add support for context in kms module (#3307)
This commit is contained in:
Ludovico Magnocavallo
committed by
GitHub
GitHub
parent
68955ff809
commit
80193cfa2e
@@ -154,15 +154,16 @@ module "kms" {
|
||||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [keyring](variables.tf#L64) | Keyring attributes. | <code title="object({ location = string name = string })">object({…})</code> | ✓ | |
|
||||
| [project_id](variables.tf#L114) | Project id where the keyring will be created. | <code>string</code> | ✓ | |
|
||||
| [iam](variables.tf#L17) | Keyring IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [iam_bindings](variables.tf#L24) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code title="map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_bindings_additive](variables.tf#L39) | Keyring individual additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [import_job](variables.tf#L54) | Keyring import job attributes. | <code title="object({ id = string import_method = string protection_level = string })">object({…})</code> | | <code>null</code> |
|
||||
| [keyring_create](variables.tf#L72) | Set to false to manage keys and IAM bindings in an existing keyring. | <code>bool</code> | | <code>true</code> |
|
||||
| [keys](variables.tf#L78) | Key names and base attributes. Set attributes to null if not needed. | <code title="map(object({ destroy_scheduled_duration = optional(string) rotation_period = optional(string) labels = optional(map(string)) purpose = optional(string, "ENCRYPT_DECRYPT") skip_initial_version_creation = optional(bool, false) version_template = optional(object({ algorithm = string protection_level = optional(string, "SOFTWARE") })) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [tag_bindings](variables.tf#L119) | Tag bindings for this keyring, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [keyring](variables.tf#L88) | Keyring attributes. | <code title="object({ location = string name = string })">object({…})</code> | ✓ | |
|
||||
| [project_id](variables.tf#L138) | Project id where the keyring will be created. | <code>string</code> | ✓ | |
|
||||
| [context](variables.tf#L17) | Context-specific interpolations. | <code title="object({ condition_vars = optional(map(map(string)), {}) custom_roles = optional(map(string), {}) kms_keys = optional(map(string), {}) iam_principals = optional(map(string), {}) locations = optional(map(string), {}) tag_keys = optional(map(string), {}) tag_values = optional(map(string), {}) })">object({…})</code> | | <code>{}</code> |
|
||||
| [iam](variables.tf#L41) | Keyring IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [iam_bindings](variables.tf#L48) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code title="map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_bindings_additive](variables.tf#L63) | Keyring individual additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [import_job](variables.tf#L78) | Keyring import job attributes. | <code title="object({ id = string import_method = string protection_level = string })">object({…})</code> | | <code>null</code> |
|
||||
| [keyring_create](variables.tf#L96) | Set to false to manage keys and IAM bindings in an existing keyring. | <code>bool</code> | | <code>true</code> |
|
||||
| [keys](variables.tf#L102) | Key names and base attributes. Set attributes to null if not needed. | <code title="map(object({ destroy_scheduled_duration = optional(string) rotation_period = optional(string) labels = optional(map(string)) purpose = optional(string, "ENCRYPT_DECRYPT") skip_initial_version_creation = optional(bool, false) version_template = optional(object({ algorithm = string protection_level = optional(string, "SOFTWARE") })) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [tag_bindings](variables.tf#L143) | Tag bindings for this keyring, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -51,19 +51,26 @@ locals {
|
||||
resource "google_kms_key_ring_iam_binding" "authoritative" {
|
||||
for_each = var.iam
|
||||
key_ring_id = local.keyring.id
|
||||
role = each.key
|
||||
members = each.value
|
||||
role = lookup(local.ctx.custom_roles, each.key, each.key)
|
||||
members = [
|
||||
for v in each.value :
|
||||
lookup(local.ctx.iam_principals, v, v)
|
||||
]
|
||||
}
|
||||
|
||||
resource "google_kms_key_ring_iam_binding" "bindings" {
|
||||
for_each = var.iam_bindings
|
||||
key_ring_id = local.keyring.id
|
||||
role = each.value.role
|
||||
members = each.value.members
|
||||
role = lookup(local.ctx.custom_roles, each.value.role, each.value.role)
|
||||
members = [
|
||||
for v in each.value.members : lookup(local.ctx.iam_principals, v, v)
|
||||
]
|
||||
dynamic "condition" {
|
||||
for_each = each.value.condition == null ? [] : [""]
|
||||
content {
|
||||
expression = each.value.condition.expression
|
||||
expression = templatestring(
|
||||
each.value.condition.expression, var.context.condition_vars
|
||||
)
|
||||
title = each.value.condition.title
|
||||
description = each.value.condition.description
|
||||
}
|
||||
@@ -73,12 +80,14 @@ resource "google_kms_key_ring_iam_binding" "bindings" {
|
||||
resource "google_kms_key_ring_iam_member" "bindings" {
|
||||
for_each = var.iam_bindings_additive
|
||||
key_ring_id = local.keyring.id
|
||||
role = each.value.role
|
||||
member = each.value.member
|
||||
role = lookup(local.ctx.custom_roles, each.value.role, each.value.role)
|
||||
member = lookup(local.ctx.iam_principals, each.value.member, each.value.member)
|
||||
dynamic "condition" {
|
||||
for_each = each.value.condition == null ? [] : [""]
|
||||
content {
|
||||
expression = each.value.condition.expression
|
||||
expression = templatestring(
|
||||
each.value.condition.expression, var.context.condition_vars
|
||||
)
|
||||
title = each.value.condition.title
|
||||
description = each.value.condition.description
|
||||
}
|
||||
@@ -90,20 +99,28 @@ resource "google_kms_crypto_key_iam_binding" "authoritative" {
|
||||
for binding in local.key_iam :
|
||||
"${binding.key}.${binding.role}" => binding
|
||||
}
|
||||
role = each.value.role
|
||||
role = lookup(local.ctx.custom_roles, each.value.role, each.value.role)
|
||||
crypto_key_id = google_kms_crypto_key.default[each.value.key].id
|
||||
members = each.value.members
|
||||
members = [
|
||||
for v in each.value.members :
|
||||
lookup(local.ctx.iam_principals, v, v)
|
||||
]
|
||||
}
|
||||
|
||||
resource "google_kms_crypto_key_iam_binding" "bindings" {
|
||||
for_each = local.key_iam_bindings
|
||||
role = each.value.role
|
||||
role = lookup(local.ctx.custom_roles, each.value.role, each.value.role)
|
||||
crypto_key_id = google_kms_crypto_key.default[each.value.key].id
|
||||
members = each.value.members
|
||||
members = [
|
||||
for v in each.value.members :
|
||||
lookup(local.ctx.iam_principals, v, v)
|
||||
]
|
||||
dynamic "condition" {
|
||||
for_each = each.value.condition == null ? [] : [""]
|
||||
content {
|
||||
expression = each.value.condition.expression
|
||||
expression = templatestring(
|
||||
each.value.condition.expression, var.context.condition_vars
|
||||
)
|
||||
title = each.value.condition.title
|
||||
description = each.value.condition.description
|
||||
}
|
||||
@@ -113,12 +130,14 @@ resource "google_kms_crypto_key_iam_binding" "bindings" {
|
||||
resource "google_kms_crypto_key_iam_member" "members" {
|
||||
for_each = local.key_iam_bindings_additive
|
||||
crypto_key_id = google_kms_crypto_key.default[each.value.key].id
|
||||
role = each.value.role
|
||||
member = each.value.member
|
||||
role = lookup(local.ctx.custom_roles, each.value.role, each.value.role)
|
||||
member = lookup(local.ctx.iam_principals, each.value.member, each.value.member)
|
||||
dynamic "condition" {
|
||||
for_each = each.value.condition == null ? [] : [""]
|
||||
content {
|
||||
expression = each.value.condition.expression
|
||||
expression = templatestring(
|
||||
each.value.condition.expression, var.context.condition_vars
|
||||
)
|
||||
title = each.value.condition.title
|
||||
description = each.value.condition.description
|
||||
}
|
||||
|
||||
@@ -15,6 +15,12 @@
|
||||
*/
|
||||
|
||||
locals {
|
||||
ctx = {
|
||||
for k, v in var.context : k => {
|
||||
for kk, vv in v : "${local.ctx_p}${k}:${kk}" => vv
|
||||
} if k != "condition_vars"
|
||||
}
|
||||
ctx_p = "$"
|
||||
keyring = (
|
||||
var.keyring_create
|
||||
? google_kms_key_ring.default[0]
|
||||
@@ -26,14 +32,14 @@ data "google_kms_key_ring" "default" {
|
||||
count = var.keyring_create ? 0 : 1
|
||||
project = var.project_id
|
||||
name = var.keyring.name
|
||||
location = var.keyring.location
|
||||
location = lookup(local.ctx.locations, var.keyring.location, var.keyring.location)
|
||||
}
|
||||
|
||||
resource "google_kms_key_ring" "default" {
|
||||
count = var.keyring_create ? 1 : 0
|
||||
project = var.project_id
|
||||
name = var.keyring.name
|
||||
location = var.keyring.location
|
||||
location = lookup(local.ctx.locations, var.keyring.location, var.keyring.location)
|
||||
}
|
||||
|
||||
resource "google_kms_crypto_key" "default" {
|
||||
@@ -61,4 +67,4 @@ resource "google_kms_key_ring_import_job" "default" {
|
||||
import_job_id = var.import_job.id
|
||||
import_method = var.import_job.import_method
|
||||
protection_level = var.import_job.protection_level
|
||||
}
|
||||
}
|
||||
|
||||
@@ -17,6 +17,6 @@
|
||||
resource "google_tags_location_tag_binding" "binding" {
|
||||
for_each = var.tag_bindings
|
||||
parent = "//cloudkms.googleapis.com/${local.keyring.id}"
|
||||
tag_value = each.value
|
||||
location = var.keyring.location
|
||||
tag_value = lookup(local.ctx.tag_values, each.value, each.value)
|
||||
location = lookup(local.ctx.locations, var.keyring.location, var.keyring.location)
|
||||
}
|
||||
|
||||
@@ -14,6 +14,30 @@
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
variable "context" {
|
||||
description = "Context-specific interpolations."
|
||||
type = object({
|
||||
condition_vars = optional(map(map(string)), {})
|
||||
custom_roles = optional(map(string), {})
|
||||
kms_keys = optional(map(string), {})
|
||||
iam_principals = optional(map(string), {})
|
||||
locations = optional(map(string), {})
|
||||
tag_keys = optional(map(string), {})
|
||||
tag_values = optional(map(string), {})
|
||||
})
|
||||
default = {}
|
||||
nullable = false
|
||||
}
|
||||
|
||||
# variable "factories_config" {
|
||||
# description = "Paths to data files and folders that enable factory functionality."
|
||||
# type = object({
|
||||
# keyrings = optional(string)
|
||||
# })
|
||||
# nullable = false
|
||||
# default = {}
|
||||
# }
|
||||
|
||||
variable "iam" {
|
||||
description = "Keyring IAM bindings in {ROLE => [MEMBERS]} format."
|
||||
type = map(list(string))
|
||||
|
||||
Reference in New Issue
Block a user