IAM interface refactor (#1595)
* IAM modules refactor proposal * policy * subheading * Update 20230816-iam-refactor.md * log Julio's +1 * data-catalog-policy-tag * dataproc * dataproc * folder * folder * folder * folder * project * better filtering in test examples * project * folder * folder * organization * fix variable descriptions * kms * net-vpc * dataplex-datascan * modules/iam-service-account * modules/source-repository/ * blueprints/cloud-operations/vm-migration/ * blueprints/third-party-solutions/wordpress * dataplex-datascan * blueprints/cloud-operations/workload-identity-federation * blueprints/data-solutions/cloudsql-multiregion/ * blueprints/data-solutions/composer-2 * Update 20230816-iam-refactor.md * Update 20230816-iam-refactor.md * capture discussion in architectural doc * update variable names and refactor proposal * project * blueprints first round * folder * organization * data-catalog-policy-tag * re-enable folder inventory * project module style fix * dataproc * source-repository * source-repository tests * dataplex-datascan * dataplex-datascan tests * net-vpc * net-vpc test examples * iam-service-account * iam-service-account test examples * kms * boilerplate * tfdoc * fix module tests * more blueprint fixes * fix typo in data blueprints * incomplete refactor of data platform foundations * tfdoc * data platform foundation * refactor data platform foundation iam locals * remove redundant example test * shielded folder fix * fix typo * project factory * project factory outputs * tfdoc * test workflow: less verbose tests, fix tf version * re-enable -vv, shorter traceback, fix action version * ignore github extension warning, re-enable action version * fast bootstrap IAM, untested * bootstrap stage IAM fixes * stage 0 tests * fast stage 1 * tenant stage 1 * minor changes to fast stage 0 and 1 * fast security stage * fast mt stage 0 * fast mt stage 0 * fast pf
This commit is contained in:
Ludovico Magnocavallo
committed by
GitHub
GitHub
parent
6eeba5e599
commit
819894d2ba
File diff suppressed because one or more lines are too long
@@ -23,11 +23,6 @@ locals {
|
||||
for k, v in var.group_iam : "group:${k}" if try(index(v, r), null) != null
|
||||
]
|
||||
}
|
||||
_iam_additive_pairs = flatten([
|
||||
for role, members in var.iam_additive : [
|
||||
for member in members : { role = role, member = member }
|
||||
]
|
||||
])
|
||||
iam = {
|
||||
for role in distinct(concat(keys(var.iam), keys(local._group_iam))) :
|
||||
role => concat(
|
||||
@@ -35,13 +30,6 @@ locals {
|
||||
try(local._group_iam[role], [])
|
||||
)
|
||||
}
|
||||
iam_additive = {
|
||||
for pair in local._iam_additive_pairs :
|
||||
"${pair.role}-${pair.member}" => {
|
||||
role = pair.role
|
||||
member = pair.member
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "google_dataproc_cluster_iam_binding" "authoritative" {
|
||||
@@ -53,23 +41,28 @@ resource "google_dataproc_cluster_iam_binding" "authoritative" {
|
||||
members = each.value
|
||||
}
|
||||
|
||||
resource "google_dataproc_cluster_iam_member" "additive" {
|
||||
for_each = (
|
||||
length(var.iam_additive) > 0
|
||||
? local.iam_additive
|
||||
: {}
|
||||
)
|
||||
project = var.project_id
|
||||
cluster = google_dataproc_cluster.cluster.name
|
||||
region = var.region
|
||||
role = each.value.role
|
||||
member = each.value.member
|
||||
}
|
||||
|
||||
resource "google_dataproc_cluster_iam_member" "members" {
|
||||
for_each = var.iam_members
|
||||
resource "google_dataproc_cluster_iam_binding" "bindings" {
|
||||
for_each = var.iam_bindings
|
||||
project = var.project_id
|
||||
cluster = google_dataproc_cluster.cluster.name
|
||||
region = var.region
|
||||
role = each.key
|
||||
members = each.value.members
|
||||
dynamic "condition" {
|
||||
for_each = each.value.condition == null ? [] : [""]
|
||||
content {
|
||||
expression = each.value.condition.expression
|
||||
title = each.value.condition.title
|
||||
description = each.value.condition.description
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "google_dataproc_cluster_iam_member" "bindings" {
|
||||
for_each = var.iam_bindings_additive
|
||||
project = var.project_id
|
||||
cluster = google_dataproc_cluster.cluster.name
|
||||
region = var.region
|
||||
role = each.value.role
|
||||
member = each.value.member
|
||||
dynamic "condition" {
|
||||
|
||||
@@ -196,15 +196,22 @@ variable "iam" {
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "iam_additive" {
|
||||
description = "IAM additive bindings in {ROLE => [MEMBERS]} format."
|
||||
type = map(list(string))
|
||||
default = {}
|
||||
nullable = false
|
||||
variable "iam_bindings" {
|
||||
description = "Authoritative IAM bindings in {ROLE => {members = [], condition = {}}}."
|
||||
type = map(object({
|
||||
members = list(string)
|
||||
condition = optional(object({
|
||||
expression = string
|
||||
title = string
|
||||
description = optional(string)
|
||||
}))
|
||||
}))
|
||||
nullable = false
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "iam_members" {
|
||||
description = "Individual additive IAM bindings, use this when iam_additive does not work due to dynamic resources. Keys are arbitrary and only used for the internal loop."
|
||||
variable "iam_bindings_additive" {
|
||||
description = "Individual additive IAM bindings. Keys are arbitrary."
|
||||
type = map(object({
|
||||
member = string
|
||||
role = string
|
||||
|
||||
Reference in New Issue
Block a user