Add support for the Assured Workloads in the project factory (#3666)
* Add support for the Assured Workloads in the project factory * Fix test after requiring organization as a var
This commit is contained in:
lopezvit
@@ -23,6 +23,8 @@ iam_by_principals:
|
||||
- roles/resourcemanager.tagUser
|
||||
- $custom_roles:service_project_network_admin
|
||||
$iam_principals:service_accounts/iac-0/iac-pf-ro:
|
||||
# uncomment if you want to use Assured Workloads
|
||||
# - roles/assuredworkloads.reader
|
||||
- roles/viewer
|
||||
- roles/resourcemanager.folderViewer
|
||||
- roles/resourcemanager.tagViewer
|
||||
|
||||
@@ -92,6 +92,9 @@ iam_by_principals:
|
||||
# uncomment for cooperative VPC-SC configurations
|
||||
# $iam_principals:service_accounts/iac-0/iac-pw-rw:
|
||||
# - roles/accesscontextmanager.policyEditor
|
||||
# uncomment if you want to use Assured Workloads
|
||||
# $iam_principals:service_accounts/iac-0/iac-pf-rw:
|
||||
# - roles/assuredworkloads.editor
|
||||
$iam_principals:service_accounts/iac-0/iac-security-rw:
|
||||
# uncomment for cooperative VPC-SC configurations
|
||||
# - roles/accesscontextmanager.policyEditor
|
||||
|
||||
@@ -47,6 +47,8 @@ iam_by_principals:
|
||||
- roles/serviceusage.serviceUsageConsumer
|
||||
services:
|
||||
- accesscontextmanager.googleapis.com
|
||||
# uncomment if you want to use Assured Workloads
|
||||
# - assuredworkloads.googleapis.com
|
||||
- bigquery.googleapis.com
|
||||
- bigqueryreservation.googleapis.com
|
||||
- bigquerystorage.googleapis.com
|
||||
|
||||
@@ -93,6 +93,9 @@ iam_by_principals:
|
||||
# uncomment for cooperative VPC-SC configurations
|
||||
# $iam_principals:service_accounts/iac-0/iac-pw-rw:
|
||||
# - roles/accesscontextmanager.policyEditor
|
||||
# uncomment if you want to use Assured Workloads
|
||||
# $iam_principals:service_accounts/iac-0/iac-pf-rw:
|
||||
# - roles/assuredworkloads.editor
|
||||
$iam_principals:service_accounts/iac-0/iac-security-rw:
|
||||
# uncomment for cooperative VPC-SC configurations
|
||||
# - roles/accesscontextmanager.policyEditor
|
||||
|
||||
@@ -47,6 +47,8 @@ iam_by_principals:
|
||||
- roles/serviceusage.serviceUsageConsumer
|
||||
services:
|
||||
- accesscontextmanager.googleapis.com
|
||||
# uncomment if you want to use Assured Workloads
|
||||
# - assuredworkloads.googleapis.com
|
||||
- bigquery.googleapis.com
|
||||
- bigqueryreservation.googleapis.com
|
||||
- bigquerystorage.googleapis.com
|
||||
|
||||
@@ -349,6 +349,9 @@
|
||||
"pam_entitlements": {
|
||||
"$ref": "#/$defs/pam_entitlements"
|
||||
},
|
||||
"assured_workload_config": {
|
||||
"$ref": "#/$defs/assured_workload_config"
|
||||
},
|
||||
"parent": {
|
||||
"type": "string",
|
||||
"pattern": "^(?:folders/[0-9]+|organizations/[0-9]+|\\$folder_ids:[a-z0-9_-]+)$"
|
||||
@@ -767,6 +770,95 @@
|
||||
"additionalProperties": false
|
||||
}
|
||||
}
|
||||
},
|
||||
"assured_workload_config": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"compliance_regime": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"ASSURED_WORKLOADS_FOR_PARTNERS",
|
||||
"AU_REGIONS_AND_US_SUPPORT",
|
||||
"CA_PROTECTED_B",
|
||||
"CA_REGIONS_AND_SUPPORT",
|
||||
"CJIS",
|
||||
"COMPLIANCE_REGIME_UNSPECIFIED",
|
||||
"EU_REGIONS_AND_SUPPORT",
|
||||
"FEDRAMP_HIGH",
|
||||
"FEDRAMP_MODERATE",
|
||||
"HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS_US_SUPPORT",
|
||||
"HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS",
|
||||
"HIPAA",
|
||||
"HITRUST",
|
||||
"IL2",
|
||||
"IL4",
|
||||
"IL5",
|
||||
"IRS_1075",
|
||||
"ISR_REGIONS_AND_SUPPORT",
|
||||
"ISR_REGIONS",
|
||||
"ITAR",
|
||||
"JP_REGIONS_AND_SUPPORT",
|
||||
"KSA_REGIONS_AND_SUPPORT_WITH_SOVEREIGNTY_CONTROLS",
|
||||
"REGIONAL_CONTROLS",
|
||||
"US_REGIONAL_ACCESS"
|
||||
]
|
||||
},
|
||||
"display_name": {
|
||||
"type": "string"
|
||||
},
|
||||
"location": {
|
||||
"type": "string"
|
||||
},
|
||||
"organization": {
|
||||
"type": "string"
|
||||
},
|
||||
"enable_sovereign_controls": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"labels": {
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"partner": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"LOCAL_CONTROLS_BY_S3NS",
|
||||
"PARTNER_UNSPECIFIED",
|
||||
"SOVEREIGN_CONTROLS_BY_CNTXT_NO_EKM",
|
||||
"SOVEREIGN_CONTROLS_BY_CNTXT",
|
||||
"SOVEREIGN_CONTROLS_BY_PSN",
|
||||
"SOVEREIGN_CONTROLS_BY_SIA_MINSAIT",
|
||||
"SOVEREIGN_CONTROLS_BY_T_SYSTEMS"
|
||||
]
|
||||
},
|
||||
"partner_permissions": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"assured_workloads_monitoring": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"data_logs_viewer": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"service_access_approver": {
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
"violation_notifications_enabled": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"compliance_regime",
|
||||
"display_name",
|
||||
"location",
|
||||
"organization"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -90,6 +90,7 @@
|
||||
- **location**: *string*
|
||||
- **title**: *string*
|
||||
- **pam_entitlements**: *reference([pam_entitlements](#refs-pam_entitlements))*
|
||||
- **assured_workload_config**: *reference([assured_workload_config](#refs-assured_workload_config))*
|
||||
- **parent**: *string*
|
||||
<br>*pattern: ^(?:folders/[0-9]+|organizations/[0-9]+|\$folder_ids:[a-z0-9_-]+)$*
|
||||
- **tag_bindings**: *object*
|
||||
@@ -227,3 +228,21 @@
|
||||
- items: *string*
|
||||
- **requester_email_recipients**: *array*
|
||||
- items: *string*
|
||||
- **assured_workload_config**<a name="refs-assured_workload_config"></a>: *object*
|
||||
<br>*additional properties: false*
|
||||
- ⁺**compliance_regime**: *string*
|
||||
<br>*enum: ['ASSURED_WORKLOADS_FOR_PARTNERS', 'AU_REGIONS_AND_US_SUPPORT', 'CA_PROTECTED_B', 'CA_REGIONS_AND_SUPPORT', 'CJIS', 'COMPLIANCE_REGIME_UNSPECIFIED', 'EU_REGIONS_AND_SUPPORT', 'FEDRAMP_HIGH', 'FEDRAMP_MODERATE', 'HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS_US_SUPPORT', 'HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS', 'HIPAA', 'HITRUST', 'IL2', 'IL4', 'IL5', 'IRS_1075', 'ISR_REGIONS_AND_SUPPORT', 'ISR_REGIONS', 'ITAR', 'JP_REGIONS_AND_SUPPORT', 'KSA_REGIONS_AND_SUPPORT_WITH_SOVEREIGNTY_CONTROLS', 'REGIONAL_CONTROLS', 'US_REGIONAL_ACCESS']*
|
||||
- ⁺**display_name**: *string*
|
||||
- ⁺**location**: *string*
|
||||
- ⁺**organization**: *string*
|
||||
- **enable_sovereign_controls**: *boolean*
|
||||
- **labels**: *object*
|
||||
*additional properties: String*
|
||||
- **partner**: *string*
|
||||
<br>*enum: ['LOCAL_CONTROLS_BY_S3NS', 'PARTNER_UNSPECIFIED', 'SOVEREIGN_CONTROLS_BY_CNTXT_NO_EKM', 'SOVEREIGN_CONTROLS_BY_CNTXT', 'SOVEREIGN_CONTROLS_BY_PSN', 'SOVEREIGN_CONTROLS_BY_SIA_MINSAIT', 'SOVEREIGN_CONTROLS_BY_T_SYSTEMS']*
|
||||
- **partner_permissions**: *object*
|
||||
<br>*additional properties: false*
|
||||
- **assured_workloads_monitoring**: *boolean*
|
||||
- **data_logs_viewer**: *boolean*
|
||||
- **service_access_approver**: *boolean*
|
||||
- **violation_notifications_enabled**: *boolean*
|
||||
|
||||
@@ -349,6 +349,9 @@
|
||||
"pam_entitlements": {
|
||||
"$ref": "#/$defs/pam_entitlements"
|
||||
},
|
||||
"assured_workload_config": {
|
||||
"$ref": "#/$defs/assured_workload_config"
|
||||
},
|
||||
"parent": {
|
||||
"type": "string",
|
||||
"pattern": "^(?:folders/[0-9]+|organizations/[0-9]+|\\$folder_ids:[a-z0-9_-]+)$"
|
||||
@@ -767,6 +770,95 @@
|
||||
"additionalProperties": false
|
||||
}
|
||||
}
|
||||
},
|
||||
"assured_workload_config": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"compliance_regime": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"ASSURED_WORKLOADS_FOR_PARTNERS",
|
||||
"AU_REGIONS_AND_US_SUPPORT",
|
||||
"CA_PROTECTED_B",
|
||||
"CA_REGIONS_AND_SUPPORT",
|
||||
"CJIS",
|
||||
"COMPLIANCE_REGIME_UNSPECIFIED",
|
||||
"EU_REGIONS_AND_SUPPORT",
|
||||
"FEDRAMP_HIGH",
|
||||
"FEDRAMP_MODERATE",
|
||||
"HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS_US_SUPPORT",
|
||||
"HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS",
|
||||
"HIPAA",
|
||||
"HITRUST",
|
||||
"IL2",
|
||||
"IL4",
|
||||
"IL5",
|
||||
"IRS_1075",
|
||||
"ISR_REGIONS_AND_SUPPORT",
|
||||
"ISR_REGIONS",
|
||||
"ITAR",
|
||||
"JP_REGIONS_AND_SUPPORT",
|
||||
"KSA_REGIONS_AND_SUPPORT_WITH_SOVEREIGNTY_CONTROLS",
|
||||
"REGIONAL_CONTROLS",
|
||||
"US_REGIONAL_ACCESS"
|
||||
]
|
||||
},
|
||||
"display_name": {
|
||||
"type": "string"
|
||||
},
|
||||
"location": {
|
||||
"type": "string"
|
||||
},
|
||||
"organization": {
|
||||
"type": "string"
|
||||
},
|
||||
"enable_sovereign_controls": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"labels": {
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"partner": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"LOCAL_CONTROLS_BY_S3NS",
|
||||
"PARTNER_UNSPECIFIED",
|
||||
"SOVEREIGN_CONTROLS_BY_CNTXT_NO_EKM",
|
||||
"SOVEREIGN_CONTROLS_BY_CNTXT",
|
||||
"SOVEREIGN_CONTROLS_BY_PSN",
|
||||
"SOVEREIGN_CONTROLS_BY_SIA_MINSAIT",
|
||||
"SOVEREIGN_CONTROLS_BY_T_SYSTEMS"
|
||||
]
|
||||
},
|
||||
"partner_permissions": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"assured_workloads_monitoring": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"data_logs_viewer": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"service_access_approver": {
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
"violation_notifications_enabled": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"compliance_regime",
|
||||
"display_name",
|
||||
"location",
|
||||
"organization"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -479,8 +479,9 @@ Pattern-based files make specific assumptions:
|
||||
| name | description | type | required | default | producer |
|
||||
|---|---|:---:|:---:|:---:|:---:|
|
||||
| [automation](variables-fast.tf#L17) | Automation resources created by the bootstrap stage. | <code title="object({ outputs_bucket = string })">object({…})</code> | ✓ | | <code>0-org-setup</code> |
|
||||
| [billing_account](variables-fast.tf#L26) | Billing account id. | <code title="object({ id = string })">object({…})</code> | ✓ | | <code>0-org-setup</code> |
|
||||
| [prefix](variables-fast.tf#L82) | Prefix used for resources that need unique names. Use a maximum of 9 chars for organizations, and 11 chars for tenants. | <code>string</code> | ✓ | | <code>0-org-setup</code> |
|
||||
| [billing_account](variables-fast.tf#L26) | Billing account id. | <code title="object({ id = string })">object({…})</code> | ✓ | | <code>0-globals</code> |
|
||||
| [organization](variables-fast.tf#L74) | Organization details. | <code title="object({ domain = string id = number customer_id = string })">object({…})</code> | ✓ | | <code>0-globals</code> |
|
||||
| [prefix](variables-fast.tf#L92) | Prefix used for resources that need unique names. Use a maximum of 9 chars for organizations, and 11 chars for tenants. | <code>string</code> | ✓ | | <code>0-globals</code> |
|
||||
| [context](variables.tf#L17) | Context-specific interpolations. | <code title="object({ condition_vars = optional(map(map(string)), {}) custom_roles = optional(map(string), {}) email_addresses = optional(map(string), {}) folder_ids = optional(map(string), {}) iam_principals = optional(map(string), {}) kms_keys = optional(map(string), {}) locations = optional(map(string), {}) notification_channels = optional(map(string), {}) project_ids = optional(map(string), {}) tag_values = optional(map(string), {}) vpc_host_projects = optional(map(string), {}) vpc_sc_perimeters = optional(map(string), {}) })">object({…})</code> | | <code>{}</code> | |
|
||||
| [custom_roles](variables-fast.tf#L34) | Custom roles defined at the org level, in key => id format. | <code>map(string)</code> | | <code>{}</code> | <code>0-org-setup</code> |
|
||||
| [data_defaults](variables-projects.tf#L17) | Optional default values used when corresponding project or folder data from files are missing. | <code title="object({ billing_account = optional(string) bucket = optional(object({ force_destroy = optional(bool) }), {}) contacts = optional(map(list(string)), {}) deletion_policy = optional(string) factories_config = optional(object({ custom_roles = optional(string) observability = optional(string) org_policies = optional(string) quotas = optional(string) }), {}) labels = optional(map(string), {}) locations = optional(object({ bigquery = optional(string) logging = optional(string) storage = optional(string) }), {}) logging_data_access = optional(map(object({ ADMIN_READ = optional(object({ exempted_members = optional(list(string)) })), DATA_READ = optional(object({ exempted_members = optional(list(string)) })), DATA_WRITE = optional(object({ exempted_members = optional(list(string)) })) })), {}) metric_scopes = optional(list(string), []) parent = optional(string) prefix = optional(string) project_reuse = optional(object({ use_data_source = optional(bool, true) attributes = optional(object({ name = string number = number services_enabled = optional(list(string), []) })) })) service_accounts = optional(map(object({ display_name = optional(string, "Terraform-managed.") iam_self_roles = optional(list(string)) })), {}) service_encryption_key_ids = optional(map(list(string)), {}) services = optional(list(string), []) shared_vpc_service_config = optional(object({ host_project = string iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) network_users = optional(list(string), []) service_agent_iam = optional(map(list(string)), {}) service_agent_subnet_iam = optional(map(list(string)), {}) service_iam_grants = optional(list(string), []) network_subnet_users = optional(map(list(string)), {}) })) tag_bindings = optional(map(string), {}) universe = optional(object({ prefix = string forced_jit_service_identities = optional(list(string), []) unavailable_service_identities = optional(list(string), []) unavailable_services = optional(list(string), []) })) vpc_sc = optional(object({ perimeter_name = string is_dry_run = optional(bool, false) })) })">object({…})</code> | | <code>{}</code> | |
|
||||
@@ -491,13 +492,13 @@ Pattern-based files make specific assumptions:
|
||||
| [host_project_ids](variables-fast.tf#L58) | Host project for the shared VPC. | <code>map(string)</code> | | <code>{}</code> | <code>2-networking</code> |
|
||||
| [iam_principals](variables-fast.tf#L50) | IAM-format principals. | <code>map(string)</code> | | <code>{}</code> | <code>0-org-setup</code> |
|
||||
| [kms_keys](variables-fast.tf#L66) | KMS key ids. | <code>map(string)</code> | | <code>{}</code> | <code>2-security</code> |
|
||||
| [perimeters](variables-fast.tf#L74) | Optional VPC-SC perimeter ids. | <code>map(string)</code> | | <code>{}</code> | <code>1-vpcsc</code> |
|
||||
| [project_ids](variables-fast.tf#L92) | Projects created in the bootstrap stage. | <code>map(string)</code> | | <code>{}</code> | <code>0-org-setup</code> |
|
||||
| [service_accounts](variables-fast.tf#L100) | Service accounts created in the bootstrap stage. | <code>map(string)</code> | | <code>{}</code> | <code>0-org-setup</code> |
|
||||
| [perimeters](variables-fast.tf#L84) | Optional VPC-SC perimeter ids. | <code>map(string)</code> | | <code>{}</code> | <code>1-vpcsc</code> |
|
||||
| [project_ids](variables-fast.tf#L102) | Projects created in the bootstrap stage. | <code>map(string)</code> | | <code>{}</code> | <code>0-org-setup</code> |
|
||||
| [service_accounts](variables-fast.tf#L110) | Service accounts created in the bootstrap stage. | <code>map(string)</code> | | <code>{}</code> | <code>0-org-setup</code> |
|
||||
| [stage_name](variables.tf#L58) | FAST stage name. Used to separate output files across different factories. | <code>string</code> | | <code>"2-project-factory"</code> | |
|
||||
| [subnet_self_links](variables-fast.tf#L108) | Shared VPC subnet IDs. | <code>map(map(string))</code> | | <code>{}</code> | <code>2-networking</code> |
|
||||
| [tag_values](variables-fast.tf#L116) | FAST-managed resource manager tag values. | <code>map(string)</code> | | <code>{}</code> | <code>0-org-setup</code> |
|
||||
| [universe](variables-fast.tf#L124) | GCP universe where to deploy projects. The prefix will be prepended to the project id. | <code title="object({ domain = string prefix = string forced_jit_service_identities = optional(list(string), []) unavailable_services = optional(list(string), []) unavailable_service_identities = optional(list(string), []) })">object({…})</code> | | <code>null</code> | <code>0-org-setup</code> |
|
||||
| [subnet_self_links](variables-fast.tf#L118) | Shared VPC subnet IDs. | <code>map(map(string))</code> | | <code>{}</code> | <code>2-networking</code> |
|
||||
| [tag_values](variables-fast.tf#L126) | FAST-managed resource manager tag values. | <code>map(string)</code> | | <code>{}</code> | <code>0-org-setup</code> |
|
||||
| [universe](variables-fast.tf#L134) | GCP universe where to deploy projects. The prefix will be prepended to the project id. | <code title="object({ domain = string prefix = string forced_jit_service_identities = optional(list(string), []) unavailable_services = optional(list(string), []) unavailable_service_identities = optional(list(string), []) })">object({…})</code> | | <code>null</code> | <code>0-globals</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -73,6 +73,11 @@ module "factory" {
|
||||
subnet_self_links = {
|
||||
for v in local.subnet_self_links : v.key => v.link
|
||||
}
|
||||
organization = {
|
||||
id = var.organization.id
|
||||
domain = var.organization.domain
|
||||
customer_id = var.organization.customer_id
|
||||
}
|
||||
}, local.context.condition_vars)
|
||||
custom_roles = merge(var.custom_roles, local.context.custom_roles)
|
||||
folder_ids = merge(var.folder_ids, local.context.folder_ids)
|
||||
|
||||
@@ -349,6 +349,9 @@
|
||||
"pam_entitlements": {
|
||||
"$ref": "#/$defs/pam_entitlements"
|
||||
},
|
||||
"assured_workload_config": {
|
||||
"$ref": "#/$defs/assured_workload_config"
|
||||
},
|
||||
"parent": {
|
||||
"type": "string",
|
||||
"pattern": "^(?:folders/[0-9]+|organizations/[0-9]+|\\$folder_ids:[a-z0-9_-]+)$"
|
||||
@@ -767,6 +770,95 @@
|
||||
"additionalProperties": false
|
||||
}
|
||||
}
|
||||
},
|
||||
"assured_workload_config": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"compliance_regime": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"ASSURED_WORKLOADS_FOR_PARTNERS",
|
||||
"AU_REGIONS_AND_US_SUPPORT",
|
||||
"CA_PROTECTED_B",
|
||||
"CA_REGIONS_AND_SUPPORT",
|
||||
"CJIS",
|
||||
"COMPLIANCE_REGIME_UNSPECIFIED",
|
||||
"EU_REGIONS_AND_SUPPORT",
|
||||
"FEDRAMP_HIGH",
|
||||
"FEDRAMP_MODERATE",
|
||||
"HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS_US_SUPPORT",
|
||||
"HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS",
|
||||
"HIPAA",
|
||||
"HITRUST",
|
||||
"IL2",
|
||||
"IL4",
|
||||
"IL5",
|
||||
"IRS_1075",
|
||||
"ISR_REGIONS_AND_SUPPORT",
|
||||
"ISR_REGIONS",
|
||||
"ITAR",
|
||||
"JP_REGIONS_AND_SUPPORT",
|
||||
"KSA_REGIONS_AND_SUPPORT_WITH_SOVEREIGNTY_CONTROLS",
|
||||
"REGIONAL_CONTROLS",
|
||||
"US_REGIONAL_ACCESS"
|
||||
]
|
||||
},
|
||||
"display_name": {
|
||||
"type": "string"
|
||||
},
|
||||
"location": {
|
||||
"type": "string"
|
||||
},
|
||||
"organization": {
|
||||
"type": "string"
|
||||
},
|
||||
"enable_sovereign_controls": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"labels": {
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"partner": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"LOCAL_CONTROLS_BY_S3NS",
|
||||
"PARTNER_UNSPECIFIED",
|
||||
"SOVEREIGN_CONTROLS_BY_CNTXT_NO_EKM",
|
||||
"SOVEREIGN_CONTROLS_BY_CNTXT",
|
||||
"SOVEREIGN_CONTROLS_BY_PSN",
|
||||
"SOVEREIGN_CONTROLS_BY_SIA_MINSAIT",
|
||||
"SOVEREIGN_CONTROLS_BY_T_SYSTEMS"
|
||||
]
|
||||
},
|
||||
"partner_permissions": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"assured_workloads_monitoring": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"data_logs_viewer": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"service_access_approver": {
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
"violation_notifications_enabled": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"compliance_regime",
|
||||
"display_name",
|
||||
"location",
|
||||
"organization"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -90,6 +90,7 @@
|
||||
- **location**: *string*
|
||||
- **title**: *string*
|
||||
- **pam_entitlements**: *reference([pam_entitlements](#refs-pam_entitlements))*
|
||||
- **assured_workload_config**: *reference([assured_workload_config](#refs-assured_workload_config))*
|
||||
- **parent**: *string*
|
||||
<br>*pattern: ^(?:folders/[0-9]+|organizations/[0-9]+|\$folder_ids:[a-z0-9_-]+)$*
|
||||
- **tag_bindings**: *object*
|
||||
@@ -227,3 +228,21 @@
|
||||
- items: *string*
|
||||
- **requester_email_recipients**: *array*
|
||||
- items: *string*
|
||||
- **assured_workload_config**<a name="refs-assured_workload_config"></a>: *object*
|
||||
<br>*additional properties: false*
|
||||
- ⁺**compliance_regime**: *string*
|
||||
<br>*enum: ['ASSURED_WORKLOADS_FOR_PARTNERS', 'AU_REGIONS_AND_US_SUPPORT', 'CA_PROTECTED_B', 'CA_REGIONS_AND_SUPPORT', 'CJIS', 'COMPLIANCE_REGIME_UNSPECIFIED', 'EU_REGIONS_AND_SUPPORT', 'FEDRAMP_HIGH', 'FEDRAMP_MODERATE', 'HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS_US_SUPPORT', 'HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS', 'HIPAA', 'HITRUST', 'IL2', 'IL4', 'IL5', 'IRS_1075', 'ISR_REGIONS_AND_SUPPORT', 'ISR_REGIONS', 'ITAR', 'JP_REGIONS_AND_SUPPORT', 'KSA_REGIONS_AND_SUPPORT_WITH_SOVEREIGNTY_CONTROLS', 'REGIONAL_CONTROLS', 'US_REGIONAL_ACCESS']*
|
||||
- ⁺**display_name**: *string*
|
||||
- ⁺**location**: *string*
|
||||
- ⁺**organization**: *string*
|
||||
- **enable_sovereign_controls**: *boolean*
|
||||
- **labels**: *object*
|
||||
*additional properties: String*
|
||||
- **partner**: *string*
|
||||
<br>*enum: ['LOCAL_CONTROLS_BY_S3NS', 'PARTNER_UNSPECIFIED', 'SOVEREIGN_CONTROLS_BY_CNTXT_NO_EKM', 'SOVEREIGN_CONTROLS_BY_CNTXT', 'SOVEREIGN_CONTROLS_BY_PSN', 'SOVEREIGN_CONTROLS_BY_SIA_MINSAIT', 'SOVEREIGN_CONTROLS_BY_T_SYSTEMS']*
|
||||
- **partner_permissions**: *object*
|
||||
<br>*additional properties: false*
|
||||
- **assured_workloads_monitoring**: *boolean*
|
||||
- **data_logs_viewer**: *boolean*
|
||||
- **service_access_approver**: *boolean*
|
||||
- **violation_notifications_enabled**: *boolean*
|
||||
|
||||
@@ -24,7 +24,7 @@ variable "automation" {
|
||||
}
|
||||
|
||||
variable "billing_account" {
|
||||
# tfdoc:variable:source 0-org-setup
|
||||
# tfdoc:variable:source 0-globals
|
||||
description = "Billing account id."
|
||||
type = object({
|
||||
id = string
|
||||
@@ -71,6 +71,16 @@ variable "kms_keys" {
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "organization" {
|
||||
# tfdoc:variable:source 0-globals
|
||||
description = "Organization details."
|
||||
type = object({
|
||||
domain = string
|
||||
id = number
|
||||
customer_id = string
|
||||
})
|
||||
}
|
||||
|
||||
variable "perimeters" {
|
||||
# tfdoc:variable:source 1-vpcsc
|
||||
description = "Optional VPC-SC perimeter ids."
|
||||
@@ -80,7 +90,7 @@ variable "perimeters" {
|
||||
}
|
||||
|
||||
variable "prefix" {
|
||||
# tfdoc:variable:source 0-org-setup
|
||||
# tfdoc:variable:source 0-globals
|
||||
description = "Prefix used for resources that need unique names. Use a maximum of 9 chars for organizations, and 11 chars for tenants."
|
||||
type = string
|
||||
validation {
|
||||
@@ -122,7 +132,7 @@ variable "tag_values" {
|
||||
}
|
||||
|
||||
variable "universe" {
|
||||
# tfdoc:variable:source 0-org-setup
|
||||
# tfdoc:variable:source 0-globals
|
||||
description = "GCP universe where to deploy projects. The prefix will be prepended to the project id."
|
||||
type = object({
|
||||
domain = string
|
||||
|
||||
@@ -349,6 +349,9 @@
|
||||
"pam_entitlements": {
|
||||
"$ref": "#/$defs/pam_entitlements"
|
||||
},
|
||||
"assured_workload_config": {
|
||||
"$ref": "#/$defs/assured_workload_config"
|
||||
},
|
||||
"parent": {
|
||||
"type": "string",
|
||||
"pattern": "^(?:folders/[0-9]+|organizations/[0-9]+|\\$folder_ids:[a-z0-9_-]+)$"
|
||||
@@ -767,6 +770,95 @@
|
||||
"additionalProperties": false
|
||||
}
|
||||
}
|
||||
},
|
||||
"assured_workload_config": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"compliance_regime": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"ASSURED_WORKLOADS_FOR_PARTNERS",
|
||||
"AU_REGIONS_AND_US_SUPPORT",
|
||||
"CA_PROTECTED_B",
|
||||
"CA_REGIONS_AND_SUPPORT",
|
||||
"CJIS",
|
||||
"COMPLIANCE_REGIME_UNSPECIFIED",
|
||||
"EU_REGIONS_AND_SUPPORT",
|
||||
"FEDRAMP_HIGH",
|
||||
"FEDRAMP_MODERATE",
|
||||
"HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS_US_SUPPORT",
|
||||
"HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS",
|
||||
"HIPAA",
|
||||
"HITRUST",
|
||||
"IL2",
|
||||
"IL4",
|
||||
"IL5",
|
||||
"IRS_1075",
|
||||
"ISR_REGIONS_AND_SUPPORT",
|
||||
"ISR_REGIONS",
|
||||
"ITAR",
|
||||
"JP_REGIONS_AND_SUPPORT",
|
||||
"KSA_REGIONS_AND_SUPPORT_WITH_SOVEREIGNTY_CONTROLS",
|
||||
"REGIONAL_CONTROLS",
|
||||
"US_REGIONAL_ACCESS"
|
||||
]
|
||||
},
|
||||
"display_name": {
|
||||
"type": "string"
|
||||
},
|
||||
"location": {
|
||||
"type": "string"
|
||||
},
|
||||
"organization": {
|
||||
"type": "string"
|
||||
},
|
||||
"enable_sovereign_controls": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"labels": {
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"partner": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"LOCAL_CONTROLS_BY_S3NS",
|
||||
"PARTNER_UNSPECIFIED",
|
||||
"SOVEREIGN_CONTROLS_BY_CNTXT_NO_EKM",
|
||||
"SOVEREIGN_CONTROLS_BY_CNTXT",
|
||||
"SOVEREIGN_CONTROLS_BY_PSN",
|
||||
"SOVEREIGN_CONTROLS_BY_SIA_MINSAIT",
|
||||
"SOVEREIGN_CONTROLS_BY_T_SYSTEMS"
|
||||
]
|
||||
},
|
||||
"partner_permissions": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"assured_workloads_monitoring": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"data_logs_viewer": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"service_access_approver": {
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
"violation_notifications_enabled": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"compliance_regime",
|
||||
"display_name",
|
||||
"location",
|
||||
"organization"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user