New security stage leveraging project factory and contexts (#3311)
* wip * wip * fix contexts * cas factory * add support for context to cas module * cas module contexts and tests * cas factory * rename legacy security stage, add test for new stage * readmes * doc * tfdoc * doc, outputs * update inventory
This commit is contained in:
Ludovico Magnocavallo
committed by
GitHub
GitHub
parent
eff8799303
commit
c93b628979
@@ -154,13 +154,13 @@ module "kms" {
|
||||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [keyring](variables.tf#L80) | Keyring attributes. | <code title="object({ location = string name = string })">object({…})</code> | ✓ | |
|
||||
| [project_id](variables.tf#L149) | Project id where the keyring will be created. | <code>string</code> | ✓ | |
|
||||
| [context](variables.tf#L17) | Context-specific interpolations. | <code title="object({ condition_vars = optional(map(map(string)), {}) custom_roles = optional(map(string), {}) kms_keys = optional(map(string), {}) iam_principals = optional(map(string), {}) locations = optional(map(string), {}) tag_keys = optional(map(string), {}) tag_values = optional(map(string), {}) })">object({…})</code> | | <code>{}</code> |
|
||||
| [iam](variables.tf#L32) | Keyring IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [iam_bindings](variables.tf#L39) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code title="map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_bindings_additive](variables.tf#L54) | Keyring individual additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [import_job](variables.tf#L69) | Keyring import job attributes. | <code title="object({ id = string import_method = string protection_level = string })">object({…})</code> | | <code>null</code> |
|
||||
| [keyring](variables.tf#L79) | Keyring attributes. | <code title="object({ location = string name = string })">object({…})</code> | | <code>null</code> |
|
||||
| [context](variables.tf#L17) | Context-specific interpolations. | <code title="object({ condition_vars = optional(map(map(string)), {}) custom_roles = optional(map(string), {}) kms_keys = optional(map(string), {}) iam_principals = optional(map(string), {}) locations = optional(map(string), {}) project_ids = optional(map(string), {}) tag_keys = optional(map(string), {}) tag_values = optional(map(string), {}) })">object({…})</code> | | <code>{}</code> |
|
||||
| [iam](variables.tf#L33) | Keyring IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [iam_bindings](variables.tf#L40) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code title="map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_bindings_additive](variables.tf#L55) | Keyring individual additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [import_job](variables.tf#L70) | Keyring import job attributes. | <code title="object({ id = string import_method = string protection_level = string })">object({…})</code> | | <code>null</code> |
|
||||
| [keyring_create](variables.tf#L89) | Set to false to manage keys and IAM bindings in an existing keyring. | <code>bool</code> | | <code>true</code> |
|
||||
| [keys](variables.tf#L95) | Key names and base attributes. Set attributes to null if not needed. | <code title="map(object({ destroy_scheduled_duration = optional(string) rotation_period = optional(string) labels = optional(map(string)) purpose = optional(string, "ENCRYPT_DECRYPT") skip_initial_version_creation = optional(bool, false) version_template = optional(object({ algorithm = string protection_level = optional(string, "SOFTWARE") })) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [tag_bindings](variables.tf#L154) | Tag bindings for this keyring, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
||||
|
||||
@@ -26,18 +26,19 @@ locals {
|
||||
? google_kms_key_ring.default[0]
|
||||
: data.google_kms_key_ring.default[0]
|
||||
)
|
||||
project_id = lookup(local.ctx.project_ids, var.project_id, var.project_id)
|
||||
}
|
||||
|
||||
data "google_kms_key_ring" "default" {
|
||||
count = var.keyring_create ? 0 : 1
|
||||
project = var.project_id
|
||||
project = local.project_id
|
||||
name = var.keyring.name
|
||||
location = lookup(local.ctx.locations, var.keyring.location, var.keyring.location)
|
||||
}
|
||||
|
||||
resource "google_kms_key_ring" "default" {
|
||||
count = var.keyring_create ? 1 : 0
|
||||
project = var.project_id
|
||||
project = local.project_id
|
||||
name = var.keyring.name
|
||||
location = lookup(local.ctx.locations, var.keyring.location, var.keyring.location)
|
||||
}
|
||||
|
||||
@@ -22,6 +22,7 @@ variable "context" {
|
||||
kms_keys = optional(map(string), {})
|
||||
iam_principals = optional(map(string), {})
|
||||
locations = optional(map(string), {})
|
||||
project_ids = optional(map(string), {})
|
||||
tag_keys = optional(map(string), {})
|
||||
tag_values = optional(map(string), {})
|
||||
})
|
||||
@@ -82,8 +83,7 @@ variable "keyring" {
|
||||
location = string
|
||||
name = string
|
||||
})
|
||||
nullable = true
|
||||
default = null
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "keyring_create" {
|
||||
|
||||
Reference in New Issue
Block a user