8d3ee3 100644
--- a/fast/stages/3-network-security/data/firewall-policy-rules/prod/ingress.yaml
+++ b/fast/stages/3-network-security/data/firewall-policy-rules/prod/ingress.yaml
@@ -1,6 +1,8 @@
# skip boilerplate check
---
-# Following are some NGFW Enterprise ingress rules examples
+# yaml-language-server: $schema=../../../schemas/firewall-policy-rules.schema.json
+
+# Sample NGFW Enterprise ingress rules to uncomment and customize as needed
# ingress-allow-inspect-cross:
# description: "Allow and inspect cross-env traffic."
@@ -10,6 +12,7 @@
# - dev (to be defined)
# action: "apply_security_profile_group"
# security_profile_group: "prod"
+# tls_inspect: true
# ingress-allow-inspect-intra:
# description: "Allow and inspect intra-VPC traffic."
@@ -19,3 +22,4 @@
# - prod (to be defined)
# action: "apply_security_profile_group"
# security_profile_group: "prod"
+# tls_inspect: true
diff --git a/fast/stages/3-network-security/diagram.png b/fast/stages/3-network-security/diagram.png
index 960cbff20..9fb05873a 100644
Binary files a/fast/stages/3-network-security/diagram.png and b/fast/stages/3-network-security/diagram.png differ
diff --git a/fast/stages/3-network-security/diagram.svg b/fast/stages/3-network-security/diagram.svg
index 3c586b458..83547ed34 100644
--- a/fast/stages/3-network-security/diagram.svg
+++ b/fast/stages/3-network-security/diagram.svg
@@ -1 +1 @@
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/fast/stages/3-network-security/net-dev.tf b/fast/stages/3-network-security/net-dev.tf
index 408a4e4ec..461cd8db0 100644
--- a/fast/stages/3-network-security/net-dev.tf
+++ b/fast/stages/3-network-security/net-dev.tf
@@ -38,6 +38,12 @@ resource "google_network_security_firewall_endpoint_association" "dev_fw_ep_asso
location = each.value
firewall_endpoint = google_network_security_firewall_endpoint.firewall_endpoint[each.key].id
network = try(local.vpc_ids.dev-spoke-0, null)
+ # If TLS inspection is enabled, link the regional TLS inspection policy
+ tls_inspection_policy = (
+ var.ngfw_tls_configs.tls_enabled
+ ? try(var.ngfw_tls_configs.tls_ip_ids_by_region.dev[substr(each.value, 0, length(each.value) - 2)], null)
+ : null
+ )
}
module "dev-spoke-firewall-policy" {
diff --git a/fast/stages/3-network-security/net-prod.tf b/fast/stages/3-network-security/net-prod.tf
index bffdf133c..d69638033 100644
--- a/fast/stages/3-network-security/net-prod.tf
+++ b/fast/stages/3-network-security/net-prod.tf
@@ -38,6 +38,12 @@ resource "google_network_security_firewall_endpoint_association" "prod_fw_ep_ass
location = each.value
firewall_endpoint = google_network_security_firewall_endpoint.firewall_endpoint[each.key].id
network = try(local.vpc_ids.prod-spoke-0, null)
+ # If TLS inspection is enabled, link the regional TLS inspection policy
+ tls_inspection_policy = (
+ var.ngfw_tls_configs.tls_enabled
+ ? try(var.ngfw_tls_configs.tls_ip_ids_by_region.prod[substr(each.value, 0, length(each.value) - 2)], null)
+ : null
+ )
}
module "prod-spoke-firewall-policy" {
diff --git a/fast/stages/3-network-security/variables-fast.tf b/fast/stages/3-network-security/variables-fast.tf
index 7a65658b0..e6b6de55c 100644
--- a/fast/stages/3-network-security/variables-fast.tf
+++ b/fast/stages/3-network-security/variables-fast.tf
@@ -49,6 +49,26 @@ variable "host_project_ids" {
default = {}
}
+variable "ngfw_tls_configs" {
+ # tfdoc:variable:source 2-security
+ description = "The NGFW Enterprise TLS configurations."
+ type = object({
+ tls_enabled = optional(bool, false)
+ tls_ip_ids_by_region = optional(object({
+ dev = optional(map(string), {})
+ prod = optional(map(string), {})
+ }))
+ })
+ nullable = false
+ default = {
+ tls_enabled = false
+ tls_ip_ids_by_region = {
+ dev = {}
+ prod = {}
+ }
+ }
+}
+
variable "organization" {
# tfdoc:variable:source 00-globals
description = "Organization details."
diff --git a/fast/stages/diagrams.excalidraw.gz b/fast/stages/diagrams.excalidraw.gz
index 5cf62be67..2d168c2ac 100644
Binary files a/fast/stages/diagrams.excalidraw.gz and b/fast/stages/diagrams.excalidraw.gz differ
diff --git a/tests/fast/stages/s0_bootstrap/checklist.yaml b/tests/fast/stages/s0_bootstrap/checklist.yaml
index 86f58ee38..d49a8e57e 100644
--- a/tests/fast/stages/s0_bootstrap/checklist.yaml
+++ b/tests/fast/stages/s0_bootstrap/checklist.yaml
@@ -46,21 +46,6 @@ values:
google_storage_bucket_object.providers["0-bootstrap"]:
bucket: fast-prod-iac-core-outputs-0
cache_control: null
- content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
- \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
- \ in compliance with the License.\n * You may obtain a copy of the License at\n\
- \ *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
- \ by applicable law or agreed to in writing, software\n * distributed under\
- \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
- \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
- \ the specific language governing permissions and\n * limitations under the\
- \ License.\n */\n\nterraform {\n backend \"gcs\" {\n bucket \
- \ = \"fast-prod-iac-core-bootstrap-0\"\n impersonate_service_account\
- \ = \"fast-prod-bootstrap-0@fast-prod-iac-core-0.iam.gserviceaccount.com\"\n\
- \ }\n}\nprovider \"google\" {\n impersonate_service_account = \"fast-prod-bootstrap-0@fast-prod-iac-core-0.iam.gserviceaccount.com\"\
- \n}\nprovider \"google-beta\" {\n impersonate_service_account = \"fast-prod-bootstrap-0@fast-prod-iac-core-0.iam.gserviceaccount.com\"\
- \n}\n\n# end provider.tf for bootstrap\n"
- content_disposition: null
content_encoding: null
content_language: null
customer_encryption: []
@@ -75,21 +60,6 @@ values:
google_storage_bucket_object.providers["0-bootstrap-r"]:
bucket: fast-prod-iac-core-outputs-0
cache_control: null
- content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
- \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
- \ in compliance with the License.\n * You may obtain a copy of the License at\n\
- \ *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
- \ by applicable law or agreed to in writing, software\n * distributed under\
- \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
- \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
- \ the specific language governing permissions and\n * limitations under the\
- \ License.\n */\n\nterraform {\n backend \"gcs\" {\n bucket \
- \ = \"fast-prod-iac-core-bootstrap-0\"\n impersonate_service_account\
- \ = \"fast-prod-bootstrap-0r@fast-prod-iac-core-0.iam.gserviceaccount.com\"\n\
- \ }\n}\nprovider \"google\" {\n impersonate_service_account = \"fast-prod-bootstrap-0r@fast-prod-iac-core-0.iam.gserviceaccount.com\"\
- \n}\nprovider \"google-beta\" {\n impersonate_service_account = \"fast-prod-bootstrap-0r@fast-prod-iac-core-0.iam.gserviceaccount.com\"\
- \n}\n\n# end provider.tf for bootstrap\n"
- content_disposition: null
content_encoding: null
content_language: null
customer_encryption: []
@@ -104,21 +74,6 @@ values:
google_storage_bucket_object.providers["1-resman"]:
bucket: fast-prod-iac-core-outputs-0
cache_control: null
- content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
- \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
- \ in compliance with the License.\n * You may obtain a copy of the License at\n\
- \ *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
- \ by applicable law or agreed to in writing, software\n * distributed under\
- \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
- \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
- \ the specific language governing permissions and\n * limitations under the\
- \ License.\n */\n\nterraform {\n backend \"gcs\" {\n bucket \
- \ = \"fast-prod-iac-core-resman-0\"\n impersonate_service_account\
- \ = \"fast-prod-resman-0@fast-prod-iac-core-0.iam.gserviceaccount.com\"\n }\n\
- }\nprovider \"google\" {\n impersonate_service_account = \"fast-prod-resman-0@fast-prod-iac-core-0.iam.gserviceaccount.com\"\
- \n}\nprovider \"google-beta\" {\n impersonate_service_account = \"fast-prod-resman-0@fast-prod-iac-core-0.iam.gserviceaccount.com\"\
- \n}\n\n# end provider.tf for resman\n"
- content_disposition: null
content_encoding: null
content_language: null
customer_encryption: []
@@ -133,21 +88,6 @@ values:
google_storage_bucket_object.providers["1-resman-r"]:
bucket: fast-prod-iac-core-outputs-0
cache_control: null
- content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
- \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
- \ in compliance with the License.\n * You may obtain a copy of the License at\n\
- \ *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
- \ by applicable law or agreed to in writing, software\n * distributed under\
- \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
- \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
- \ the specific language governing permissions and\n * limitations under the\
- \ License.\n */\n\nterraform {\n backend \"gcs\" {\n bucket \
- \ = \"fast-prod-iac-core-resman-0\"\n impersonate_service_account\
- \ = \"fast-prod-resman-0r@fast-prod-iac-core-0.iam.gserviceaccount.com\"\n \
- \ }\n}\nprovider \"google\" {\n impersonate_service_account = \"fast-prod-resman-0r@fast-prod-iac-core-0.iam.gserviceaccount.com\"\
- \n}\nprovider \"google-beta\" {\n impersonate_service_account = \"fast-prod-resman-0r@fast-prod-iac-core-0.iam.gserviceaccount.com\"\
- \n}\n\n# end provider.tf for resman\n"
- content_disposition: null
content_encoding: null
content_language: null
customer_encryption: []
@@ -162,21 +102,6 @@ values:
google_storage_bucket_object.providers["1-tenant-factory"]:
bucket: fast-prod-iac-core-outputs-0
cache_control: null
- content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
- \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
- \ in compliance with the License.\n * You may obtain a copy of the License at\n\
- \ *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
- \ by applicable law or agreed to in writing, software\n * distributed under\
- \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
- \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
- \ the specific language governing permissions and\n * limitations under the\
- \ License.\n */\n\nterraform {\n backend \"gcs\" {\n bucket \
- \ = \"fast-prod-iac-core-resman-0\"\n impersonate_service_account\
- \ = \"fast-prod-resman-0@fast-prod-iac-core-0.iam.gserviceaccount.com\"\n \
- \ prefix = \"tenant-factory\"\n }\n}\nprovider \"google\" {\n impersonate_service_account\
- \ = \"fast-prod-resman-0@fast-prod-iac-core-0.iam.gserviceaccount.com\"\n}\n\
- provider \"google-beta\" {\n impersonate_service_account = \"fast-prod-resman-0@fast-prod-iac-core-0.iam.gserviceaccount.com\"\
- \n}\n\n# end provider.tf for tenant-factory\n"
content_disposition: null
content_encoding: null
content_language: null
@@ -192,21 +117,6 @@ values:
google_storage_bucket_object.providers["1-tenant-factory-r"]:
bucket: fast-prod-iac-core-outputs-0
cache_control: null
- content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
- \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
- \ in compliance with the License.\n * You may obtain a copy of the License at\n\
- \ *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
- \ by applicable law or agreed to in writing, software\n * distributed under\
- \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
- \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
- \ the specific language governing permissions and\n * limitations under the\
- \ License.\n */\n\nterraform {\n backend \"gcs\" {\n bucket \
- \ = \"fast-prod-iac-core-resman-0\"\n impersonate_service_account\
- \ = \"fast-prod-resman-0r@fast-prod-iac-core-0.iam.gserviceaccount.com\"\n \
- \ prefix = \"tenant-factory\"\n }\n}\nprovider \"google\" {\n impersonate_service_account\
- \ = \"fast-prod-resman-0r@fast-prod-iac-core-0.iam.gserviceaccount.com\"\n}\n\
- provider \"google-beta\" {\n impersonate_service_account = \"fast-prod-resman-0r@fast-prod-iac-core-0.iam.gserviceaccount.com\"\
- \n}\n\n# end provider.tf for tenant-factory\n"
content_disposition: null
content_encoding: null
content_language: null
@@ -222,21 +132,6 @@ values:
google_storage_bucket_object.providers["1-vpcsc"]:
bucket: fast-prod-iac-core-outputs-0
cache_control: null
- content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
- \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
- \ in compliance with the License.\n * You may obtain a copy of the License at\n\
- \ *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
- \ by applicable law or agreed to in writing, software\n * distributed under\
- \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
- \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
- \ the specific language governing permissions and\n * limitations under the\
- \ License.\n */\n\nterraform {\n backend \"gcs\" {\n bucket \
- \ = \"fast-prod-iac-core-vpcsc-0\"\n impersonate_service_account\
- \ = \"fast-prod-vpcsc-0@fast-prod-iac-core-0.iam.gserviceaccount.com\"\n \
- \ prefix = \"vpcsc\"\n }\n}\nprovider \"google\" {\n impersonate_service_account\
- \ = \"fast-prod-vpcsc-0@fast-prod-iac-core-0.iam.gserviceaccount.com\"\n}\n\
- provider \"google-beta\" {\n impersonate_service_account = \"fast-prod-vpcsc-0@fast-prod-iac-core-0.iam.gserviceaccount.com\"\
- \n}\n\n# end provider.tf for vpcsc\n"
content_disposition: null
content_encoding: null
content_language: null
@@ -252,21 +147,6 @@ values:
google_storage_bucket_object.providers["1-vpcsc-r"]:
bucket: fast-prod-iac-core-outputs-0
cache_control: null
- content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
- \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
- \ in compliance with the License.\n * You may obtain a copy of the License at\n\
- \ *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
- \ by applicable law or agreed to in writing, software\n * distributed under\
- \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
- \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
- \ the specific language governing permissions and\n * limitations under the\
- \ License.\n */\n\nterraform {\n backend \"gcs\" {\n bucket \
- \ = \"fast-prod-iac-core-vpcsc-0\"\n impersonate_service_account\
- \ = \"fast-prod-vpcsc-0r@fast-prod-iac-core-0.iam.gserviceaccount.com\"\n \
- \ prefix = \"vpcsc\"\n }\n}\nprovider \"google\" {\n impersonate_service_account\
- \ = \"fast-prod-vpcsc-0r@fast-prod-iac-core-0.iam.gserviceaccount.com\"\n}\n\
- provider \"google-beta\" {\n impersonate_service_account = \"fast-prod-vpcsc-0r@fast-prod-iac-core-0.iam.gserviceaccount.com\"\
- \n}\n\n# end provider.tf for vpcsc\n"
content_disposition: null
content_encoding: null
content_language: null
@@ -1646,9 +1526,9 @@ values:
module.organization.google_organization_iam_binding.bindings["organization_iam_admin_conditional"]:
condition:
- description: Automation service account delegated grants.
- expression: 'api.getAttribute(''iam.googleapis.com/modifiedGrantsByRole'', []).hasOnly([''roles/accesscontextmanager.policyAdmin'',''roles/cloudasset.viewer'',''roles/compute.orgFirewallPolicyAdmin'',''roles/compute.xpnAdmin'',''roles/orgpolicy.policyAdmin'',''roles/orgpolicy.policyViewer'',''roles/resourcemanager.organizationViewer''])
+ expression: 'api.getAttribute(''iam.googleapis.com/modifiedGrantsByRole'', []).hasOnly([''roles/accesscontextmanager.policyAdmin'',''roles/cloudasset.viewer'',''roles/compute.orgFirewallPolicyAdmin'',''roles/compute.orgFirewallPolicyUser'',''roles/compute.xpnAdmin'',''roles/orgpolicy.policyAdmin'',''roles/orgpolicy.policyViewer'',''roles/resourcemanager.organizationViewer''])
- || api.getAttribute(''iam.googleapis.com/modifiedGrantsByRole'', []).hasOnly([''organizations/123456789012/roles/networkFirewallPoliciesAdmin'',''organizations/123456789012/roles/networkFirewallPoliciesViewer'',''organizations/123456789012/roles/ngfwEnterpriseAdmin'',''organizations/123456789012/roles/ngfwEnterpriseViewer'',''organizations/123456789012/roles/serviceProjectNetworkAdmin'',''organizations/123456789012/roles/tenantNetworkAdmin''])
+ || api.getAttribute(''iam.googleapis.com/modifiedGrantsByRole'', []).hasOnly([''organizations/123456789012/roles/networkFirewallPoliciesAdmin'',''organizations/123456789012/roles/ngfwEnterpriseAdmin'',''organizations/123456789012/roles/ngfwEnterpriseViewer'',''organizations/123456789012/roles/serviceProjectNetworkAdmin'',''organizations/123456789012/roles/tenantNetworkAdmin''])
'
title: automation_sa_delegated_grants
@@ -1687,15 +1567,6 @@ values:
role_id: networkFirewallPoliciesAdmin
stage: GA
title: Custom role networkFirewallPoliciesAdmin
- module.organization.google_organization_iam_custom_role.roles["network_firewall_policies_viewer"]:
- description: Terraform-managed.
- org_id: '123456789012'
- permissions:
- - networksecurity.firewallEndpointAssociations.get
- - networksecurity.firewallEndpointAssociations.list
- role_id: networkFirewallPoliciesViewer
- stage: GA
- title: Custom role networkFirewallPoliciesViewer
module.organization.google_organization_iam_custom_role.roles["ngfw_enterprise_admin"]:
description: Terraform-managed.
org_id: '123456789012'
@@ -1724,6 +1595,11 @@ values:
- networksecurity.securityProfiles.list
- networksecurity.securityProfiles.update
- networksecurity.securityProfiles.use
+ - networksecurity.tlsInspectionPolicies.create
+ - networksecurity.tlsInspectionPolicies.get
+ - networksecurity.tlsInspectionPolicies.list
+ - networksecurity.tlsInspectionPolicies.update
+ - networksecurity.tlsInspectionPolicies.use
role_id: ngfwEnterpriseAdmin
stage: GA
title: Custom role ngfwEnterpriseAdmin
@@ -1744,6 +1620,9 @@ values:
- networksecurity.securityProfiles.get
- networksecurity.securityProfiles.list
- networksecurity.securityProfiles.use
+ - networksecurity.tlsInspectionPolicies.get
+ - networksecurity.tlsInspectionPolicies.list
+ - networksecurity.tlsInspectionPolicies.use
role_id: ngfwEnterpriseViewer
stage: GA
title: Custom role ngfwEnterpriseViewer
@@ -2066,7 +1945,7 @@ counts:
google_logging_project_bucket_config: 4
google_org_policy_policy: 22
google_organization_iam_binding: 28
- google_organization_iam_custom_role: 11
+ google_organization_iam_custom_role: 10
google_organization_iam_member: 42
google_project: 3
google_project_iam_audit_config: 1
@@ -2085,4 +1964,4 @@ counts:
google_tags_tag_key: 1
google_tags_tag_value: 1
modules: 21
- resources: 237
+ resources: 236
diff --git a/tests/fast/stages/s0_bootstrap/simple.yaml b/tests/fast/stages/s0_bootstrap/simple.yaml
index d5e936d86..4d1558505 100644
--- a/tests/fast/stages/s0_bootstrap/simple.yaml
+++ b/tests/fast/stages/s0_bootstrap/simple.yaml
@@ -21,7 +21,7 @@ counts:
google_logging_project_bucket_config: 4
google_org_policy_policy: 22
google_organization_iam_binding: 28
- google_organization_iam_custom_role: 11
+ google_organization_iam_custom_role: 10
google_organization_iam_member: 29
google_project: 3
google_project_iam_audit_config: 1
@@ -41,7 +41,7 @@ counts:
google_tags_tag_value: 1
local_file: 10
modules: 20
- resources: 231
+ resources: 230
outputs:
automation: __missing__
@@ -50,7 +50,6 @@ outputs:
custom_roles:
gcve_network_admin: organizations/123456789012/roles/gcveNetworkAdmin
network_firewall_policies_admin: organizations/123456789012/roles/networkFirewallPoliciesAdmin
- network_firewall_policies_viewer: organizations/123456789012/roles/networkFirewallPoliciesViewer
ngfw_enterprise_admin: organizations/123456789012/roles/ngfwEnterpriseAdmin
ngfw_enterprise_viewer: organizations/123456789012/roles/ngfwEnterpriseViewer
organization_admin_viewer: organizations/123456789012/roles/organizationAdminViewer
@@ -73,3 +72,4 @@ outputs:
workload_identity_pool:
pool: null
providers: {}
+
diff --git a/tests/fast/stages/s1_resman/checklist.tfvars b/tests/fast/stages/s1_resman/checklist.tfvars
index 3684f0f77..809977312 100644
--- a/tests/fast/stages/s1_resman/checklist.tfvars
+++ b/tests/fast/stages/s1_resman/checklist.tfvars
@@ -13,14 +13,13 @@ billing_account = {
}
custom_roles = {
# organization_iam_admin = "organizations/123456789012/roles/organizationIamAdmin",
- gcve_network_admin = "organizations/123456789012/roles/gcveNetworkAdmin"
- network_firewall_policies_admin = "organizations/123456789012/roles/networkFirewallPoliciesAdmin"
- network_firewall_policies_viewer = "organizations/123456789012/roles/networkFirewallPoliciesViewer"
- ngfw_enterprise_admin = "organizations/123456789012/roles/ngfwEnterpriseAdmin"
- ngfw_enterprise_viewer = "organizations/123456789012/roles/ngfwEnterpriseViewer"
- organization_admin_viewer = "organizations/123456789012/roles/organizationAdminViewer"
- service_project_network_admin = "organizations/123456789012/roles/xpnServiceAdmin"
- storage_viewer = "organizations/123456789012/roles/storageViewer"
+ gcve_network_admin = "organizations/123456789012/roles/gcveNetworkAdmin"
+ network_firewall_policies_admin = "organizations/123456789012/roles/networkFirewallPoliciesAdmin"
+ ngfw_enterprise_admin = "organizations/123456789012/roles/ngfwEnterpriseAdmin"
+ ngfw_enterprise_viewer = "organizations/123456789012/roles/ngfwEnterpriseViewer"
+ organization_admin_viewer = "organizations/123456789012/roles/organizationAdminViewer"
+ service_project_network_admin = "organizations/123456789012/roles/xpnServiceAdmin"
+ storage_viewer = "organizations/123456789012/roles/storageViewer"
}
factories_config = {
checklist_data = "checklist-data.json"
diff --git a/tests/fast/stages/s1_resman/checklist.yaml b/tests/fast/stages/s1_resman/checklist.yaml
index c3208c0ba..4fe2b0647 100644
--- a/tests/fast/stages/s1_resman/checklist.yaml
+++ b/tests/fast/stages/s1_resman/checklist.yaml
@@ -13,6 +13,671 @@
# limitations under the License.
values:
+ google_storage_bucket_object.providers["2-networking"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-networking-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-networking-r"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-networking-r-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-project-factory"]:
+ bucket: test
+ cache_control: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-project-factory-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-project-factory-dev"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-project-factory-dev-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-project-factory-dev-r"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-project-factory-dev-r-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-project-factory-prod"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-project-factory-prod-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-project-factory-prod-r"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-project-factory-prod-r-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-project-factory-r"]:
+ bucket: test
+ cache_control: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-project-factory-r-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-security"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-security-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-security-r"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-security-r-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.tfvars:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: tfvars/1-resman.auto.tfvars.json
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ module.branch-network-dev-folder.google_folder.folder[0]:
+ display_name: Development
+ timeouts: null
+ ? module.branch-network-dev-folder.google_folder_iam_binding.authoritative["organizations/123456789012/roles/gcveNetworkAdmin"]
+ : condition: []
+ members: null
+ role: organizations/123456789012/roles/gcveNetworkAdmin
+ ? module.branch-network-dev-folder.google_folder_iam_binding.authoritative["organizations/123456789012/roles/xpnServiceAdmin"]
+ : condition: []
+ members:
+ - serviceAccount:fast2-dev-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: organizations/123456789012/roles/xpnServiceAdmin
+ module.branch-network-dev-folder.google_folder_iam_binding.authoritative["roles/compute.networkViewer"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-dev-resman-pf-0r@fast-prod-automation.iam.gserviceaccount.com
+ - serviceAccount:fast2-resman-pf-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/compute.networkViewer
+ module.branch-network-dev-folder.google_tags_tag_binding.binding["environment"]:
+ timeouts: null
+ module.branch-network-folder.google_folder.folder[0]:
+ display_name: Networking
+ parent: organizations/123456789012
+ timeouts: null
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/compute.xpnAdmin"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/compute.xpnAdmin
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/editor"]:
+ condition: []
+ members:
+ - group:gcp-vpc-network-admins@fast.example.com
+ role: roles/editor
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/logging.admin"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/logging.admin
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/owner"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/owner
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/resourcemanager.folderAdmin"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.folderAdmin
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/resourcemanager.folderViewer"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.folderViewer
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/resourcemanager.projectCreator"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.projectCreator
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/viewer"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/viewer
+ module.branch-network-folder.google_tags_tag_binding.binding["context"]:
+ timeouts: null
+ module.branch-network-gcs.google_storage_bucket.bucket:
+ autoclass: []
+ cors: []
+ custom_placement_config: []
+ default_event_based_hold: null
+ enable_object_retention: null
+ encryption: []
+ force_destroy: false
+ labels: null
+ lifecycle_rule: []
+ location: EU
+ logging: []
+ name: fast2-prod-resman-net-0
+ project: fast-prod-automation
+ requester_pays: null
+ retention_policy: []
+ storage_class: STANDARD
+ timeouts: null
+ uniform_bucket_level_access: true
+ versioning:
+ - enabled: true
+ module.branch-network-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectAdmin"]:
+ bucket: fast2-prod-resman-net-0
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectAdmin
+ module.branch-network-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectViewer"]:
+ bucket: fast2-prod-resman-net-0
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectViewer
+ module.branch-network-prod-folder.google_folder.folder[0]:
+ display_name: Production
+ timeouts: null
+ ? module.branch-network-prod-folder.google_folder_iam_binding.authoritative["organizations/123456789012/roles/gcveNetworkAdmin"]
+ : condition: []
+ members: null
+ role: organizations/123456789012/roles/gcveNetworkAdmin
+ ? module.branch-network-prod-folder.google_folder_iam_binding.authoritative["organizations/123456789012/roles/xpnServiceAdmin"]
+ : condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: organizations/123456789012/roles/xpnServiceAdmin
+ module.branch-network-prod-folder.google_folder_iam_binding.authoritative["roles/compute.networkViewer"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-pf-0r@fast-prod-automation.iam.gserviceaccount.com
+ - serviceAccount:fast2-resman-pf-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/compute.networkViewer
+ module.branch-network-prod-folder.google_tags_tag_binding.binding["environment"]:
+ timeouts: null
+ ? module.branch-network-r-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-network-r-sa.google_service_account.service_account[0]:
+ account_id: fast2-prod-resman-net-0r
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform resman networking service account (read-only).
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-network-r-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ ? module.branch-network-r-sa.google_storage_bucket_iam_member.bucket-roles["test-organizations/123456789012/roles/storageViewer"]
+ : bucket: test
+ condition: []
+ role: organizations/123456789012/roles/storageViewer
+ ? module.branch-network-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-network-sa.google_service_account.service_account[0]:
+ account_id: fast2-prod-resman-net-0
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform resman networking service account.
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-network-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ module.branch-network-sa.google_storage_bucket_iam_member.bucket-roles["test-roles/storage.objectAdmin"]:
+ bucket: test
+ condition: []
+ role: roles/storage.objectAdmin
+ module.branch-pf-dev-gcs.google_storage_bucket.bucket:
+ autoclass: []
+ cors: []
+ custom_placement_config: []
+ default_event_based_hold: null
+ enable_object_retention: null
+ encryption: []
+ force_destroy: false
+ labels: null
+ lifecycle_rule: []
+ location: EU
+ logging: []
+ name: fast2-dev-resman-pf-0
+ project: fast-prod-automation
+ requester_pays: null
+ retention_policy: []
+ storage_class: STANDARD
+ timeouts: null
+ uniform_bucket_level_access: true
+ versioning:
+ - enabled: true
+ module.branch-pf-dev-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectAdmin"]:
+ bucket: fast2-dev-resman-pf-0
+ condition: []
+ members:
+ - serviceAccount:fast2-dev-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectAdmin
+ module.branch-pf-dev-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectViewer"]:
+ bucket: fast2-dev-resman-pf-0
+ condition: []
+ members:
+ - serviceAccount:fast2-dev-resman-pf-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectViewer
+ ? module.branch-pf-dev-r-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-pf-dev-r-sa.google_service_account.service_account[0]:
+ account_id: fast2-dev-resman-pf-0r
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform project factory development service account (read-only).
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-pf-dev-r-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ ? module.branch-pf-dev-r-sa.google_storage_bucket_iam_member.bucket-roles["test-organizations/123456789012/roles/storageViewer"]
+ : bucket: test
+ condition: []
+ role: organizations/123456789012/roles/storageViewer
+ ? module.branch-pf-dev-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-pf-dev-sa.google_service_account.service_account[0]:
+ account_id: fast2-dev-resman-pf-0
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform project factory development service account.
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-pf-dev-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ module.branch-pf-dev-sa.google_storage_bucket_iam_member.bucket-roles["test-roles/storage.objectAdmin"]:
+ bucket: test
+ condition: []
+ role: roles/storage.objectAdmin
+ module.branch-pf-gcs.google_storage_bucket.bucket:
+ autoclass: []
+ cors: []
+ custom_placement_config: []
+ default_event_based_hold: null
+ enable_object_retention: null
+ encryption: []
+ force_destroy: false
+ labels: null
+ lifecycle_rule: []
+ location: EU
+ logging: []
+ name: fast2-resman-pf-0
+ project: fast-prod-automation
+ requester_pays: null
+ retention_policy: []
+ storage_class: STANDARD
+ timeouts: null
+ uniform_bucket_level_access: true
+ versioning:
+ - enabled: true
+ module.branch-pf-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectAdmin"]:
+ bucket: fast2-resman-pf-0
+ condition: []
+ members:
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectAdmin
+ module.branch-pf-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectViewer"]:
+ bucket: fast2-resman-pf-0
+ condition: []
+ members:
+ - serviceAccount:fast2-resman-pf-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectViewer
+ module.branch-pf-prod-gcs.google_storage_bucket.bucket:
+ autoclass: []
+ cors: []
+ custom_placement_config: []
+ default_event_based_hold: null
+ enable_object_retention: null
+ encryption: []
+ force_destroy: false
+ labels: null
+ lifecycle_rule: []
+ location: EU
+ logging: []
+ name: fast2-prod-resman-pf-0
+ project: fast-prod-automation
+ requester_pays: null
+ retention_policy: []
+ storage_class: STANDARD
+ timeouts: null
+ uniform_bucket_level_access: true
+ versioning:
+ - enabled: true
+ module.branch-pf-prod-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectAdmin"]:
+ bucket: fast2-prod-resman-pf-0
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectAdmin
+ module.branch-pf-prod-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectViewer"]:
+ bucket: fast2-prod-resman-pf-0
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-pf-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectViewer
+ ? module.branch-pf-prod-r-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-pf-prod-r-sa.google_service_account.service_account[0]:
+ account_id: fast2-prod-resman-pf-0r
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform project factory production service account (read-only).
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-pf-prod-r-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ ? module.branch-pf-prod-r-sa.google_storage_bucket_iam_member.bucket-roles["test-organizations/123456789012/roles/storageViewer"]
+ : bucket: test
+ condition: []
+ role: organizations/123456789012/roles/storageViewer
+ ? module.branch-pf-prod-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-pf-prod-sa.google_service_account.service_account[0]:
+ account_id: fast2-prod-resman-pf-0
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform project factory production service account.
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-pf-prod-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ module.branch-pf-prod-sa.google_storage_bucket_iam_member.bucket-roles["test-roles/storage.objectAdmin"]:
+ bucket: test
+ condition: []
+ role: roles/storage.objectAdmin
+ ? module.branch-pf-r-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-pf-r-sa.google_service_account.service_account[0]:
+ account_id: fast2-resman-pf-0r
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform project factory main service account (read-only).
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-pf-r-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ module.branch-pf-r-sa.google_storage_bucket_iam_member.bucket-roles["test-organizations/123456789012/roles/storageViewer"]:
+ bucket: test
+ condition: []
+ role: organizations/123456789012/roles/storageViewer
+ ? module.branch-pf-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-pf-sa.google_service_account.service_account[0]:
+ account_id: fast2-resman-pf-0
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform project factory main service account.
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-pf-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ module.branch-pf-sa.google_storage_bucket_iam_member.bucket-roles["test-roles/storage.objectAdmin"]:
+ bucket: test
+ condition: []
+ role: roles/storage.objectAdmin
+ module.branch-security-folder.google_folder.folder[0]:
+ display_name: Security
+ parent: organizations/123456789012
+ timeouts: null
+ module.branch-security-folder.google_folder_iam_binding.authoritative["roles/editor"]:
+ condition: []
+ members:
+ - group:gcp-security-admins@fast.example.com
+ role: roles/editor
+ module.branch-security-folder.google_folder_iam_binding.authoritative["roles/logging.admin"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/logging.admin
+ module.branch-security-folder.google_folder_iam_binding.authoritative["roles/owner"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/owner
+ module.branch-security-folder.google_folder_iam_binding.authoritative["roles/resourcemanager.folderAdmin"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.folderAdmin
+ module.branch-security-folder.google_folder_iam_binding.authoritative["roles/resourcemanager.folderViewer"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.folderViewer
+ module.branch-security-folder.google_folder_iam_binding.authoritative["roles/resourcemanager.projectCreator"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.projectCreator
+ module.branch-security-folder.google_folder_iam_binding.authoritative["roles/viewer"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/viewer
+ module.branch-security-folder.google_folder_iam_binding.bindings["tenant_iam_admin_conditional"]:
+ condition:
+ - description: Certificate Authority Service delegated grants.
+ expression: api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly(['roles/privateca.certificateManager'])
+ title: security_sa_delegated_grants
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.folderIamAdmin
+ module.branch-security-folder.google_tags_tag_binding.binding["context"]:
+ timeouts: null
+ module.branch-security-gcs.google_storage_bucket.bucket:
+ autoclass: []
+ cors: []
+ custom_placement_config: []
+ default_event_based_hold: null
+ enable_object_retention: null
+ encryption: []
+ force_destroy: false
+ labels: null
+ lifecycle_rule: []
+ location: EU
+ logging: []
+ name: fast2-prod-resman-sec-0
+ project: fast-prod-automation
+ requester_pays: null
+ retention_policy: []
+ storage_class: STANDARD
+ timeouts: null
+ uniform_bucket_level_access: true
+ versioning:
+ - enabled: true
+ module.branch-security-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectAdmin"]:
+ bucket: fast2-prod-resman-sec-0
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectAdmin
+ module.branch-security-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectViewer"]:
+ bucket: fast2-prod-resman-sec-0
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectViewer
+ ? module.branch-security-r-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-security-r-sa.google_service_account.service_account[0]:
+ account_id: fast2-prod-resman-sec-0r
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform resman security service account (read-only).
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-security-r-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ ? module.branch-security-r-sa.google_storage_bucket_iam_member.bucket-roles["test-organizations/123456789012/roles/storageViewer"]
+ : bucket: test
+ condition: []
+ role: organizations/123456789012/roles/storageViewer
+ ? module.branch-security-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-security-sa.google_service_account.service_account[0]:
+ account_id: fast2-prod-resman-sec-0
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform resman security service account.
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-security-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ module.branch-security-sa.google_storage_bucket_iam_member.bucket-roles["test-roles/storage.objectAdmin"]:
+ bucket: test
+ condition: []
+ role: roles/storage.objectAdmin
module.checklist-folder-1["Common"].google_folder.folder[0]:
display_name: Common
parent: organizations/123456789012
@@ -413,10 +1078,194 @@ values:
module.checklist-folder-3["Department 3/Team 4/Production"].google_folder.folder[0]:
display_name: Production
timeouts: null
+ module.organization[0].google_organization_iam_member.bindings["sa_net_billing"]:
+ condition: []
+ member: serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.user
+ module.organization[0].google_organization_iam_member.bindings["sa_net_fw_policy_admin"]:
+ condition: []
+ member: serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/compute.orgFirewallPolicyAdmin
+ module.organization[0].google_organization_iam_member.bindings["sa_net_xpn_admin"]:
+ condition: []
+ member: serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/compute.xpnAdmin
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_billing"]:
+ condition: []
+ member: serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.user
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_conditional_org_policy"]:
+ condition:
+ - description: Org policy tag scoped grant for project factory main.
+ expression: 'resource.matchTag(''123456789012/context'', ''project-factory'')
+
+ '
+ title: org_policy_tag_pf_scoped
+ member: serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/orgpolicy.policyAdmin
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_costs_manager"]:
+ condition: []
+ member: serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.costsManager
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_dev_billing"]:
+ condition: []
+ member: serviceAccount:fast2-dev-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.user
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_dev_conditional_org_policy"]:
+ condition:
+ - description: Org policy tag scoped grant for project factory dev.
+ expression: 'resource.matchTag(''123456789012/context'', ''project-factory'')
+
+ &&
+
+ resource.matchTag(''123456789012/environment'', ''development'')
+
+ '
+ title: org_policy_tag_pf_scoped_dev
+ member: serviceAccount:fast2-dev-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/orgpolicy.policyAdmin
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_dev_costs_manager"]:
+ condition: []
+ member: serviceAccount:fast2-dev-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.costsManager
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_prod_billing"]:
+ condition: []
+ member: serviceAccount:fast2-prod-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.user
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_prod_conditional_org_policy"]:
+ condition:
+ - description: Org policy tag scoped grant for project factory prod.
+ expression: 'resource.matchTag(''123456789012/context'', ''project-factory'')
+
+ &&
+
+ resource.matchTag(''123456789012/environment'', ''production'')
+
+ '
+ title: org_policy_tag_pf_scoped_prod
+ member: serviceAccount:fast2-prod-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/orgpolicy.policyAdmin
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_prod_costs_manager"]:
+ condition: []
+ member: serviceAccount:fast2-prod-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.costsManager
+ module.organization[0].google_organization_iam_member.bindings["sa_sec_asset_viewer"]:
+ condition: []
+ member: serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/cloudasset.viewer
+ module.organization[0].google_organization_iam_member.bindings["sa_sec_billing"]:
+ condition: []
+ member: serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.user
+ module.organization[0].google_tags_tag_key.default["context"]:
+ description: Resource management context.
+ parent: organizations/123456789012
+ purpose: null
+ purpose_data: null
+ short_name: context
+ timeouts: null
+ module.organization[0].google_tags_tag_key.default["environment"]:
+ description: Environment definition.
+ parent: organizations/123456789012
+ purpose: null
+ purpose_data: null
+ short_name: environment
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["context/data"]:
+ description: Managed by the Terraform organization module.
+ short_name: data
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["context/gcve"]:
+ description: Managed by the Terraform organization module.
+ short_name: gcve
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["context/gke"]:
+ description: Managed by the Terraform organization module.
+ short_name: gke
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["context/networking"]:
+ description: Managed by the Terraform organization module.
+ short_name: networking
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["context/project-factory"]:
+ description: Managed by the Terraform organization module.
+ short_name: project-factory
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["context/sandbox"]:
+ description: Managed by the Terraform organization module.
+ short_name: sandbox
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["context/security"]:
+ description: Managed by the Terraform organization module.
+ short_name: security
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["environment/development"]:
+ description: Managed by the Terraform organization module.
+ short_name: development
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["environment/production"]:
+ description: Managed by the Terraform organization module.
+ short_name: production
+ timeouts: null
+ module.organization[0].google_tags_tag_value_iam_binding.bindings["environment/development:pf"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.tagUser
+ module.organization[0].google_tags_tag_value_iam_binding.bindings["environment/production:pf"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.tagUser
+ module.top-level-folder["teams"].google_folder.folder[0]:
+ display_name: Teams
+ parent: organizations/123456789012
+ timeouts: null
+ ? module.top-level-folder["teams"].google_folder_iam_binding.authoritative["organizations/123456789012/roles/xpnServiceAdmin"]
+ : condition: []
+ members:
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: organizations/123456789012/roles/xpnServiceAdmin
+ module.top-level-folder["teams"].google_folder_iam_binding.authoritative["roles/owner"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/owner
+ module.top-level-folder["teams"].google_folder_iam_binding.authoritative["roles/resourcemanager.folderAdmin"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.folderAdmin
+ module.top-level-folder["teams"].google_folder_iam_binding.authoritative["roles/resourcemanager.projectCreator"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.projectCreator
+ module.top-level-folder["teams"].google_folder_iam_binding.authoritative["roles/resourcemanager.tagUser"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.tagUser
+ module.top-level-folder["teams"].google_tags_tag_binding.binding["context"]:
+ timeouts: null
counts:
google_folder: 57
- google_folder_iam_binding: 74
+ google_folder_iam_binding: 75
google_organization_iam_member: 14
google_project_iam_member: 10
google_service_account: 10
@@ -430,4 +1279,4 @@ counts:
google_tags_tag_value: 9
google_tags_tag_value_iam_binding: 2
modules: 73
- resources: 229
+ resources: 230
diff --git a/tests/fast/stages/s1_resman/simple.tfvars b/tests/fast/stages/s1_resman/simple.tfvars
index 046f45fdf..5a999ff8c 100644
--- a/tests/fast/stages/s1_resman/simple.tfvars
+++ b/tests/fast/stages/s1_resman/simple.tfvars
@@ -13,14 +13,13 @@ billing_account = {
}
custom_roles = {
# organization_iam_admin = "organizations/123456789012/roles/organizationIamAdmin",
- gcve_network_admin = "organizations/123456789012/roles/gcveNetworkAdmin"
- network_firewall_policies_admin = "organizations/123456789012/roles/networkFirewallPoliciesAdmin"
- network_firewall_policies_viewer = "organizations/123456789012/roles/networkFirewallPoliciesViewer"
- ngfw_enterprise_admin = "organizations/123456789012/roles/ngfwEnterpriseAdmin"
- ngfw_enterprise_viewer = "organizations/123456789012/roles/ngfwEnterpriseViewer"
- organization_admin_viewer = "organizations/123456789012/roles/organizationAdminViewer"
- service_project_network_admin = "organizations/123456789012/roles/xpnServiceAdmin"
- storage_viewer = "organizations/123456789012/roles/storageViewer"
+ gcve_network_admin = "organizations/123456789012/roles/gcveNetworkAdmin"
+ network_firewall_policies_admin = "organizations/123456789012/roles/networkFirewallPoliciesAdmin"
+ ngfw_enterprise_admin = "organizations/123456789012/roles/ngfwEnterpriseAdmin"
+ ngfw_enterprise_viewer = "organizations/123456789012/roles/ngfwEnterpriseViewer"
+ organization_admin_viewer = "organizations/123456789012/roles/organizationAdminViewer"
+ service_project_network_admin = "organizations/123456789012/roles/xpnServiceAdmin"
+ storage_viewer = "organizations/123456789012/roles/storageViewer"
}
groups = {
gcp-billing-admins = "gcp-billing-admins",
diff --git a/tests/fast/stages/s1_resman/simple.yaml b/tests/fast/stages/s1_resman/simple.yaml
index 6a2bd8830..8c019e5d0 100644
--- a/tests/fast/stages/s1_resman/simple.yaml
+++ b/tests/fast/stages/s1_resman/simple.yaml
@@ -13,6 +13,836 @@
# limitations under the License.
values:
+ google_storage_bucket_object.providers["2-networking"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-networking-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-networking-r"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-networking-r-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-project-factory"]:
+ bucket: test
+ cache_control: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-project-factory-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-project-factory-dev"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-project-factory-dev-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-project-factory-dev-r"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-project-factory-dev-r-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-project-factory-prod"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-project-factory-prod-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-project-factory-prod-r"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-project-factory-prod-r-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-project-factory-r"]:
+ bucket: test
+ cache_control: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-project-factory-r-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-security"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-security-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.providers["2-security-r"]:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: providers/2-security-r-providers.tf
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ google_storage_bucket_object.tfvars:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: tfvars/1-resman.auto.tfvars.json
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ module.branch-network-dev-folder.google_folder.folder[0]:
+ display_name: Development
+ timeouts: null
+ ? module.branch-network-dev-folder.google_folder_iam_binding.authoritative["organizations/123456789012/roles/gcveNetworkAdmin"]
+ : condition: []
+ members: null
+ role: organizations/123456789012/roles/gcveNetworkAdmin
+ ? module.branch-network-dev-folder.google_folder_iam_binding.authoritative["organizations/123456789012/roles/xpnServiceAdmin"]
+ : condition: []
+ members:
+ - serviceAccount:fast2-dev-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: organizations/123456789012/roles/xpnServiceAdmin
+ module.branch-network-dev-folder.google_folder_iam_binding.authoritative["roles/compute.networkViewer"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-dev-resman-pf-0r@fast-prod-automation.iam.gserviceaccount.com
+ - serviceAccount:fast2-resman-pf-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/compute.networkViewer
+ module.branch-network-dev-folder.google_tags_tag_binding.binding["environment"]:
+ timeouts: null
+ module.branch-network-folder.google_folder.folder[0]:
+ display_name: Networking
+ parent: organizations/123456789012
+ timeouts: null
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/browser"]:
+ condition: []
+ members:
+ - user:extra-browser@fast.example.com
+ role: roles/browser
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/compute.xpnAdmin"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/compute.xpnAdmin
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/editor"]:
+ condition: []
+ members:
+ - group:gcp-vpc-network-admins@fast.example.com
+ role: roles/editor
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/logging.admin"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/logging.admin
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/owner"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ - user:extra-owner@fast.example.com
+ role: roles/owner
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/resourcemanager.folderAdmin"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.folderAdmin
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/resourcemanager.folderViewer"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.folderViewer
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/resourcemanager.projectCreator"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.projectCreator
+ module.branch-network-folder.google_folder_iam_binding.authoritative["roles/viewer"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/viewer
+ module.branch-network-folder.google_tags_tag_binding.binding["context"]:
+ timeouts: null
+ module.branch-network-gcs.google_storage_bucket.bucket:
+ autoclass: []
+ cors: []
+ custom_placement_config: []
+ default_event_based_hold: null
+ enable_object_retention: null
+ encryption: []
+ force_destroy: false
+ labels: null
+ lifecycle_rule: []
+ location: EU
+ logging: []
+ name: fast2-prod-resman-net-0
+ project: fast-prod-automation
+ requester_pays: null
+ retention_policy: []
+ storage_class: STANDARD
+ timeouts: null
+ uniform_bucket_level_access: true
+ versioning:
+ - enabled: true
+ module.branch-network-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectAdmin"]:
+ bucket: fast2-prod-resman-net-0
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectAdmin
+ module.branch-network-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectViewer"]:
+ bucket: fast2-prod-resman-net-0
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-net-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectViewer
+ module.branch-network-prod-folder.google_folder.folder[0]:
+ display_name: Production
+ timeouts: null
+ ? module.branch-network-prod-folder.google_folder_iam_binding.authoritative["organizations/123456789012/roles/gcveNetworkAdmin"]
+ : condition: []
+ members: null
+ role: organizations/123456789012/roles/gcveNetworkAdmin
+ ? module.branch-network-prod-folder.google_folder_iam_binding.authoritative["organizations/123456789012/roles/xpnServiceAdmin"]
+ : condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: organizations/123456789012/roles/xpnServiceAdmin
+ module.branch-network-prod-folder.google_folder_iam_binding.authoritative["roles/compute.networkViewer"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-pf-0r@fast-prod-automation.iam.gserviceaccount.com
+ - serviceAccount:fast2-resman-pf-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/compute.networkViewer
+ module.branch-network-prod-folder.google_tags_tag_binding.binding["environment"]:
+ timeouts: null
+ ? module.branch-network-r-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-network-r-sa.google_service_account.service_account[0]:
+ account_id: fast2-prod-resman-net-0r
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform resman networking service account (read-only).
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-network-r-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ ? module.branch-network-r-sa.google_storage_bucket_iam_member.bucket-roles["test-organizations/123456789012/roles/storageViewer"]
+ : bucket: test
+ condition: []
+ role: organizations/123456789012/roles/storageViewer
+ ? module.branch-network-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-network-sa.google_service_account.service_account[0]:
+ account_id: fast2-prod-resman-net-0
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform resman networking service account.
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-network-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ module.branch-network-sa.google_storage_bucket_iam_member.bucket-roles["test-roles/storage.objectAdmin"]:
+ bucket: test
+ condition: []
+ role: roles/storage.objectAdmin
+ module.branch-pf-dev-gcs.google_storage_bucket.bucket:
+ autoclass: []
+ cors: []
+ custom_placement_config: []
+ default_event_based_hold: null
+ enable_object_retention: null
+ encryption: []
+ force_destroy: false
+ labels: null
+ lifecycle_rule: []
+ location: EU
+ logging: []
+ name: fast2-dev-resman-pf-0
+ project: fast-prod-automation
+ requester_pays: null
+ retention_policy: []
+ storage_class: STANDARD
+ timeouts: null
+ uniform_bucket_level_access: true
+ versioning:
+ - enabled: true
+ module.branch-pf-dev-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectAdmin"]:
+ bucket: fast2-dev-resman-pf-0
+ condition: []
+ members:
+ - serviceAccount:fast2-dev-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectAdmin
+ module.branch-pf-dev-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectViewer"]:
+ bucket: fast2-dev-resman-pf-0
+ condition: []
+ members:
+ - serviceAccount:fast2-dev-resman-pf-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectViewer
+ ? module.branch-pf-dev-r-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-pf-dev-r-sa.google_service_account.service_account[0]:
+ account_id: fast2-dev-resman-pf-0r
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform project factory development service account (read-only).
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-pf-dev-r-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ ? module.branch-pf-dev-r-sa.google_storage_bucket_iam_member.bucket-roles["test-organizations/123456789012/roles/storageViewer"]
+ : bucket: test
+ condition: []
+ role: organizations/123456789012/roles/storageViewer
+ ? module.branch-pf-dev-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-pf-dev-sa.google_service_account.service_account[0]:
+ account_id: fast2-dev-resman-pf-0
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform project factory development service account.
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-pf-dev-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ module.branch-pf-dev-sa.google_storage_bucket_iam_member.bucket-roles["test-roles/storage.objectAdmin"]:
+ bucket: test
+ condition: []
+ role: roles/storage.objectAdmin
+ module.branch-pf-gcs.google_storage_bucket.bucket:
+ autoclass: []
+ cors: []
+ custom_placement_config: []
+ default_event_based_hold: null
+ enable_object_retention: null
+ encryption: []
+ force_destroy: false
+ labels: null
+ lifecycle_rule: []
+ location: EU
+ logging: []
+ name: fast2-resman-pf-0
+ project: fast-prod-automation
+ requester_pays: null
+ retention_policy: []
+ storage_class: STANDARD
+ timeouts: null
+ uniform_bucket_level_access: true
+ versioning:
+ - enabled: true
+ module.branch-pf-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectAdmin"]:
+ bucket: fast2-resman-pf-0
+ condition: []
+ members:
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectAdmin
+ module.branch-pf-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectViewer"]:
+ bucket: fast2-resman-pf-0
+ condition: []
+ members:
+ - serviceAccount:fast2-resman-pf-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectViewer
+ module.branch-pf-prod-gcs.google_storage_bucket.bucket:
+ autoclass: []
+ cors: []
+ custom_placement_config: []
+ default_event_based_hold: null
+ enable_object_retention: null
+ encryption: []
+ force_destroy: false
+ labels: null
+ lifecycle_rule: []
+ location: EU
+ logging: []
+ name: fast2-prod-resman-pf-0
+ project: fast-prod-automation
+ requester_pays: null
+ retention_policy: []
+ storage_class: STANDARD
+ timeouts: null
+ uniform_bucket_level_access: true
+ versioning:
+ - enabled: true
+ module.branch-pf-prod-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectAdmin"]:
+ bucket: fast2-prod-resman-pf-0
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectAdmin
+ module.branch-pf-prod-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectViewer"]:
+ bucket: fast2-prod-resman-pf-0
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-pf-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectViewer
+ ? module.branch-pf-prod-r-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-pf-prod-r-sa.google_service_account.service_account[0]:
+ account_id: fast2-prod-resman-pf-0r
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform project factory production service account (read-only).
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-pf-prod-r-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ ? module.branch-pf-prod-r-sa.google_storage_bucket_iam_member.bucket-roles["test-organizations/123456789012/roles/storageViewer"]
+ : bucket: test
+ condition: []
+ role: organizations/123456789012/roles/storageViewer
+ ? module.branch-pf-prod-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-pf-prod-sa.google_service_account.service_account[0]:
+ account_id: fast2-prod-resman-pf-0
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform project factory production service account.
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-pf-prod-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ module.branch-pf-prod-sa.google_storage_bucket_iam_member.bucket-roles["test-roles/storage.objectAdmin"]:
+ bucket: test
+ condition: []
+ role: roles/storage.objectAdmin
+ ? module.branch-pf-r-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-pf-r-sa.google_service_account.service_account[0]:
+ account_id: fast2-resman-pf-0r
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform project factory main service account (read-only).
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-pf-r-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ module.branch-pf-r-sa.google_storage_bucket_iam_member.bucket-roles["test-organizations/123456789012/roles/storageViewer"]:
+ bucket: test
+ condition: []
+ role: organizations/123456789012/roles/storageViewer
+ ? module.branch-pf-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-pf-sa.google_service_account.service_account[0]:
+ account_id: fast2-resman-pf-0
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform project factory main service account.
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-pf-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ module.branch-pf-sa.google_storage_bucket_iam_member.bucket-roles["test-roles/storage.objectAdmin"]:
+ bucket: test
+ condition: []
+ role: roles/storage.objectAdmin
+ module.branch-security-folder.google_folder.folder[0]:
+ display_name: Security
+ parent: organizations/123456789012
+ timeouts: null
+ module.branch-security-folder.google_folder_iam_binding.authoritative["roles/browser"]:
+ condition: []
+ members:
+ - user:extra-browser@fast.example.com
+ role: roles/browser
+ module.branch-security-folder.google_folder_iam_binding.authoritative["roles/editor"]:
+ condition: []
+ members:
+ - group:gcp-security-admins@fast.example.com
+ role: roles/editor
+ module.branch-security-folder.google_folder_iam_binding.authoritative["roles/logging.admin"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/logging.admin
+ module.branch-security-folder.google_folder_iam_binding.authoritative["roles/owner"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ - user:extra-owner@fast.example.com
+ role: roles/owner
+ module.branch-security-folder.google_folder_iam_binding.authoritative["roles/resourcemanager.folderAdmin"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.folderAdmin
+ module.branch-security-folder.google_folder_iam_binding.authoritative["roles/resourcemanager.folderViewer"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.folderViewer
+ module.branch-security-folder.google_folder_iam_binding.authoritative["roles/resourcemanager.projectCreator"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.projectCreator
+ module.branch-security-folder.google_folder_iam_binding.authoritative["roles/viewer"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/viewer
+ module.branch-security-folder.google_folder_iam_binding.bindings["tenant_iam_admin_conditional"]:
+ condition:
+ - description: Certificate Authority Service delegated grants.
+ expression: api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly(['roles/privateca.certificateManager'])
+ title: security_sa_delegated_grants
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.folderIamAdmin
+ module.branch-security-folder.google_tags_tag_binding.binding["context"]:
+ timeouts: null
+ module.branch-security-gcs.google_storage_bucket.bucket:
+ autoclass: []
+ cors: []
+ custom_placement_config: []
+ default_event_based_hold: null
+ enable_object_retention: null
+ encryption: []
+ force_destroy: false
+ labels: null
+ lifecycle_rule: []
+ location: EU
+ logging: []
+ name: fast2-prod-resman-sec-0
+ project: fast-prod-automation
+ requester_pays: null
+ retention_policy: []
+ storage_class: STANDARD
+ timeouts: null
+ uniform_bucket_level_access: true
+ versioning:
+ - enabled: true
+ module.branch-security-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectAdmin"]:
+ bucket: fast2-prod-resman-sec-0
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectAdmin
+ module.branch-security-gcs.google_storage_bucket_iam_binding.authoritative["roles/storage.objectViewer"]:
+ bucket: fast2-prod-resman-sec-0
+ condition: []
+ members:
+ - serviceAccount:fast2-prod-resman-sec-0r@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/storage.objectViewer
+ ? module.branch-security-r-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-security-r-sa.google_service_account.service_account[0]:
+ account_id: fast2-prod-resman-sec-0r
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform resman security service account (read-only).
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-security-r-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ ? module.branch-security-r-sa.google_storage_bucket_iam_member.bucket-roles["test-organizations/123456789012/roles/storageViewer"]
+ : bucket: test
+ condition: []
+ role: organizations/123456789012/roles/storageViewer
+ ? module.branch-security-sa.google_project_iam_member.project-roles["fast-prod-automation-roles/serviceusage.serviceUsageConsumer"]
+ : condition: []
+ project: fast-prod-automation
+ role: roles/serviceusage.serviceUsageConsumer
+ module.branch-security-sa.google_service_account.service_account[0]:
+ account_id: fast2-prod-resman-sec-0
+ create_ignore_already_exists: null
+ description: null
+ disabled: false
+ display_name: Terraform resman security service account.
+ project: fast-prod-automation
+ timeouts: null
+ module.branch-security-sa.google_service_account_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]:
+ condition: []
+ members: null
+ role: roles/iam.serviceAccountTokenCreator
+ module.branch-security-sa.google_storage_bucket_iam_member.bucket-roles["test-roles/storage.objectAdmin"]:
+ bucket: test
+ condition: []
+ role: roles/storage.objectAdmin
+ module.organization[0].google_organization_iam_member.bindings["sa_net_billing"]:
+ condition: []
+ member: serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.user
+ module.organization[0].google_organization_iam_member.bindings["sa_net_fw_policy_admin"]:
+ condition: []
+ member: serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/compute.orgFirewallPolicyAdmin
+ module.organization[0].google_organization_iam_member.bindings["sa_net_xpn_admin"]:
+ condition: []
+ member: serviceAccount:fast2-prod-resman-net-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/compute.xpnAdmin
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_billing"]:
+ condition: []
+ member: serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.user
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_conditional_org_policy"]:
+ condition:
+ - description: Org policy tag scoped grant for project factory main.
+ expression: 'resource.matchTag(''123456789012/context'', ''project-factory'')
+
+ '
+ title: org_policy_tag_pf_scoped
+ member: serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/orgpolicy.policyAdmin
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_costs_manager"]:
+ condition: []
+ member: serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.costsManager
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_dev_billing"]:
+ condition: []
+ member: serviceAccount:fast2-dev-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.user
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_dev_conditional_org_policy"]:
+ condition:
+ - description: Org policy tag scoped grant for project factory dev.
+ expression: 'resource.matchTag(''123456789012/context'', ''project-factory'')
+
+ &&
+
+ resource.matchTag(''123456789012/environment'', ''development'')
+
+ '
+ title: org_policy_tag_pf_scoped_dev
+ member: serviceAccount:fast2-dev-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/orgpolicy.policyAdmin
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_dev_costs_manager"]:
+ condition: []
+ member: serviceAccount:fast2-dev-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.costsManager
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_prod_billing"]:
+ condition: []
+ member: serviceAccount:fast2-prod-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.user
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_prod_conditional_org_policy"]:
+ condition:
+ - description: Org policy tag scoped grant for project factory prod.
+ expression: 'resource.matchTag(''123456789012/context'', ''project-factory'')
+
+ &&
+
+ resource.matchTag(''123456789012/environment'', ''production'')
+
+ '
+ title: org_policy_tag_pf_scoped_prod
+ member: serviceAccount:fast2-prod-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/orgpolicy.policyAdmin
+ module.organization[0].google_organization_iam_member.bindings["sa_pf_prod_costs_manager"]:
+ condition: []
+ member: serviceAccount:fast2-prod-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.costsManager
+ module.organization[0].google_organization_iam_member.bindings["sa_sec_asset_viewer"]:
+ condition: []
+ member: serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/cloudasset.viewer
+ module.organization[0].google_organization_iam_member.bindings["sa_sec_billing"]:
+ condition: []
+ member: serviceAccount:fast2-prod-resman-sec-0@fast-prod-automation.iam.gserviceaccount.com
+ org_id: '123456789012'
+ role: roles/billing.user
+ module.organization[0].google_tags_tag_key.default["context"]:
+ description: Resource management context.
+ parent: organizations/123456789012
+ purpose: null
+ purpose_data: null
+ short_name: context
+ timeouts: null
+ module.organization[0].google_tags_tag_key.default["environment"]:
+ description: Environment definition.
+ parent: organizations/123456789012
+ purpose: null
+ purpose_data: null
+ short_name: environment
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["context/data"]:
+ description: Managed by the Terraform organization module.
+ short_name: data
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["context/gcve"]:
+ description: Managed by the Terraform organization module.
+ short_name: gcve
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["context/gke"]:
+ description: Managed by the Terraform organization module.
+ short_name: gke
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["context/networking"]:
+ description: Managed by the Terraform organization module.
+ short_name: networking
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["context/project-factory"]:
+ description: Managed by the Terraform organization module.
+ short_name: project-factory
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["context/sandbox"]:
+ description: Managed by the Terraform organization module.
+ short_name: sandbox
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["context/security"]:
+ description: Managed by the Terraform organization module.
+ short_name: security
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["environment/development"]:
+ description: Managed by the Terraform organization module.
+ short_name: development
+ timeouts: null
+ module.organization[0].google_tags_tag_value.default["environment/production"]:
+ description: Managed by the Terraform organization module.
+ short_name: production
+ timeouts: null
+ module.organization[0].google_tags_tag_value_iam_binding.bindings["environment/development:pf"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.tagUser
+ module.organization[0].google_tags_tag_value_iam_binding.bindings["environment/production:pf"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.tagUser
module.top-level-folder["teams"].google_folder.folder[0]:
display_name: Teams
parent: organizations/123456789012
@@ -37,12 +867,17 @@ values:
members:
- serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
role: roles/resourcemanager.projectCreator
+ module.top-level-folder["teams"].google_folder_iam_binding.authoritative["roles/resourcemanager.tagUser"]:
+ condition: []
+ members:
+ - serviceAccount:fast2-resman-pf-0@fast-prod-automation.iam.gserviceaccount.com
+ role: roles/resourcemanager.tagUser
module.top-level-folder["teams"].google_tags_tag_binding.binding["context"]:
timeouts: null
counts:
google_folder: 5
- google_folder_iam_binding: 28
+ google_folder_iam_binding: 29
google_organization_iam_member: 14
google_project_iam_member: 10
google_service_account: 10
@@ -56,4 +891,4 @@ counts:
google_tags_tag_value: 9
google_tags_tag_value_iam_binding: 2
modules: 21
- resources: 131
+ resources: 132
diff --git a/tests/fast/stages/s2_security/simple.tfvars b/tests/fast/stages/s2_security/simple.tfvars
index 8d7dbab28..0dff49037 100644
--- a/tests/fast/stages/s2_security/simple.tfvars
+++ b/tests/fast/stages/s2_security/simple.tfvars
@@ -28,6 +28,8 @@ service_accounts = {
security = "foobar@iam.gserviceaccount.com"
data-platform-dev = "foobar@iam.gserviceaccount.com"
data-platform-prod = "foobar@iam.gserviceaccount.com"
+ nsec = "foobar@iam.gserviceaccount.com"
+ nsec-r = "foobar@iam.gserviceaccount.com"
project-factory = "foobar@iam.gserviceaccount.com"
project-factory-dev = "foobar@iam.gserviceaccount.com"
project-factory-prod = "foobar@iam.gserviceaccount.com"
diff --git a/tests/fast/stages/s2_security/simple.yaml b/tests/fast/stages/s2_security/simple.yaml
index 21d05e8bb..e98ac3805 100644
--- a/tests/fast/stages/s2_security/simple.yaml
+++ b/tests/fast/stages/s2_security/simple.yaml
@@ -12,6 +12,439 @@
# See the License for the specific language governing permissions and
# limitations under the License.
+values:
+ google_storage_bucket_object.tfvars:
+ bucket: test
+ cache_control: null
+ content_disposition: null
+ content_encoding: null
+ content_language: null
+ customer_encryption: []
+ detect_md5hash: different hash
+ event_based_hold: null
+ metadata: null
+ name: tfvars/2-security.auto.tfvars.json
+ retention: []
+ source: null
+ temporary_hold: null
+ timeouts: null
+ module.dev-sec-kms["europe"].google_kms_crypto_key.default["compute"]:
+ effective_labels:
+ service: compute
+ labels:
+ service: compute
+ name: compute
+ purpose: ENCRYPT_DECRYPT
+ rotation_period: 7776000s
+ skip_initial_version_creation: false
+ terraform_labels:
+ service: compute
+ timeouts: null
+ module.dev-sec-kms["europe"].google_kms_crypto_key_iam_binding.authoritative["compute.roles/cloudkms.admin"]:
+ condition: []
+ members:
+ - user:user1@example.com
+ role: roles/cloudkms.admin
+ module.dev-sec-kms["europe"].google_kms_key_ring.default[0]:
+ location: europe
+ name: dev-europe
+ project: fast-dev-sec-core-0
+ timeouts: null
+ module.dev-sec-kms["europe-west1"].google_kms_crypto_key.default["compute"]:
+ effective_labels:
+ service: compute
+ labels:
+ service: compute
+ name: compute
+ purpose: ENCRYPT_DECRYPT
+ rotation_period: 7776000s
+ skip_initial_version_creation: false
+ terraform_labels:
+ service: compute
+ timeouts: null
+ module.dev-sec-kms["europe-west1"].google_kms_crypto_key_iam_binding.authoritative["compute.roles/cloudkms.admin"]:
+ condition: []
+ members:
+ - user:user1@example.com
+ role: roles/cloudkms.admin
+ module.dev-sec-kms["europe-west1"].google_kms_key_ring.default[0]:
+ location: europe-west1
+ name: dev-europe-west1
+ project: fast-dev-sec-core-0
+ timeouts: null
+ module.dev-sec-kms["europe-west3"].google_kms_crypto_key.default["compute"]:
+ effective_labels:
+ service: compute
+ labels:
+ service: compute
+ name: compute
+ purpose: ENCRYPT_DECRYPT
+ rotation_period: 7776000s
+ skip_initial_version_creation: false
+ terraform_labels:
+ service: compute
+ timeouts: null
+ module.dev-sec-kms["europe-west3"].google_kms_crypto_key_iam_binding.authoritative["compute.roles/cloudkms.admin"]:
+ condition: []
+ members:
+ - user:user1@example.com
+ role: roles/cloudkms.admin
+ module.dev-sec-kms["europe-west3"].google_kms_key_ring.default[0]:
+ location: europe-west3
+ name: dev-europe-west3
+ project: fast-dev-sec-core-0
+ timeouts: null
+ module.dev-sec-kms["global"].google_kms_crypto_key.default["compute"]:
+ effective_labels:
+ service: compute
+ labels:
+ service: compute
+ name: compute
+ purpose: ENCRYPT_DECRYPT
+ rotation_period: 7776000s
+ skip_initial_version_creation: false
+ terraform_labels:
+ service: compute
+ timeouts: null
+ module.dev-sec-kms["global"].google_kms_crypto_key_iam_binding.authoritative["compute.roles/cloudkms.admin"]:
+ condition: []
+ members:
+ - user:user1@example.com
+ role: roles/cloudkms.admin
+ module.dev-sec-kms["global"].google_kms_key_ring.default[0]:
+ location: global
+ name: dev-global
+ project: fast-dev-sec-core-0
+ timeouts: null
+ module.dev-sec-project.google_project.project[0]:
+ auto_create_network: false
+ billing_account: 000000-111111-222222
+ deletion_policy: DELETE
+ effective_labels:
+ environment: dev
+ team: security
+ folder_id: null
+ labels:
+ environment: dev
+ team: security
+ name: fast-dev-sec-core-0
+ org_id: null
+ project_id: fast-dev-sec-core-0
+ terraform_labels:
+ environment: dev
+ team: security
+ timeouts: null
+ module.dev-sec-project.google_project_iam_binding.authoritative["roles/cloudkms.viewer"]:
+ condition: []
+ members:
+ - serviceAccount:foobar@iam.gserviceaccount.com
+ project: fast-dev-sec-core-0
+ role: roles/cloudkms.viewer
+ ? module.dev-sec-project.google_project_iam_member.bindings["kms_restricted_admin.serviceAccount:foobar@iam.gserviceaccount.com"]
+ : condition:
+ - description: Automation service account delegated grants.
+ expression: 'api.getAttribute(''iam.googleapis.com/modifiedGrantsByRole'', []).hasOnly([''roles/cloudkms.cryptoKeyEncrypterDecrypter'',''roles/cloudkms.cryptoKeyEncrypterDecrypterViaDelegation''])
+ &&
+
+ resource.type == ''cloudkms.googleapis.com/CryptoKey''
+
+ '
+ title: kms_sa_delegated_grants
+ member: serviceAccount:foobar@iam.gserviceaccount.com
+ project: fast-dev-sec-core-0
+ role: roles/cloudkms.admin
+ module.dev-sec-project.google_project_iam_member.service_agents["certificatemanager"]:
+ condition: []
+ project: fast-dev-sec-core-0
+ role: roles/certificatemanager.serviceAgent
+ module.dev-sec-project.google_project_iam_member.service_agents["cloudkms"]:
+ condition: []
+ project: fast-dev-sec-core-0
+ role: roles/cloudkms.serviceAgent
+ module.dev-sec-project.google_project_iam_member.service_agents["networkmanagement"]:
+ condition: []
+ project: fast-dev-sec-core-0
+ role: roles/networkmanagement.serviceAgent
+ module.dev-sec-project.google_project_service.project_services["certificatemanager.googleapis.com"]:
+ disable_dependent_services: false
+ disable_on_destroy: false
+ project: fast-dev-sec-core-0
+ service: certificatemanager.googleapis.com
+ timeouts: null
+ module.dev-sec-project.google_project_service.project_services["cloudkms.googleapis.com"]:
+ disable_dependent_services: false
+ disable_on_destroy: false
+ project: fast-dev-sec-core-0
+ service: cloudkms.googleapis.com
+ timeouts: null
+ module.dev-sec-project.google_project_service.project_services["networkmanagement.googleapis.com"]:
+ disable_dependent_services: false
+ disable_on_destroy: false
+ project: fast-dev-sec-core-0
+ service: networkmanagement.googleapis.com
+ timeouts: null
+ module.dev-sec-project.google_project_service.project_services["networksecurity.googleapis.com"]:
+ disable_dependent_services: false
+ disable_on_destroy: false
+ project: fast-dev-sec-core-0
+ service: networksecurity.googleapis.com
+ timeouts: null
+ module.dev-sec-project.google_project_service.project_services["privateca.googleapis.com"]:
+ disable_dependent_services: false
+ disable_on_destroy: false
+ project: fast-dev-sec-core-0
+ service: privateca.googleapis.com
+ timeouts: null
+ module.dev-sec-project.google_project_service.project_services["secretmanager.googleapis.com"]:
+ disable_dependent_services: false
+ disable_on_destroy: false
+ project: fast-dev-sec-core-0
+ service: secretmanager.googleapis.com
+ timeouts: null
+ module.dev-sec-project.google_project_service.project_services["stackdriver.googleapis.com"]:
+ disable_dependent_services: false
+ disable_on_destroy: false
+ project: fast-dev-sec-core-0
+ service: stackdriver.googleapis.com
+ timeouts: null
+ module.dev-sec-project.google_project_service_identity.default["certificatemanager.googleapis.com"]:
+ project: fast-dev-sec-core-0
+ service: certificatemanager.googleapis.com
+ timeouts: null
+ module.dev-sec-project.google_project_service_identity.default["cloudkms.googleapis.com"]:
+ project: fast-dev-sec-core-0
+ service: cloudkms.googleapis.com
+ timeouts: null
+ module.dev-sec-project.google_project_service_identity.default["networkmanagement.googleapis.com"]:
+ project: fast-dev-sec-core-0
+ service: networkmanagement.googleapis.com
+ timeouts: null
+ module.dev-sec-project.google_project_service_identity.default["networksecurity.googleapis.com"]:
+ project: fast-dev-sec-core-0
+ service: networksecurity.googleapis.com
+ timeouts: null
+ module.dev-sec-project.google_project_service_identity.default["privateca.googleapis.com"]:
+ project: fast-dev-sec-core-0
+ service: privateca.googleapis.com
+ timeouts: null
+ module.dev-sec-project.google_project_service_identity.default["secretmanager.googleapis.com"]:
+ project: fast-dev-sec-core-0
+ service: secretmanager.googleapis.com
+ timeouts: null
+ module.folder.google_essential_contacts_contact.contact["gcp-security-admins@fast.example.com"]:
+ email: gcp-security-admins@fast.example.com
+ language_tag: en
+ notification_category_subscriptions:
+ - ALL
+ timeouts: null
+ module.folder.google_folder.folder[0]:
+ display_name: Security
+ parent: organizations/123456789012
+ timeouts: null
+ module.prod-sec-kms["europe"].google_kms_crypto_key.default["compute"]:
+ effective_labels:
+ service: compute
+ labels:
+ service: compute
+ name: compute
+ purpose: ENCRYPT_DECRYPT
+ rotation_period: 7776000s
+ skip_initial_version_creation: false
+ terraform_labels:
+ service: compute
+ timeouts: null
+ module.prod-sec-kms["europe"].google_kms_crypto_key_iam_binding.authoritative["compute.roles/cloudkms.admin"]:
+ condition: []
+ members:
+ - user:user1@example.com
+ role: roles/cloudkms.admin
+ module.prod-sec-kms["europe"].google_kms_key_ring.default[0]:
+ location: europe
+ name: prod-europe
+ project: fast-prod-sec-core-0
+ timeouts: null
+ module.prod-sec-kms["europe-west1"].google_kms_crypto_key.default["compute"]:
+ effective_labels:
+ service: compute
+ labels:
+ service: compute
+ name: compute
+ purpose: ENCRYPT_DECRYPT
+ rotation_period: 7776000s
+ skip_initial_version_creation: false
+ terraform_labels:
+ service: compute
+ timeouts: null
+ module.prod-sec-kms["europe-west1"].google_kms_crypto_key_iam_binding.authoritative["compute.roles/cloudkms.admin"]:
+ condition: []
+ members:
+ - user:user1@example.com
+ role: roles/cloudkms.admin
+ module.prod-sec-kms["europe-west1"].google_kms_key_ring.default[0]:
+ location: europe-west1
+ name: prod-europe-west1
+ project: fast-prod-sec-core-0
+ timeouts: null
+ module.prod-sec-kms["europe-west3"].google_kms_crypto_key.default["compute"]:
+ effective_labels:
+ service: compute
+ labels:
+ service: compute
+ name: compute
+ purpose: ENCRYPT_DECRYPT
+ rotation_period: 7776000s
+ skip_initial_version_creation: false
+ terraform_labels:
+ service: compute
+ timeouts: null
+ module.prod-sec-kms["europe-west3"].google_kms_crypto_key_iam_binding.authoritative["compute.roles/cloudkms.admin"]:
+ condition: []
+ members:
+ - user:user1@example.com
+ role: roles/cloudkms.admin
+ module.prod-sec-kms["europe-west3"].google_kms_key_ring.default[0]:
+ location: europe-west3
+ name: prod-europe-west3
+ project: fast-prod-sec-core-0
+ timeouts: null
+ module.prod-sec-kms["global"].google_kms_crypto_key.default["compute"]:
+ effective_labels:
+ service: compute
+ labels:
+ service: compute
+ name: compute
+ purpose: ENCRYPT_DECRYPT
+ rotation_period: 7776000s
+ skip_initial_version_creation: false
+ terraform_labels:
+ service: compute
+ timeouts: null
+ module.prod-sec-kms["global"].google_kms_crypto_key_iam_binding.authoritative["compute.roles/cloudkms.admin"]:
+ condition: []
+ members:
+ - user:user1@example.com
+ role: roles/cloudkms.admin
+ module.prod-sec-kms["global"].google_kms_key_ring.default[0]:
+ location: global
+ name: prod-global
+ project: fast-prod-sec-core-0
+ timeouts: null
+ module.prod-sec-project.google_project.project[0]:
+ auto_create_network: false
+ billing_account: 000000-111111-222222
+ deletion_policy: DELETE
+ effective_labels:
+ environment: prod
+ team: security
+ folder_id: null
+ labels:
+ environment: prod
+ team: security
+ name: fast-prod-sec-core-0
+ org_id: null
+ project_id: fast-prod-sec-core-0
+ terraform_labels:
+ environment: prod
+ team: security
+ timeouts: null
+ module.prod-sec-project.google_project_iam_binding.authoritative["roles/cloudkms.viewer"]:
+ condition: []
+ members:
+ - serviceAccount:foobar@iam.gserviceaccount.com
+ project: fast-prod-sec-core-0
+ role: roles/cloudkms.viewer
+ ? module.prod-sec-project.google_project_iam_member.bindings["kms_restricted_admin.serviceAccount:foobar@iam.gserviceaccount.com"]
+ : condition:
+ - description: Automation service account delegated grants.
+ expression: 'api.getAttribute(''iam.googleapis.com/modifiedGrantsByRole'', []).hasOnly([''roles/cloudkms.cryptoKeyEncrypterDecrypter'',''roles/cloudkms.cryptoKeyEncrypterDecrypterViaDelegation''])
+ &&
+
+ resource.type == ''cloudkms.googleapis.com/CryptoKey''
+
+ '
+ title: kms_sa_delegated_grants
+ member: serviceAccount:foobar@iam.gserviceaccount.com
+ project: fast-prod-sec-core-0
+ role: roles/cloudkms.admin
+ module.prod-sec-project.google_project_iam_member.service_agents["certificatemanager"]:
+ condition: []
+ project: fast-prod-sec-core-0
+ role: roles/certificatemanager.serviceAgent
+ module.prod-sec-project.google_project_iam_member.service_agents["cloudkms"]:
+ condition: []
+ project: fast-prod-sec-core-0
+ role: roles/cloudkms.serviceAgent
+ module.prod-sec-project.google_project_iam_member.service_agents["networkmanagement"]:
+ condition: []
+ project: fast-prod-sec-core-0
+ role: roles/networkmanagement.serviceAgent
+ module.prod-sec-project.google_project_service.project_services["certificatemanager.googleapis.com"]:
+ disable_dependent_services: false
+ disable_on_destroy: false
+ project: fast-prod-sec-core-0
+ service: certificatemanager.googleapis.com
+ timeouts: null
+ module.prod-sec-project.google_project_service.project_services["cloudkms.googleapis.com"]:
+ disable_dependent_services: false
+ disable_on_destroy: false
+ project: fast-prod-sec-core-0
+ service: cloudkms.googleapis.com
+ timeouts: null
+ module.prod-sec-project.google_project_service.project_services["networkmanagement.googleapis.com"]:
+ disable_dependent_services: false
+ disable_on_destroy: false
+ project: fast-prod-sec-core-0
+ service: networkmanagement.googleapis.com
+ timeouts: null
+ module.prod-sec-project.google_project_service.project_services["networksecurity.googleapis.com"]:
+ disable_dependent_services: false
+ disable_on_destroy: false
+ project: fast-prod-sec-core-0
+ service: networksecurity.googleapis.com
+ timeouts: null
+ module.prod-sec-project.google_project_service.project_services["privateca.googleapis.com"]:
+ disable_dependent_services: false
+ disable_on_destroy: false
+ project: fast-prod-sec-core-0
+ service: privateca.googleapis.com
+ timeouts: null
+ module.prod-sec-project.google_project_service.project_services["secretmanager.googleapis.com"]:
+ disable_dependent_services: false
+ disable_on_destroy: false
+ project: fast-prod-sec-core-0
+ service: secretmanager.googleapis.com
+ timeouts: null
+ module.prod-sec-project.google_project_service.project_services["stackdriver.googleapis.com"]:
+ disable_dependent_services: false
+ disable_on_destroy: false
+ project: fast-prod-sec-core-0
+ service: stackdriver.googleapis.com
+ timeouts: null
+ module.prod-sec-project.google_project_service_identity.default["certificatemanager.googleapis.com"]:
+ project: fast-prod-sec-core-0
+ service: certificatemanager.googleapis.com
+ timeouts: null
+ module.prod-sec-project.google_project_service_identity.default["cloudkms.googleapis.com"]:
+ project: fast-prod-sec-core-0
+ service: cloudkms.googleapis.com
+ timeouts: null
+ module.prod-sec-project.google_project_service_identity.default["networkmanagement.googleapis.com"]:
+ project: fast-prod-sec-core-0
+ service: networkmanagement.googleapis.com
+ timeouts: null
+ module.prod-sec-project.google_project_service_identity.default["networksecurity.googleapis.com"]:
+ project: fast-prod-sec-core-0
+ service: networksecurity.googleapis.com
+ timeouts: null
+ module.prod-sec-project.google_project_service_identity.default["privateca.googleapis.com"]:
+ project: fast-prod-sec-core-0
+ service: privateca.googleapis.com
+ timeouts: null
+ module.prod-sec-project.google_project_service_identity.default["secretmanager.googleapis.com"]:
+ project: fast-prod-sec-core-0
+ service: secretmanager.googleapis.com
+ timeouts: null
+
counts:
google_essential_contacts_contact: 1
google_folder: 1
@@ -20,9 +453,24 @@ counts:
google_kms_key_ring: 8
google_project: 2
google_project_iam_binding: 2
- google_project_iam_member: 4
- google_project_service: 6
- google_project_service_identity: 4
+ google_project_iam_member: 8
+ google_project_service: 14
+ google_project_service_identity: 12
google_storage_bucket_object: 1
modules: 11
- resources: 45
+ resources: 65
+
+outputs:
+ cas_configs:
+ dev: {}
+ prod: {}
+ kms_keys: __missing__
+ ngfw_tls_configs:
+ tls_enabled: false
+ tls_ip_ids_by_region:
+ dev: {}
+ prod: {}
+ tfvars: __missing__
+ trust_config_ids:
+ dev: {}
+ prod: {}
diff --git a/fast/stages/0-bootstrap/data/custom-roles/network_firewall_policies_viewer.yaml b/tests/fast/stages/s3_network_security/tftest.yaml
similarity index 71%
rename from fast/stages/0-bootstrap/data/custom-roles/network_firewall_policies_viewer.yaml
rename to tests/fast/stages/s3_network_security/tftest.yaml
index 6f0ab59e9..5f6eafbb3 100644
--- a/fast/stages/0-bootstrap/data/custom-roles/network_firewall_policies_viewer.yaml
+++ b/tests/fast/stages/s3_network_security/tftest.yaml
@@ -12,9 +12,8 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-# yaml-language-server: $schema=../../schemas/custom-role.schema.json
+module: fast/stages/3-network-security/
-name: networkFirewallPoliciesViewer
-includedPermissions:
- - networksecurity.firewallEndpointAssociations.get
- - networksecurity.firewallEndpointAssociations.list
+tests:
+ simple:
+ tls:
diff --git a/tests/fast/stages/s3_network_security/tls.tfvars b/tests/fast/stages/s3_network_security/tls.tfvars
new file mode 100644
index 000000000..72f88d660
--- /dev/null
+++ b/tests/fast/stages/s3_network_security/tls.tfvars
@@ -0,0 +1,40 @@
+billing_account = {
+ id = "000000-111111-222222"
+}
+folder_ids = {
+ networking = "folders/12345678900"
+ networking-dev = "folders/12345678901"
+ networking-prod = "folders/12345678902"
+}
+host_project_ids = {
+ dev-spoke-0 = "dev-project"
+ prod-spoke-0 = "prod-project"
+}
+ngfw_enterprise_config = {
+ endpoint_zones = [
+ "europe-west1-b",
+ "europe-west1-c",
+ "europe-west1-d"
+ ]
+}
+ngfw_tls_configs = {
+ tls_enabled = true
+ tls_ip_ids_by_region = {
+ dev = {
+ europe-west1 = "projects/project1/locations/europe-west1/tlsInspectionPolicies/dev-tls-ip-0"
+ }
+ prod = {
+ europe-west1 = "projects/project1/locations/europe-west1/tlsInspectionPolicies/prod-tls-ip-0"
+ }
+ }
+}
+organization = {
+ domain = "fast.example.com"
+ id = 123456789012
+ customer_id = "C00000000"
+}
+prefix = "fast2"
+vpc_self_links = {
+ dev-spoke-0 = "https://www.googleapis.com/compute/v1/projects/123456789/networks/vpc-1"
+ prod-spoke-0 = "https://www.googleapis.com/compute/v1/projects/123456789/networks/vpc-2"
+}
diff --git a/tests/fast/stages/s3_network_security/tls.yaml b/tests/fast/stages/s3_network_security/tls.yaml
new file mode 100644
index 000000000..83431eac8
--- /dev/null
+++ b/tests/fast/stages/s3_network_security/tls.yaml
@@ -0,0 +1,309 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+values:
+ google_network_security_firewall_endpoint.firewall_endpoint["europe-west1-b"]:
+ billing_project_id: fast2-net-ngfw-0
+ labels: null
+ location: europe-west1-b
+ name: fast2-ngfw-endpoint-europe-west1-b
+ parent: organizations/123456789012
+ timeouts: null
+ google_network_security_firewall_endpoint.firewall_endpoint["europe-west1-c"]:
+ billing_project_id: fast2-net-ngfw-0
+ labels: null
+ location: europe-west1-c
+ name: fast2-ngfw-endpoint-europe-west1-c
+ parent: organizations/123456789012
+ timeouts: null
+ google_network_security_firewall_endpoint.firewall_endpoint["europe-west1-d"]:
+ billing_project_id: fast2-net-ngfw-0
+ labels: null
+ location: europe-west1-d
+ name: fast2-ngfw-endpoint-europe-west1-d
+ parent: organizations/123456789012
+ timeouts: null
+ google_network_security_firewall_endpoint_association.dev_fw_ep_association["europe-west1-b"]:
+ disabled: false
+ labels: null
+ location: europe-west1-b
+ name: fast2-dev-epa-europe-west1-b
+ network: projects/123456789/networks/vpc-1
+ parent: projects/dev-project
+ timeouts: null
+ tls_inspection_policy: projects/project1/locations/europe-west1/tlsInspectionPolicies/dev-tls-ip-0
+ google_network_security_firewall_endpoint_association.dev_fw_ep_association["europe-west1-c"]:
+ disabled: false
+ labels: null
+ location: europe-west1-c
+ name: fast2-dev-epa-europe-west1-c
+ network: projects/123456789/networks/vpc-1
+ parent: projects/dev-project
+ timeouts: null
+ tls_inspection_policy: projects/project1/locations/europe-west1/tlsInspectionPolicies/dev-tls-ip-0
+ google_network_security_firewall_endpoint_association.dev_fw_ep_association["europe-west1-d"]:
+ disabled: false
+ labels: null
+ location: europe-west1-d
+ name: fast2-dev-epa-europe-west1-d
+ network: projects/123456789/networks/vpc-1
+ parent: projects/dev-project
+ timeouts: null
+ tls_inspection_policy: projects/project1/locations/europe-west1/tlsInspectionPolicies/dev-tls-ip-0
+ google_network_security_firewall_endpoint_association.prod_fw_ep_association["europe-west1-b"]:
+ disabled: false
+ labels: null
+ location: europe-west1-b
+ name: fast2-prod-epa-europe-west1-b
+ network: projects/123456789/networks/vpc-2
+ parent: projects/prod-project
+ timeouts: null
+ tls_inspection_policy: projects/project1/locations/europe-west1/tlsInspectionPolicies/prod-tls-ip-0
+ google_network_security_firewall_endpoint_association.prod_fw_ep_association["europe-west1-c"]:
+ disabled: false
+ labels: null
+ location: europe-west1-c
+ name: fast2-prod-epa-europe-west1-c
+ network: projects/123456789/networks/vpc-2
+ parent: projects/prod-project
+ timeouts: null
+ tls_inspection_policy: projects/project1/locations/europe-west1/tlsInspectionPolicies/prod-tls-ip-0
+ google_network_security_firewall_endpoint_association.prod_fw_ep_association["europe-west1-d"]:
+ disabled: false
+ labels: null
+ location: europe-west1-d
+ name: fast2-prod-epa-europe-west1-d
+ network: projects/123456789/networks/vpc-2
+ parent: projects/prod-project
+ timeouts: null
+ tls_inspection_policy: projects/project1/locations/europe-west1/tlsInspectionPolicies/prod-tls-ip-0
+ google_network_security_security_profile.dev_sec_profile:
+ description: null
+ labels: null
+ location: global
+ name: fast2-dev-sp-0
+ parent: organizations/123456789012
+ threat_prevention_profile: []
+ timeouts: null
+ type: THREAT_PREVENTION
+ google_network_security_security_profile.prod_sec_profile:
+ description: null
+ labels: null
+ location: global
+ name: fast2-prod-sp-0
+ parent: organizations/123456789012
+ threat_prevention_profile: []
+ timeouts: null
+ type: THREAT_PREVENTION
+ google_network_security_security_profile_group.dev_sec_profile_group:
+ description: Dev security profile group.
+ labels: null
+ location: global
+ name: fast2-dev-spg-0
+ parent: organizations/123456789012
+ timeouts: null
+ google_network_security_security_profile_group.prod_sec_profile_group:
+ description: prod security profile group.
+ labels: null
+ location: global
+ name: fast2-prod-spg-0
+ parent: organizations/123456789012
+ timeouts: null
+ module.dev-spoke-firewall-policy.google_compute_network_firewall_policy.net-global[0]:
+ description: null
+ name: fast2-dev-fw-policy
+ project: dev-project
+ timeouts: null
+ module.dev-spoke-firewall-policy.google_compute_network_firewall_policy_association.net-global["dev-spoke"]:
+ attachment_target: https://www.googleapis.com/compute/v1/projects/123456789/networks/vpc-1
+ firewall_policy: fast2-dev-fw-policy
+ name: fast2-dev-fw-policy-dev-spoke
+ project: dev-project
+ timeouts: null
+ module.dev-spoke-firewall-policy.google_compute_network_firewall_policy_rule.net-global["egress/egress-allow-rfc1918"]:
+ action: allow
+ description: Allow all hosts to RFC-1918
+ direction: EGRESS
+ disabled: false
+ enable_logging: null
+ firewall_policy: fast2-dev-fw-policy
+ match:
+ - dest_address_groups: null
+ dest_fqdns: null
+ dest_ip_ranges:
+ - 10.0.0.0/8
+ - 172.16.0.0/12
+ - 192.168.0.0/16
+ dest_region_codes: null
+ dest_threat_intelligences: null
+ layer4_configs:
+ - ip_protocol: all
+ ports: null
+ src_address_groups: null
+ src_fqdns: null
+ src_ip_ranges: null
+ src_region_codes: null
+ src_secure_tags: []
+ src_threat_intelligences: null
+ priority: 2147483546
+ project: dev-project
+ rule_name: egress-allow-rfc1918
+ security_profile_group: null
+ target_secure_tags: []
+ target_service_accounts: null
+ timeouts: null
+ tls_inspect: null
+ module.dev-spoke-firewall-policy.google_compute_network_firewall_policy_rule.net-global["egress/egress-inspect-internet"]:
+ action: apply_security_profile_group
+ description: Inspect egress traffic from all dev hosts to Internet
+ direction: EGRESS
+ disabled: false
+ enable_logging: null
+ firewall_policy: fast2-dev-fw-policy
+ match:
+ - dest_address_groups: null
+ dest_fqdns: null
+ dest_ip_ranges:
+ - 0.0.0.0/0
+ dest_region_codes: null
+ dest_threat_intelligences: null
+ layer4_configs:
+ - ip_protocol: all
+ ports: null
+ src_address_groups: null
+ src_fqdns: null
+ src_ip_ranges: null
+ src_region_codes: null
+ src_secure_tags: []
+ src_threat_intelligences: null
+ priority: 2147483547
+ project: dev-project
+ rule_name: egress-inspect-internet
+ target_secure_tags: []
+ target_service_accounts: null
+ timeouts: null
+ tls_inspect: null
+ module.ngfw-quota-project.google_project.project[0]:
+ auto_create_network: false
+ billing_account: 000000-111111-222222
+ deletion_policy: DELETE
+ folder_id: '12345678900'
+ labels: null
+ name: fast2-net-ngfw-0
+ org_id: null
+ project_id: fast2-net-ngfw-0
+ timeouts: null
+ module.ngfw-quota-project.google_project_service.project_services["networksecurity.googleapis.com"]:
+ disable_dependent_services: false
+ disable_on_destroy: false
+ project: fast2-net-ngfw-0
+ service: networksecurity.googleapis.com
+ timeouts: null
+ module.ngfw-quota-project.google_project_service_identity.default["networksecurity.googleapis.com"]:
+ project: fast2-net-ngfw-0
+ service: networksecurity.googleapis.com
+ timeouts: null
+ module.prod-spoke-firewall-policy.google_compute_network_firewall_policy.net-global[0]:
+ description: null
+ name: fast2-prod-fw-policy
+ project: prod-project
+ timeouts: null
+ module.prod-spoke-firewall-policy.google_compute_network_firewall_policy_association.net-global["prod-spoke"]:
+ attachment_target: https://www.googleapis.com/compute/v1/projects/123456789/networks/vpc-2
+ firewall_policy: fast2-prod-fw-policy
+ name: fast2-prod-fw-policy-prod-spoke
+ project: prod-project
+ timeouts: null
+ module.prod-spoke-firewall-policy.google_compute_network_firewall_policy_rule.net-global["egress/egress-allow-rfc1918"]:
+ action: allow
+ description: Allow all hosts to RFC-1918
+ direction: EGRESS
+ disabled: false
+ enable_logging: null
+ firewall_policy: fast2-prod-fw-policy
+ match:
+ - dest_address_groups: null
+ dest_fqdns: null
+ dest_ip_ranges:
+ - 10.0.0.0/8
+ - 172.16.0.0/12
+ - 192.168.0.0/16
+ dest_region_codes: null
+ dest_threat_intelligences: null
+ layer4_configs:
+ - ip_protocol: all
+ ports: null
+ src_address_groups: null
+ src_fqdns: null
+ src_ip_ranges: null
+ src_region_codes: null
+ src_secure_tags: []
+ src_threat_intelligences: null
+ priority: 2147483546
+ project: prod-project
+ rule_name: egress-allow-rfc1918
+ security_profile_group: null
+ target_secure_tags: []
+ target_service_accounts: null
+ timeouts: null
+ tls_inspect: null
+ module.prod-spoke-firewall-policy.google_compute_network_firewall_policy_rule.net-global["egress/egress-inspect-internet"]:
+ action: apply_security_profile_group
+ description: Inspect egress traffic from all prod hosts to Internet
+ direction: EGRESS
+ disabled: false
+ enable_logging: null
+ firewall_policy: fast2-prod-fw-policy
+ match:
+ - dest_address_groups: null
+ dest_fqdns: null
+ dest_ip_ranges:
+ - 0.0.0.0/0
+ dest_region_codes: null
+ dest_threat_intelligences: null
+ layer4_configs:
+ - ip_protocol: all
+ ports: null
+ src_address_groups: null
+ src_fqdns: null
+ src_ip_ranges: null
+ src_region_codes: null
+ src_secure_tags: []
+ src_threat_intelligences: null
+ priority: 2147483547
+ project: prod-project
+ rule_name: egress-inspect-internet
+ target_secure_tags: []
+ target_service_accounts: null
+ timeouts: null
+ tls_inspect: null
+
+counts:
+ google_compute_network_firewall_policy: 2
+ google_compute_network_firewall_policy_association: 2
+ google_compute_network_firewall_policy_rule: 4
+ google_network_security_firewall_endpoint: 3
+ google_network_security_firewall_endpoint_association: 6
+ google_network_security_security_profile: 2
+ google_network_security_security_profile_group: 2
+ google_project: 1
+ google_project_service: 1
+ google_project_service_identity: 1
+ modules: 3
+ resources: 24
+
+outputs:
+ ngfw_enterprise_endpoint_ids: __missing__
+ ngfw_enterprise_endpoints_quota_project: fast2-net-ngfw-0
+