kovagoadi/hunfabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add support for context in kms module (#3307)

Browse Source
This commit is contained in:
Ludovico Magnocavallo
2025-09-07 15:15:27 +02:00
committed by GitHub
parent 68955ff809
commit 80193cfa2e
8 changed files with 322 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
modules/kms/README.md
View File

@@ -154,15 +154,16 @@ module "kms" {
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
| [keyring](variables.tf#L64) | Keyring attributes. | <code title="object&#40;&#123;&#10; location &#61; string&#10; name &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | ✓ | |
| [project_id](variables.tf#L114) | Project id where the keyring will be created. | <code>string</code> | ✓ | |
| [iam](variables.tf#L17) | Keyring IAM bindings in {ROLE => [MEMBERS]} format. | <code>map&#40;list&#40;string&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [iam_bindings](variables.tf#L24) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code title="map&#40;object&#40;&#123;&#10; members &#61; list&#40;string&#41;&#10; role &#61; string&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [iam_bindings_additive](variables.tf#L39) | Keyring individual additive IAM bindings. Keys are arbitrary. | <code title="map&#40;object&#40;&#123;&#10; member &#61; string&#10; role &#61; string&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [import_job](variables.tf#L54) | Keyring import job attributes. | <code title="object&#40;&#123;&#10; id &#61; string&#10; import_method &#61; string&#10; protection_level &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> |
| [keyring_create](variables.tf#L72) | Set to false to manage keys and IAM bindings in an existing keyring. | <code>bool</code> | | <code>true</code> |
| [keys](variables.tf#L78) | Key names and base attributes. Set attributes to null if not needed. | <code title="map&#40;object&#40;&#123;&#10; destroy_scheduled_duration &#61; optional&#40;string&#41;&#10; rotation_period &#61; optional&#40;string&#41;&#10; labels &#61; optional&#40;map&#40;string&#41;&#41;&#10; purpose &#61; optional&#40;string, &#34;ENCRYPT_DECRYPT&#34;&#41;&#10; skip_initial_version_creation &#61; optional&#40;bool, false&#41;&#10; version_template &#61; optional&#40;object&#40;&#123;&#10; algorithm &#61; string&#10; protection_level &#61; optional&#40;string, &#34;SOFTWARE&#34;&#41;&#10; &#125;&#41;&#41;&#10; iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10; members &#61; list&#40;string&#41;&#10; role &#61; string&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10; member &#61; string&#10; role &#61; string&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [tag_bindings](variables.tf#L119) | Tag bindings for this keyring, in key => tag value id format. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> |
| [keyring](variables.tf#L88) | Keyring attributes. | <code title="object&#40;&#123;&#10; location &#61; string&#10; name &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | ✓ | |
| [project_id](variables.tf#L138) | Project id where the keyring will be created. | <code>string</code> | ✓ | |
| [context](variables.tf#L17) | Context-specific interpolations. | <code title="object&#40;&#123;&#10; condition_vars &#61; optional&#40;map&#40;map&#40;string&#41;&#41;, &#123;&#125;&#41;&#10; custom_roles &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10; kms_keys &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10; iam_principals &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10; locations &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10; tag_keys &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10; tag_values &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>&#123;&#125;</code> |
| [iam](variables.tf#L41) | Keyring IAM bindings in {ROLE => [MEMBERS]} format. | <code>map&#40;list&#40;string&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [iam_bindings](variables.tf#L48) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code title="map&#40;object&#40;&#123;&#10; members &#61; list&#40;string&#41;&#10; role &#61; string&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [iam_bindings_additive](variables.tf#L63) | Keyring individual additive IAM bindings. Keys are arbitrary. | <code title="map&#40;object&#40;&#123;&#10; member &#61; string&#10; role &#61; string&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [import_job](variables.tf#L78) | Keyring import job attributes. | <code title="object&#40;&#123;&#10; id &#61; string&#10; import_method &#61; string&#10; protection_level &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> |
| [keyring_create](variables.tf#L96) | Set to false to manage keys and IAM bindings in an existing keyring. | <code>bool</code> | | <code>true</code> |
| [keys](variables.tf#L102) | Key names and base attributes. Set attributes to null if not needed. | <code title="map&#40;object&#40;&#123;&#10; destroy_scheduled_duration &#61; optional&#40;string&#41;&#10; rotation_period &#61; optional&#40;string&#41;&#10; labels &#61; optional&#40;map&#40;string&#41;&#41;&#10; purpose &#61; optional&#40;string, &#34;ENCRYPT_DECRYPT&#34;&#41;&#10; skip_initial_version_creation &#61; optional&#40;bool, false&#41;&#10; version_template &#61; optional&#40;object&#40;&#123;&#10; algorithm &#61; string&#10; protection_level &#61; optional&#40;string, &#34;SOFTWARE&#34;&#41;&#10; &#125;&#41;&#41;&#10; iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10; members &#61; list&#40;string&#41;&#10; role &#61; string&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10; member &#61; string&#10; role &#61; string&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [tag_bindings](variables.tf#L143) | Tag bindings for this keyring, in key => tag value id format. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> |
## Outputs

51
modules/kms/iam.tf
View File

@@ -51,19 +51,26 @@ locals {
resource "google_kms_key_ring_iam_binding" "authoritative" {
for_each = var.iam
key_ring_id = local.keyring.id
role = each.key
members = each.value
role = lookup(local.ctx.custom_roles, each.key, each.key)
members = [
for v in each.value :
lookup(local.ctx.iam_principals, v, v)
]
}
resource "google_kms_key_ring_iam_binding" "bindings" {
for_each = var.iam_bindings
key_ring_id = local.keyring.id
role = each.value.role
members = each.value.members
role = lookup(local.ctx.custom_roles, each.value.role, each.value.role)
members = [
for v in each.value.members : lookup(local.ctx.iam_principals, v, v)
]
dynamic "condition" {
for_each = each.value.condition == null ? [] : [""]
content {
expression = each.value.condition.expression
expression = templatestring(
each.value.condition.expression, var.context.condition_vars
)
title = each.value.condition.title
description = each.value.condition.description
}
@@ -73,12 +80,14 @@ resource "google_kms_key_ring_iam_binding" "bindings" {
resource "google_kms_key_ring_iam_member" "bindings" {
for_each = var.iam_bindings_additive
key_ring_id = local.keyring.id
role = each.value.role
member = each.value.member
role = lookup(local.ctx.custom_roles, each.value.role, each.value.role)
member = lookup(local.ctx.iam_principals, each.value.member, each.value.member)
dynamic "condition" {
for_each = each.value.condition == null ? [] : [""]
content {
expression = each.value.condition.expression
expression = templatestring(
each.value.condition.expression, var.context.condition_vars
)
title = each.value.condition.title
description = each.value.condition.description
}
@@ -90,20 +99,28 @@ resource "google_kms_crypto_key_iam_binding" "authoritative" {
for binding in local.key_iam :
"${binding.key}.${binding.role}" => binding
}
role = each.value.role
role = lookup(local.ctx.custom_roles, each.value.role, each.value.role)
crypto_key_id = google_kms_crypto_key.default[each.value.key].id
members = each.value.members
members = [
for v in each.value.members :
lookup(local.ctx.iam_principals, v, v)
]
}
resource "google_kms_crypto_key_iam_binding" "bindings" {
for_each = local.key_iam_bindings
role = each.value.role
role = lookup(local.ctx.custom_roles, each.value.role, each.value.role)
crypto_key_id = google_kms_crypto_key.default[each.value.key].id
members = each.value.members
members = [
for v in each.value.members :
lookup(local.ctx.iam_principals, v, v)
]
dynamic "condition" {
for_each = each.value.condition == null ? [] : [""]
content {
expression = each.value.condition.expression
expression = templatestring(
each.value.condition.expression, var.context.condition_vars
)
title = each.value.condition.title
description = each.value.condition.description
}
@@ -113,12 +130,14 @@ resource "google_kms_crypto_key_iam_binding" "bindings" {
resource "google_kms_crypto_key_iam_member" "members" {
for_each = local.key_iam_bindings_additive
crypto_key_id = google_kms_crypto_key.default[each.value.key].id
role = each.value.role
member = each.value.member
role = lookup(local.ctx.custom_roles, each.value.role, each.value.role)
member = lookup(local.ctx.iam_principals, each.value.member, each.value.member)
dynamic "condition" {
for_each = each.value.condition == null ? [] : [""]
content {
expression = each.value.condition.expression
expression = templatestring(
each.value.condition.expression, var.context.condition_vars
)
title = each.value.condition.title
description = each.value.condition.description
}

12
modules/kms/main.tf
View File

@@ -15,6 +15,12 @@
*/
locals {
ctx = {
for k, v in var.context : k => {
for kk, vv in v : "${local.ctx_p}${k}:${kk}" => vv
} if k != "condition_vars"
}
ctx_p = "$"
keyring = (
var.keyring_create
? google_kms_key_ring.default[0]
@@ -26,14 +32,14 @@ data "google_kms_key_ring" "default" {
count = var.keyring_create ? 0 : 1
project = var.project_id
name = var.keyring.name
location = var.keyring.location
location = lookup(local.ctx.locations, var.keyring.location, var.keyring.location)
}
resource "google_kms_key_ring" "default" {
count = var.keyring_create ? 1 : 0
project = var.project_id
name = var.keyring.name
location = var.keyring.location
location = lookup(local.ctx.locations, var.keyring.location, var.keyring.location)
}
resource "google_kms_crypto_key" "default" {
@@ -61,4 +67,4 @@ resource "google_kms_key_ring_import_job" "default" {
import_job_id = var.import_job.id
import_method = var.import_job.import_method
protection_level = var.import_job.protection_level
}
}

4
modules/kms/tags.tf
View File

@@ -17,6 +17,6 @@
resource "google_tags_location_tag_binding" "binding" {
for_each = var.tag_bindings
parent = "//cloudkms.googleapis.com/${local.keyring.id}"
tag_value = each.value
location = var.keyring.location
tag_value = lookup(local.ctx.tag_values, each.value, each.value)
location = lookup(local.ctx.locations, var.keyring.location, var.keyring.location)
}

24
modules/kms/variables.tf
View File

@@ -14,6 +14,30 @@
* limitations under the License.
*/
variable "context" {
description = "Context-specific interpolations."
type = object({
condition_vars = optional(map(map(string)), {})
custom_roles = optional(map(string), {})
kms_keys = optional(map(string), {})
iam_principals = optional(map(string), {})
locations = optional(map(string), {})
tag_keys = optional(map(string), {})
tag_values = optional(map(string), {})
})
default = {}
nullable = false
}
# variable "factories_config" {
# description = "Paths to data files and folders that enable factory functionality."
# type = object({
# keyrings = optional(string)
# })
# nullable = false
# default = {}
# }
variable "iam" {
description = "Keyring IAM bindings in {ROLE => [MEMBERS]} format."
type = map(list(string))

111
tests/modules/kms/context.tfvars Normal file
View File

@@ -0,0 +1,111 @@
context = {
condition_vars = {
organization = {
id = 1234567890
}
}
custom_roles = {
myrole_one = "organizations/366118655033/roles/myRoleOne"
myrole_two = "organizations/366118655033/roles/myRoleTwo"
myrole_three = "organizations/366118655033/roles/myRoleThree"
myrole_four = "organizations/366118655033/roles/myRoleFour"
}
iam_principals = {
mygroup = "group:test-group@example.com"
mysa = "serviceAccount:test@test-project.iam.gserviceaccount.com"
myuser = "user:test-user@example.com"
myuser2 = "user:test-user2@example.com"
}
locations = {
ew8 = "europe-west8"
}
tag_values = {
"test/one" = "tagValues/1234567890"
}
}
project_id = "myproject"
keyring = {
location = "$locations:ew8"
name = "test"
}
keys = {
key-a = {
iam = {
"$custom_roles:myrole_one" = [
"$iam_principals:myuser"
]
"roles/viewer" = [
"$iam_principals:mysa"
]
}
iam_by_principals = {
"$iam_principals:myuser2" = [
"$custom_roles:myrole_three",
"$custom_roles:myrole_four",
"roles/owner",
]
}
iam_bindings = {
myrole_two = {
role = "$custom_roles:myrole_two"
members = [
"$iam_principals:mysa"
]
condition = {
title = "Test"
expression = "resource.matchTag('$${organization.id}/environment', 'development')"
}
}
}
}
key-b = {
rotation_period = "604800s"
iam_bindings_additive = {
myrole_three = {
role = "$custom_roles:myrole_three"
member = "$iam_principals:mysa"
}
}
}
key-c = {
labels = {
env = "test"
}
}
}
iam = {
"$custom_roles:myrole_one" = [
"$iam_principals:myuser"
]
"roles/viewer" = [
"$iam_principals:mysa"
]
}
iam_bindings = {
myrole_two = {
role = "$custom_roles:myrole_two"
members = [
"$iam_principals:mysa"
]
condition = {
title = "Test"
expression = "resource.matchTag('$${organization.id}/environment', 'development')"
}
}
}
iam_bindings_additive = {
myrole_three = {
role = "$custom_roles:myrole_three"
member = "$iam_principals:mysa"
}
}
iam_by_principals = {
"$iam_principals:myuser2" = [
"$custom_roles:myrole_three",
"$custom_roles:myrole_four",
"roles/owner",
]
}
tag_bindings = {
foo = "$tag_values:test/one"
}

114
tests/modules/kms/context.yaml Normal file
View File

@@ -0,0 +1,114 @@
# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
values:
google_kms_crypto_key.default["key-a"]:
effective_labels:
goog-terraform-provisioned: 'true'
labels: null
name: key-a
purpose: ENCRYPT_DECRYPT
rotation_period: null
skip_initial_version_creation: false
terraform_labels:
goog-terraform-provisioned: 'true'
timeouts: null
google_kms_crypto_key.default["key-b"]:
effective_labels:
goog-terraform-provisioned: 'true'
labels: null
name: key-b
purpose: ENCRYPT_DECRYPT
rotation_period: 604800s
skip_initial_version_creation: false
terraform_labels:
goog-terraform-provisioned: 'true'
timeouts: null
google_kms_crypto_key.default["key-c"]:
effective_labels:
env: test
goog-terraform-provisioned: 'true'
labels:
env: test
name: key-c
purpose: ENCRYPT_DECRYPT
rotation_period: null
skip_initial_version_creation: false
terraform_labels:
env: test
goog-terraform-provisioned: 'true'
timeouts: null
google_kms_crypto_key_iam_binding.authoritative["key-a.$custom_roles:myrole_one"]:
condition: []
members:
- user:test-user@example.com
role: organizations/366118655033/roles/myRoleOne
google_kms_crypto_key_iam_binding.authoritative["key-a.roles/viewer"]:
condition: []
members:
- serviceAccount:test@test-project.iam.gserviceaccount.com
role: roles/viewer
google_kms_crypto_key_iam_binding.bindings["myrole_two"]:
condition:
- description: null
expression: resource.matchTag('1234567890/environment', 'development')
title: Test
members:
- serviceAccount:test@test-project.iam.gserviceaccount.com
role: organizations/366118655033/roles/myRoleTwo
google_kms_crypto_key_iam_member.members["myrole_three"]:
condition: []
member: serviceAccount:test@test-project.iam.gserviceaccount.com
role: organizations/366118655033/roles/myRoleThree
google_kms_key_ring.default[0]:
location: europe-west8
name: test
project: myproject
timeouts: null
google_kms_key_ring_iam_binding.authoritative["$custom_roles:myrole_one"]:
condition: []
members:
- user:test-user@example.com
role: organizations/366118655033/roles/myRoleOne
google_kms_key_ring_iam_binding.authoritative["roles/viewer"]:
condition: []
members:
- serviceAccount:test@test-project.iam.gserviceaccount.com
role: roles/viewer
google_kms_key_ring_iam_binding.bindings["myrole_two"]:
condition:
- description: null
expression: resource.matchTag('1234567890/environment', 'development')
title: Test
members:
- serviceAccount:test@test-project.iam.gserviceaccount.com
role: organizations/366118655033/roles/myRoleTwo
google_kms_key_ring_iam_member.bindings["myrole_three"]:
condition: []
member: serviceAccount:test@test-project.iam.gserviceaccount.com
role: organizations/366118655033/roles/myRoleThree
google_tags_location_tag_binding.binding["foo"]:
location: europe-west8
tag_value: tagValues/1234567890
counts:
google_kms_crypto_key: 3
google_kms_crypto_key_iam_binding: 3
google_kms_crypto_key_iam_member: 1
google_kms_key_ring: 1
google_kms_key_ring_iam_binding: 3
google_kms_key_ring_iam_member: 1
google_tags_location_tag_binding: 1
modules: 0
resources: 13

17
tests/modules/kms/tftest.yaml Normal file
View File

@@ -0,0 +1,17 @@
# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
module: modules/kms
tests:
context: