Introduce iam_by_principals_conditional (#3649)
* Introduce iam_by_principals_conditional * Add iam_by_principals_conditional to project factory * Update IAM ADR * Update project factory readme * Sync FAST schemas * Update organization schema * Add resman tests for iam_by_principals_conditional * Update PF project-defaults.tf * Update copyright
This commit is contained in:
Julio Castillo
@@ -9,6 +9,7 @@ This module implements the creation and management of one GCP project including
|
||||
- [Basic Project Creation](#basic-project-creation)
|
||||
- [IAM](#iam)
|
||||
- [Authoritative IAM](#authoritative-iam)
|
||||
- [Conditional IAM by Principals](#conditional-iam-by-principals)
|
||||
- [Additive IAM](#additive-iam)
|
||||
- [Service Agents](#service-agents)
|
||||
- [Cloudservices Editor Role](#cloudservices-editor-role)
|
||||
@@ -140,6 +141,32 @@ module "project" {
|
||||
|
||||
The `iam_bindings` variable behaves like a more verbose version of `iam`, and allows setting binding-level IAM conditions.
|
||||
|
||||
### Conditional IAM by Principals
|
||||
|
||||
The `iam_by_principals_conditional` variable allows defining IAM bindings keyed by principal, where each principal shares a common condition for multiple roles. This is useful for granting access with specific conditions (e.g., time-based or resource-based) to users or groups across different roles.
|
||||
|
||||
```hcl
|
||||
module "project" {
|
||||
source = "./fabric/modules/project"
|
||||
billing_account = var.billing_account_id
|
||||
name = "project"
|
||||
parent = var.folder_id
|
||||
prefix = var.prefix
|
||||
services = ["storage.googleapis.com"]
|
||||
iam_by_principals_conditional = {
|
||||
"user:one@example.com" = {
|
||||
roles = ["roles/owner", "roles/viewer"]
|
||||
condition = {
|
||||
title = "expires_after_2024_12_31"
|
||||
description = "Expiring at midnight of 2024-12-31"
|
||||
expression = "request.time < timestamp(\"2025-01-01T00:00:00Z\")"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=5 inventory=iam-bpc.yaml
|
||||
```
|
||||
|
||||
```hcl
|
||||
module "project" {
|
||||
source = "./fabric/modules/project"
|
||||
@@ -2158,6 +2185,7 @@ module "project" {
|
||||
| [iam_bindings_additive](variables-iam.tf#L39) | Individual additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_by_principals](variables-iam.tf#L61) | Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid errors. Merged internally with the `iam` variable. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [iam_by_principals_additive](variables-iam.tf#L54) | Additive IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid errors. Merged internally with the `iam_bindings_additive` variable. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [iam_by_principals_conditional](variables-iam.tf#L68) | Authoritative IAM binding in {PRINCIPAL => {roles = [roles], condition = {cond}}} format. Principals need to be statically defined to avoid errors. Condition is required. | <code title="map(object({ roles = list(string) condition = object({ expression = string title = string description = optional(string) }) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [kms_autokeys](variables.tf#L169) | KMS Autokey key handles. | <code title="map(object({ location = string resource_type_selector = optional(string, "compute.googleapis.com/Disk") }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [labels](variables.tf#L187) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [lien_reason](variables.tf#L194) | If non-empty, creates a project lien with this description. | <code>string</code> | | <code>null</code> |
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Copyright 2025 Google LLC
|
||||
* Copyright 2026 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -96,6 +96,30 @@ locals {
|
||||
}
|
||||
]...
|
||||
)
|
||||
_iam_bindings_conditional = flatten([
|
||||
for principal, config in var.iam_by_principals_conditional : [
|
||||
for role in config.roles : {
|
||||
principal = principal
|
||||
role = role
|
||||
condition = config.condition
|
||||
}
|
||||
]
|
||||
])
|
||||
_iam_bindings_conditional_grouped = {
|
||||
for binding in local._iam_bindings_conditional :
|
||||
"iam-bpc:${binding.role}-${binding.condition.title}" => binding...
|
||||
}
|
||||
iam_bindings = merge(
|
||||
var.iam_bindings,
|
||||
{
|
||||
for k, v in local._iam_bindings_conditional_grouped :
|
||||
k => {
|
||||
role = v[0].role
|
||||
condition = v[0].condition
|
||||
members = [for b in v : b.principal]
|
||||
}
|
||||
}
|
||||
)
|
||||
}
|
||||
|
||||
# we use a different key for custom roles to allow referring to the role alias
|
||||
@@ -136,7 +160,7 @@ resource "google_project_iam_binding" "authoritative" {
|
||||
}
|
||||
|
||||
resource "google_project_iam_binding" "bindings" {
|
||||
for_each = var.iam_bindings
|
||||
for_each = local.iam_bindings
|
||||
project = local.project.project_id
|
||||
role = lookup(local.ctx.custom_roles, each.value.role, each.value.role)
|
||||
members = [
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Copyright 2025 Google LLC
|
||||
* Copyright 2026 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -64,3 +64,33 @@ variable "iam_by_principals" {
|
||||
default = {}
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "iam_by_principals_conditional" {
|
||||
description = "Authoritative IAM binding in {PRINCIPAL => {roles = [roles], condition = {cond}}} format. Principals need to be statically defined to avoid errors. Condition is required."
|
||||
type = map(object({
|
||||
roles = list(string)
|
||||
condition = object({
|
||||
expression = string
|
||||
title = string
|
||||
description = optional(string)
|
||||
})
|
||||
}))
|
||||
default = {}
|
||||
nullable = false
|
||||
validation {
|
||||
condition = alltrue([
|
||||
for k, v in var.iam_by_principals_conditional : v.condition != null
|
||||
])
|
||||
error_message = "The `condition` attribute is required. Use `iam_by_principals` for non-conditional bindings."
|
||||
}
|
||||
validation {
|
||||
condition = alltrue([
|
||||
for title, conditions in {
|
||||
for k, v in var.iam_by_principals_conditional :
|
||||
v.condition.title => v.condition...
|
||||
} :
|
||||
length(distinct(conditions)) == 1
|
||||
])
|
||||
error_message = "IAM bindings with the same condition title must have identical expressions and descriptions."
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user