|
|
|
|
@@ -19,6 +19,7 @@ This module allows the creation and management of folders, including support for
|
|
|
|
|
- [Custom Security Health Analytics Modules Factory](#custom-security-health-analytics-modules-factory)
|
|
|
|
|
- [Security Command Center Mute Configs](#security-command-center-mute-configs)
|
|
|
|
|
- [Security Command Center Mute Configs Factory](#security-command-center-mute-configs-factory)
|
|
|
|
|
- [Cloud Asset Search](#cloud-asset-search)
|
|
|
|
|
- [Cloud Asset Inventory Feeds](#cloud-asset-inventory-feeds)
|
|
|
|
|
- [Tags](#tags)
|
|
|
|
|
- [Files](#files)
|
|
|
|
|
@@ -617,6 +618,30 @@ muteHighSeverity:
|
|
|
|
|
type: "DYNAMIC"
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## Cloud Asset Search
|
|
|
|
|
|
|
|
|
|
The Cloud Asset Search feature allows you to search for resources within the project using the Cloud Asset Inventory API. This is useful for discovering and auditing resources based on asset types and query filters.
|
|
|
|
|
|
|
|
|
|
```hcl
|
|
|
|
|
module "folder" {
|
|
|
|
|
source = "./fabric/modules/folder"
|
|
|
|
|
billing_account = var.billing_account_id
|
|
|
|
|
id = var.folder_id
|
|
|
|
|
folder_create = false
|
|
|
|
|
asset_search = {
|
|
|
|
|
compute-sas = {
|
|
|
|
|
asset_types = ["iam.googleapis.com/ServiceAccount"]
|
|
|
|
|
query = "name:compute@developer.gserviceaccount.com"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
output "service_accounts" {
|
|
|
|
|
value = module.folder.asset_search_results["copute-sas"]
|
|
|
|
|
}
|
|
|
|
|
# tftest skip
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## Cloud Asset Inventory Feeds
|
|
|
|
|
|
|
|
|
|
Cloud Asset Inventory feeds allow you to monitor asset changes in real-time by publishing notifications to a Pub/Sub topic. Feeds configured at the folder level will monitor all resources within the folder and its subfolders.
|
|
|
|
|
@@ -709,43 +734,45 @@ module "folder" {
|
|
|
|
|
| name | description | type | required | default |
|
|
|
|
|
|---|---|:---:|:---:|:---:|
|
|
|
|
|
| [asset_feeds](variables.tf#L18) | Cloud Asset Inventory feeds. | <code title="map(object({ billing_project = string content_type = optional(string) asset_types = optional(list(string)) asset_names = optional(list(string)) feed_output_config = object({ pubsub_destination = object({ topic = string }) }) condition = optional(object({ expression = string title = optional(string) description = optional(string) location = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
|
| [assured_workload_config](variables.tf#L51) | Create AssuredWorkloads folder instead of regular folder when value is provided. Incompatible with folder_create=false. | <code title="object({ compliance_regime = string display_name = string location = string organization = string enable_sovereign_controls = optional(bool) labels = optional(map(string), {}) partner = optional(string) partner_permissions = optional(object({ assured_workloads_monitoring = optional(bool) data_logs_viewer = optional(bool) service_access_approver = optional(bool) })) violation_notifications_enabled = optional(bool) })">object({…})</code> | | <code>null</code> |
|
|
|
|
|
| [autokey_config](variables.tf#L113) | Enable autokey support for this folder's children. Project accepts either project id or number. | <code title="object({ project = string })">object({…})</code> | | <code>null</code> |
|
|
|
|
|
| [contacts](variables.tf#L122) | List of essential contacts for this resource. Must be in the form EMAIL -> [NOTIFICATION_TYPES]. Valid notification types are ALL, SUSPENSION, SECURITY, TECHNICAL, BILLING, LEGAL, PRODUCT_UPDATES. | <code>map(list(string))</code> | | <code>{}</code> |
|
|
|
|
|
| [context](variables.tf#L141) | Context-specific interpolations. | <code title="object({ bigquery_datasets = optional(map(string), {}) condition_vars = optional(map(map(string)), {}) custom_roles = optional(map(string), {}) email_addresses = optional(map(string), {}) folder_ids = optional(map(string), {}) iam_principals = optional(map(string), {}) log_buckets = optional(map(string), {}) project_ids = optional(map(string), {}) project_numbers = optional(map(string), {}) pubsub_topics = optional(map(string), {}) storage_buckets = optional(map(string), {}) tag_values = optional(map(string), {}) })">object({…})</code> | | <code>{}</code> |
|
|
|
|
|
| [deletion_protection](variables.tf#L161) | Deletion protection setting for this folder. | <code>bool</code> | | <code>false</code> |
|
|
|
|
|
| [factories_config](variables.tf#L167) | Paths to data files and folders that enable factory functionality. | <code title="object({ org_policies = optional(string) pam_entitlements = optional(string) scc_mute_configs = optional(string) scc_sha_custom_modules = optional(string) })">object({…})</code> | | <code>{}</code> |
|
|
|
|
|
| [firewall_policy](variables.tf#L179) | Hierarchical firewall policy to associate to this folder. | <code title="object({ name = string policy = string })">object({…})</code> | | <code>null</code> |
|
|
|
|
|
| [folder_create](variables.tf#L188) | Create folder. When set to false, uses id to reference an existing folder. | <code>bool</code> | | <code>true</code> |
|
|
|
|
|
| [asset_search](variables.tf#L51) | Cloud Asset Inventory search configurations. | <code title="map(object({ asset_types = list(string) query = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
|
| [assured_workload_config](variables.tf#L61) | Create AssuredWorkloads folder instead of regular folder when value is provided. Incompatible with folder_create=false. | <code title="object({ compliance_regime = string display_name = string location = string organization = string enable_sovereign_controls = optional(bool) labels = optional(map(string), {}) partner = optional(string) partner_permissions = optional(object({ assured_workloads_monitoring = optional(bool) data_logs_viewer = optional(bool) service_access_approver = optional(bool) })) violation_notifications_enabled = optional(bool) })">object({…})</code> | | <code>null</code> |
|
|
|
|
|
| [autokey_config](variables.tf#L123) | Enable autokey support for this folder's children. Project accepts either project id or number. | <code title="object({ project = string })">object({…})</code> | | <code>null</code> |
|
|
|
|
|
| [contacts](variables.tf#L132) | List of essential contacts for this resource. Must be in the form EMAIL -> [NOTIFICATION_TYPES]. Valid notification types are ALL, SUSPENSION, SECURITY, TECHNICAL, BILLING, LEGAL, PRODUCT_UPDATES. | <code>map(list(string))</code> | | <code>{}</code> |
|
|
|
|
|
| [context](variables.tf#L151) | Context-specific interpolations. | <code title="object({ bigquery_datasets = optional(map(string), {}) condition_vars = optional(map(map(string)), {}) custom_roles = optional(map(string), {}) email_addresses = optional(map(string), {}) folder_ids = optional(map(string), {}) iam_principals = optional(map(string), {}) log_buckets = optional(map(string), {}) project_ids = optional(map(string), {}) project_numbers = optional(map(string), {}) pubsub_topics = optional(map(string), {}) storage_buckets = optional(map(string), {}) tag_values = optional(map(string), {}) })">object({…})</code> | | <code>{}</code> |
|
|
|
|
|
| [deletion_protection](variables.tf#L171) | Deletion protection setting for this folder. | <code>bool</code> | | <code>false</code> |
|
|
|
|
|
| [factories_config](variables.tf#L177) | Paths to data files and folders that enable factory functionality. | <code title="object({ org_policies = optional(string) pam_entitlements = optional(string) scc_mute_configs = optional(string) scc_sha_custom_modules = optional(string) })">object({…})</code> | | <code>{}</code> |
|
|
|
|
|
| [firewall_policy](variables.tf#L189) | Hierarchical firewall policy to associate to this folder. | <code title="object({ name = string policy = string })">object({…})</code> | | <code>null</code> |
|
|
|
|
|
| [folder_create](variables.tf#L198) | Create folder. When set to false, uses id to reference an existing folder. | <code>bool</code> | | <code>true</code> |
|
|
|
|
|
| [iam](variables-iam.tf#L17) | IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
|
|
|
|
| [iam_bindings](variables-iam.tf#L24) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code title="map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
|
| [iam_bindings_additive](variables-iam.tf#L39) | Individual additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
|
| [iam_by_principals](variables-iam.tf#L61) | Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid errors. Merged internally with the `iam` variable. | <code>map(list(string))</code> | | <code>{}</code> |
|
|
|
|
|
| [iam_by_principals_additive](variables-iam.tf#L54) | Additive IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid errors. Merged internally with the `iam_bindings_additive` variable. | <code>map(list(string))</code> | | <code>{}</code> |
|
|
|
|
|
| [iam_by_principals_conditional](variables-iam.tf#L68) | Authoritative IAM binding in {PRINCIPAL => {roles = [roles], condition = {cond}}} format. Principals need to be statically defined to avoid errors. Condition is required. | <code title="map(object({ roles = list(string) condition = object({ expression = string title = string description = optional(string) }) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
|
| [id](variables.tf#L198) | Folder ID in case you use folder_create=false. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [id](variables.tf#L208) | Folder ID in case you use folder_create=false. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [logging_data_access](variables-logging.tf#L17) | Control activation of data access logs. The special 'allServices' key denotes configuration for all services. | <code title="map(object({ ADMIN_READ = optional(object({ exempted_members = optional(list(string), []) })), DATA_READ = optional(object({ exempted_members = optional(list(string), []) })), DATA_WRITE = optional(object({ exempted_members = optional(list(string), []) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
|
| [logging_exclusions](variables-logging.tf#L28) | Logging exclusions for this folder in the form {NAME -> FILTER}. | <code>map(string)</code> | | <code>{}</code> |
|
|
|
|
|
| [logging_settings](variables-logging.tf#L35) | Default settings for logging resources. | <code title="object({ disable_default_sink = optional(bool) storage_location = optional(string) })">object({…})</code> | | <code>null</code> |
|
|
|
|
|
| [logging_sinks](variables-logging.tf#L45) | Logging sinks to create for the folder. | <code title="map(object({ bq_partitioned_table = optional(bool, false) description = optional(string) destination = string disabled = optional(bool, false) exclusions = optional(map(string), {}) filter = optional(string) iam = optional(bool, true) include_children = optional(bool, true) intercept_children = optional(bool, false) type = string }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
|
| [name](variables.tf#L204) | Folder name. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [org_policies](variables.tf#L210) | Organization policies applied to this folder keyed by policy name. | <code title="map(object({ inherit_from_parent = optional(bool) # for list policies only. reset = optional(bool) rules = optional(list(object({ allow = optional(object({ all = optional(bool) values = optional(list(string)) })) deny = optional(object({ all = optional(bool) values = optional(list(string)) })) enforce = optional(bool) # for boolean policies only. condition = optional(object({ description = optional(string) expression = optional(string) location = optional(string) title = optional(string) }), {}) parameters = optional(string) })), []) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
|
| [name](variables.tf#L214) | Folder name. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [org_policies](variables.tf#L220) | Organization policies applied to this folder keyed by policy name. | <code title="map(object({ inherit_from_parent = optional(bool) # for list policies only. reset = optional(bool) rules = optional(list(object({ allow = optional(object({ all = optional(bool) values = optional(list(string)) })) deny = optional(object({ all = optional(bool) values = optional(list(string)) })) enforce = optional(bool) # for boolean policies only. condition = optional(object({ description = optional(string) expression = optional(string) location = optional(string) title = optional(string) }), {}) parameters = optional(string) })), []) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
|
| [pam_entitlements](variables-pam.tf#L17) | Privileged Access Manager entitlements for this resource, keyed by entitlement ID. | <code title="map(object({ max_request_duration = string eligible_users = list(string) privileged_access = list(object({ role = string condition = optional(string) })) requester_justification_config = optional(object({ not_mandatory = optional(bool, true) unstructured = optional(bool, false) }), { not_mandatory = false, unstructured = true }) manual_approvals = optional(object({ require_approver_justification = bool steps = list(object({ approvers = list(string) approvals_needed = optional(number, 1) approver_email_recipients = optional(list(string)) })) })) additional_notification_targets = optional(object({ admin_email_recipients = optional(list(string)) requester_email_recipients = optional(list(string)) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
|
| [parent](variables.tf#L238) | Parent in folders/folder_id or organizations/org_id format. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [parent](variables.tf#L248) | Parent in folders/folder_id or organizations/org_id format. | <code>string</code> | | <code>null</code> |
|
|
|
|
|
| [scc_mute_configs](variables-scc.tf#L17) | SCC mute configurations keyed by name. | <code title="map(object({ description = optional(string) filter = string type = optional(string, "DYNAMIC") }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
|
| [scc_sha_custom_modules](variables-scc.tf#L27) | SCC custom modules keyed by module name. | <code title="map(object({ description = optional(string) severity = string recommendation = string predicate = object({ expression = string }) resource_selector = object({ resource_types = list(string) }) enablement_state = optional(string, "ENABLED") }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
|
| [tag_bindings](variables.tf#L252) | Tag bindings for this folder, in key => tag value id format. | <code>map(string)</code> | | <code>null</code> |
|
|
|
|
|
| [tag_bindings](variables.tf#L262) | Tag bindings for this folder, in key => tag value id format. | <code>map(string)</code> | | <code>null</code> |
|
|
|
|
|
|
|
|
|
|
## Outputs
|
|
|
|
|
|
|
|
|
|
| name | description | sensitive |
|
|
|
|
|
|---|---|:---:|
|
|
|
|
|
| [assured_workload](outputs.tf#L17) | Assured Workloads workload resource. | |
|
|
|
|
|
| [folder](outputs.tf#L22) | Folder resource. | |
|
|
|
|
|
| [id](outputs.tf#L27) | Fully qualified folder id. | |
|
|
|
|
|
| [name](outputs.tf#L38) | Folder name. | |
|
|
|
|
|
| [organization_policies_ids](outputs.tf#L47) | Map of ORGANIZATION_POLICIES => ID in the folder. | |
|
|
|
|
|
| [scc_custom_sha_modules_ids](outputs.tf#L52) | Map of SCC CUSTOM SHA MODULES => ID in the folder. | |
|
|
|
|
|
| [service_agents](outputs.tf#L57) | Identities of all folder-level service agents. | |
|
|
|
|
|
| [sink_writer_identities](outputs.tf#L62) | Writer identities created for each sink. | |
|
|
|
|
|
| [asset_search_results](outputs.tf#L17) | Cloud Asset Inventory search results. | |
|
|
|
|
|
| [assured_workload](outputs.tf#L24) | Assured Workloads workload resource. | |
|
|
|
|
|
| [folder](outputs.tf#L29) | Folder resource. | |
|
|
|
|
|
| [id](outputs.tf#L34) | Fully qualified folder id. | |
|
|
|
|
|
| [name](outputs.tf#L45) | Folder name. | |
|
|
|
|
|
| [organization_policies_ids](outputs.tf#L54) | Map of ORGANIZATION_POLICIES => ID in the folder. | |
|
|
|
|
|
| [scc_custom_sha_modules_ids](outputs.tf#L59) | Map of SCC CUSTOM SHA MODULES => ID in the folder. | |
|
|
|
|
|
| [service_agents](outputs.tf#L64) | Identities of all folder-level service agents. | |
|
|
|
|
|
| [sink_writer_identities](outputs.tf#L69) | Writer identities created for each sink. | |
|
|
|
|
|
<!-- END TFDOC -->
|
|
|
|
|
|
Julio Castillo