Add CMEK support to FAST and controls for CMEK encryption (#3556)

modules/project/README.md

@@ -774,7 +774,7 @@ module "project-host" {
     no-gce-instances = "resource.type=gce_instance"
   }
 }
-# tftest modules=6 resources=19 inventory=logging.yaml e2e
+# tftest inventory=logging.yaml e2e
 ```
 
 ## Data Access Logs
@@ -842,7 +842,7 @@ module "project" {
     }
   }
 }
-# tftest modules=2 resources=6 inventory=log-scopes.yaml
+# tftest inventory=log-scopes.yaml
 ```
 
 ## Cloud KMS Encryption Keys

modules/project/cmek.tf

@@ -91,5 +91,6 @@ resource "google_kms_crypto_key_iam_member" "service_agent_cmek" {
     data.google_project.project,
     data.google_bigquery_default_service_account.bq_sa,
     data.google_storage_project_service_account.gcs_sa,
+    data.google_logging_project_settings.logging_sa
   ]
 }

modules/project/service-agents.tf

@@ -139,6 +139,12 @@ data "google_bigquery_default_service_account" "bq_sa" {
   depends_on = [google_project_service.project_services]
 }
 
+data "google_logging_project_settings" "logging_sa" {
+  count      = contains(var.services, "logging.googleapis.com") ? 1 : 0
+  project    = local.project.project_id
+  depends_on = [google_project_service.project_services]
+}
+
 moved {
   from = google_project_service_identity.jit_si
   to   = google_project_service_identity.default

modules/project/shared-vpc.tf

@@ -154,6 +154,7 @@ resource "google_project_iam_member" "shared_vpc_host_robots" {
     google_project_default_service_accounts.default_service_accounts,
     data.google_bigquery_default_service_account.bq_sa,
     data.google_storage_project_service_account.gcs_sa,
+    data.google_logging_project_settings.logging_sa
   ]
 }