Remove data source from folder module (#2260)
* remove data source from folder module * fix fast tfdoc * fix locals type error * fix folder test * fix fast test
This commit is contained in:
Ludovico Magnocavallo
committed by
GitHub
GitHub
parent
7aa6c7e059
commit
c9503d5ac5
@@ -655,7 +655,7 @@ The `fast_features` variable consists of 6 toggles:
|
||||
| [iam_bindings_additive](variables.tf#L141) | Organization-level custom additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> | |
|
||||
| [iam_by_principals](variables.tf#L156) | Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid cycle errors. Merged internally with the `iam` variable. | <code>map(list(string))</code> | | <code>{}</code> | |
|
||||
| [locations](variables.tf#L163) | Optional locations for GCS, BigQuery, and logging buckets created here. | <code title="object({ bq = optional(string, "EU") gcs = optional(string, "EU") logging = optional(string, "global") pubsub = optional(list(string), []) })">object({…})</code> | | <code>{}</code> | |
|
||||
| [log_sinks](variables.tf#L177) | Org-level log sinks, in name => {type, filter} format. | <code title="map(object({ filter = string type = string }))">map(object({…}))</code> | | <code title="{ audit-logs = { filter = <<-FILTER log_id("cloudaudit.googleapis.com/activity") OR log_id("cloudaudit.googleapis.com/system_event") OR log_id("cloudaudit.googleapis.com/policy") OR log_id("cloudaudit.googleapis.com/access_transparency") FILTER type = "logging" } iam = { filter = <<-FILTER protoPayload.serviceName="iamcredentials.googleapis.com" OR protoPayload.serviceName="iam.googleapis.com" OR protoPayload.serviceName="sts.googleapis.com" FILTER type = "logging" } vpc-sc = { filter = <<-FILTER protoPayload.metadata.@type:"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata" FILTER type = "logging" } workspace-audit-logs = { filter = <<-FILTER log_id("cloudaudit.googleapis.com/data_access") protoPayload.serviceName:"login.googleapis.com" FILTER type = "logging" } }">{…}</code> | |
|
||||
| [log_sinks](variables.tf#L177) | Org-level log sinks, in name => {type, filter} format. | <code title="map(object({ filter = string type = string }))">map(object({…}))</code> | | <code title="{ audit-logs = { filter = <<-FILTER log_id("cloudaudit.googleapis.com/activity") OR log_id("cloudaudit.googleapis.com/system_event") OR log_id("cloudaudit.googleapis.com/policy") OR log_id("cloudaudit.googleapis.com/access_transparency") FILTER type = "logging" } iam = { filter = <<-FILTER protoPayload.serviceName="iamcredentials.googleapis.com" OR protoPayload.serviceName="iam.googleapis.com" OR protoPayload.serviceName="sts.googleapis.com" FILTER type = "logging" } vpc-sc = { filter = <<-FILTER protoPayload.metadata.@type="type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata" FILTER type = "logging" } workspace-audit-logs = { filter = <<-FILTER log_id("cloudaudit.googleapis.com/data_access") AND protoPayload.serviceName="login.googleapis.com" FILTER type = "logging" } }">{…}</code> | |
|
||||
| [org_policies_config](variables.tf#L224) | Organization policies customization. | <code title="object({ constraints = optional(object({ allowed_policy_member_domains = optional(list(string), []) }), {}) import_defaults = optional(bool, false) tag_name = optional(string, "org-policies") tag_values = optional(map(object({ description = optional(string, "Managed by the Terraform organization module.") iam = optional(map(list(string)), {}) id = optional(string) })), {}) })">object({…})</code> | | <code>{}</code> | |
|
||||
| [outputs_location](variables.tf#L250) | Enable writing provider, tfvars and CI/CD workflow files to local filesystem. Leave null to disable. | <code>string</code> | | <code>null</code> | |
|
||||
| [project_parent_ids](variables.tf#L265) | Optional parents for projects created here in folders/nnnnnnn format. Null values will use the organization as parent. | <code title="object({ automation = optional(string) billing = optional(string) logging = optional(string) })">object({…})</code> | | <code>{}</code> | |
|
||||
|
||||
@@ -35,14 +35,14 @@ locals {
|
||||
|
||||
resource "google_folder_iam_binding" "authoritative" {
|
||||
for_each = local.iam
|
||||
folder = local.folder.name
|
||||
folder = local.folder_id
|
||||
role = each.key
|
||||
members = each.value
|
||||
}
|
||||
|
||||
resource "google_folder_iam_binding" "bindings" {
|
||||
for_each = var.iam_bindings
|
||||
folder = local.folder.name
|
||||
folder = local.folder_id
|
||||
role = each.value.role
|
||||
members = each.value.members
|
||||
dynamic "condition" {
|
||||
@@ -57,7 +57,7 @@ resource "google_folder_iam_binding" "bindings" {
|
||||
|
||||
resource "google_folder_iam_member" "bindings" {
|
||||
for_each = var.iam_bindings_additive
|
||||
folder = local.folder.name
|
||||
folder = local.folder_id
|
||||
role = each.value.role
|
||||
member = each.value.member
|
||||
dynamic "condition" {
|
||||
|
||||
@@ -37,7 +37,7 @@ locals {
|
||||
|
||||
resource "google_folder_iam_audit_config" "default" {
|
||||
for_each = var.logging_data_access
|
||||
folder = local.folder.name
|
||||
folder = local.folder_id
|
||||
service = each.key
|
||||
dynamic "audit_log_config" {
|
||||
for_each = each.value
|
||||
@@ -53,7 +53,7 @@ resource "google_logging_folder_sink" "sink" {
|
||||
for_each = local.logging_sinks
|
||||
name = each.key
|
||||
description = coalesce(each.value.description, "${each.key} (Terraform-managed).")
|
||||
folder = local.folder.name
|
||||
folder = local.folder_id
|
||||
destination = "${each.value.type}.googleapis.com/${each.value.destination}"
|
||||
filter = each.value.filter
|
||||
include_children = each.value.include_children
|
||||
@@ -108,10 +108,9 @@ resource "google_project_iam_member" "bucket-sinks-binding" {
|
||||
project = split("/", each.value.destination)[1]
|
||||
role = "roles/logging.bucketWriter"
|
||||
member = google_logging_folder_sink.sink[each.key].writer_identity
|
||||
|
||||
condition {
|
||||
title = "${each.key} bucket writer"
|
||||
description = "Grants bucketWriter to ${google_logging_folder_sink.sink[each.key].writer_identity} used by log sink ${each.key} on ${local.folder.id}"
|
||||
description = "Grants bucketWriter to ${google_logging_folder_sink.sink[each.key].writer_identity} used by log sink ${each.key} on ${local.folder_id}"
|
||||
expression = "resource.name.endsWith('${each.value.destination}')"
|
||||
}
|
||||
}
|
||||
@@ -126,7 +125,7 @@ resource "google_project_iam_member" "project-sinks-binding" {
|
||||
resource "google_logging_folder_exclusion" "logging-exclusion" {
|
||||
for_each = var.logging_exclusions
|
||||
name = each.key
|
||||
folder = local.folder.name
|
||||
folder = local.folder_id
|
||||
description = "${each.key} (Terraform-managed)."
|
||||
filter = each.value
|
||||
}
|
||||
|
||||
@@ -15,18 +15,13 @@
|
||||
*/
|
||||
|
||||
locals {
|
||||
folder = (
|
||||
folder_id = (
|
||||
var.folder_create
|
||||
? try(google_folder.folder[0], null)
|
||||
: try(data.google_folder.folder[0], null)
|
||||
? try(google_folder.folder[0].id, null)
|
||||
: var.id
|
||||
)
|
||||
}
|
||||
|
||||
data "google_folder" "folder" {
|
||||
count = var.folder_create ? 0 : 1
|
||||
folder = var.id
|
||||
}
|
||||
|
||||
resource "google_folder" "folder" {
|
||||
count = var.folder_create ? 1 : 0
|
||||
display_name = var.name
|
||||
@@ -36,7 +31,7 @@ resource "google_folder" "folder" {
|
||||
resource "google_essential_contacts_contact" "contact" {
|
||||
provider = google-beta
|
||||
for_each = var.contacts
|
||||
parent = local.folder.name
|
||||
parent = local.folder_id
|
||||
email = each.key
|
||||
language_tag = "en"
|
||||
notification_category_subscriptions = each.value
|
||||
@@ -49,7 +44,7 @@ resource "google_essential_contacts_contact" "contact" {
|
||||
|
||||
resource "google_compute_firewall_policy_association" "default" {
|
||||
count = var.firewall_policy == null ? 0 : 1
|
||||
attachment_target = local.folder.id
|
||||
attachment_target = local.folder_id
|
||||
name = var.firewall_policy.name
|
||||
firewall_policy = var.firewall_policy.policy
|
||||
}
|
||||
|
||||
@@ -52,8 +52,8 @@ locals {
|
||||
org_policies = {
|
||||
for k, v in local._org_policies :
|
||||
k => merge(v, {
|
||||
name = "${local.folder.name}/policies/${k}"
|
||||
parent = local.folder.name
|
||||
name = "${local.folder_id}/policies/${k}"
|
||||
parent = local.folder_id
|
||||
is_boolean_policy = (
|
||||
alltrue([for r in v.rules : r.allow == null && r.deny == null])
|
||||
)
|
||||
|
||||
@@ -16,12 +16,12 @@
|
||||
|
||||
output "folder" {
|
||||
description = "Folder resource."
|
||||
value = local.folder
|
||||
value = try(google_folder.folder[0], null)
|
||||
}
|
||||
|
||||
output "id" {
|
||||
description = "Fully qualified folder id."
|
||||
value = local.folder.name
|
||||
value = local.folder_id
|
||||
depends_on = [
|
||||
google_folder_iam_binding.authoritative,
|
||||
google_folder_iam_binding.bindings,
|
||||
@@ -32,7 +32,7 @@ output "id" {
|
||||
|
||||
output "name" {
|
||||
description = "Folder name."
|
||||
value = local.folder.display_name
|
||||
value = try(google_folder.folder[0].display_name, null)
|
||||
}
|
||||
|
||||
output "sink_writer_identities" {
|
||||
|
||||
@@ -16,6 +16,6 @@
|
||||
|
||||
resource "google_tags_tag_binding" "binding" {
|
||||
for_each = coalesce(var.tag_bindings, {})
|
||||
parent = "//cloudresourcemanager.googleapis.com/${local.folder.id}"
|
||||
parent = "//cloudresourcemanager.googleapis.com/${local.folder_id}"
|
||||
tag_value = each.value
|
||||
}
|
||||
|
||||
@@ -1520,8 +1520,6 @@ values:
|
||||
log_config:
|
||||
- enable: false
|
||||
filter: ALL
|
||||
max_ports_per_vm: 65536
|
||||
min_ports_per_vm: 64
|
||||
name: ew1
|
||||
nat_ip_allocate_option: AUTO_ONLY
|
||||
nat_ips: null
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
|
||||
counts:
|
||||
google_bigquery_default_service_account: 2
|
||||
google_folder: 2
|
||||
google_folder: 1
|
||||
google_folder_iam_binding: 5
|
||||
google_organization_iam_member: 39
|
||||
google_project: 2
|
||||
@@ -30,4 +30,4 @@ counts:
|
||||
google_tags_tag_binding: 1
|
||||
google_tags_tag_value: 1
|
||||
modules: 19
|
||||
resources: 129
|
||||
resources: 128
|
||||
|
||||
@@ -37,8 +37,8 @@ def test_policy_implementation():
|
||||
'@@ -55,2 +55,2 @@\n',
|
||||
'- name = "projects/${local.project.project_id}/policies/${k}"\n',
|
||||
'- parent = "projects/${local.project.project_id}"\n',
|
||||
'+ name = "${local.folder.name}/policies/${k}"\n',
|
||||
'+ parent = local.folder.name\n',
|
||||
'+ name = "${local.folder_id}/policies/${k}"\n',
|
||||
'+ parent = local.folder_id\n',
|
||||
]
|
||||
|
||||
diff2 = difflib.unified_diff(lines['folder'], lines['organization'], 'folder',
|
||||
@@ -50,8 +50,8 @@ def test_policy_implementation():
|
||||
'-# tfdoc:file:description Folder-level organization policies.\n',
|
||||
'+# tfdoc:file:description Organization-level organization policies.\n',
|
||||
'@@ -55,2 +55,2 @@\n',
|
||||
'- name = "${local.folder.name}/policies/${k}"\n',
|
||||
'- parent = local.folder.name\n',
|
||||
'- name = "${local.folder_id}/policies/${k}"\n',
|
||||
'- parent = local.folder_id\n',
|
||||
'+ name = "${var.organization_id}/policies/${k}"\n',
|
||||
'+ parent = var.organization_id\n',
|
||||
'@@ -113,0 +114,9 @@\n',
|
||||
|
||||
Reference in New Issue
Block a user