add validation to kms key variables (#3308)
This commit is contained in:
Ludovico Magnocavallo
committed by
GitHub
GitHub
parent
d1ec0868f0
commit
eff8799303
@@ -154,16 +154,16 @@ module "kms" {
|
||||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [keyring](variables.tf#L88) | Keyring attributes. | <code title="object({ location = string name = string })">object({…})</code> | ✓ | |
|
||||
| [project_id](variables.tf#L138) | Project id where the keyring will be created. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L149) | Project id where the keyring will be created. | <code>string</code> | ✓ | |
|
||||
| [context](variables.tf#L17) | Context-specific interpolations. | <code title="object({ condition_vars = optional(map(map(string)), {}) custom_roles = optional(map(string), {}) kms_keys = optional(map(string), {}) iam_principals = optional(map(string), {}) locations = optional(map(string), {}) tag_keys = optional(map(string), {}) tag_values = optional(map(string), {}) })">object({…})</code> | | <code>{}</code> |
|
||||
| [iam](variables.tf#L41) | Keyring IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [iam_bindings](variables.tf#L48) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code title="map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_bindings_additive](variables.tf#L63) | Keyring individual additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [import_job](variables.tf#L78) | Keyring import job attributes. | <code title="object({ id = string import_method = string protection_level = string })">object({…})</code> | | <code>null</code> |
|
||||
| [keyring_create](variables.tf#L96) | Set to false to manage keys and IAM bindings in an existing keyring. | <code>bool</code> | | <code>true</code> |
|
||||
| [keys](variables.tf#L102) | Key names and base attributes. Set attributes to null if not needed. | <code title="map(object({ destroy_scheduled_duration = optional(string) rotation_period = optional(string) labels = optional(map(string)) purpose = optional(string, "ENCRYPT_DECRYPT") skip_initial_version_creation = optional(bool, false) version_template = optional(object({ algorithm = string protection_level = optional(string, "SOFTWARE") })) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [tag_bindings](variables.tf#L143) | Tag bindings for this keyring, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [iam](variables.tf#L32) | Keyring IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [iam_bindings](variables.tf#L39) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code title="map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_bindings_additive](variables.tf#L54) | Keyring individual additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [import_job](variables.tf#L69) | Keyring import job attributes. | <code title="object({ id = string import_method = string protection_level = string })">object({…})</code> | | <code>null</code> |
|
||||
| [keyring](variables.tf#L79) | Keyring attributes. | <code title="object({ location = string name = string })">object({…})</code> | | <code>null</code> |
|
||||
| [keyring_create](variables.tf#L89) | Set to false to manage keys and IAM bindings in an existing keyring. | <code>bool</code> | | <code>true</code> |
|
||||
| [keys](variables.tf#L95) | Key names and base attributes. Set attributes to null if not needed. | <code title="map(object({ destroy_scheduled_duration = optional(string) rotation_period = optional(string) labels = optional(map(string)) purpose = optional(string, "ENCRYPT_DECRYPT") skip_initial_version_creation = optional(bool, false) version_template = optional(object({ algorithm = string protection_level = optional(string, "SOFTWARE") })) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [tag_bindings](variables.tf#L154) | Tag bindings for this keyring, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -29,15 +29,6 @@ variable "context" {
|
||||
nullable = false
|
||||
}
|
||||
|
||||
# variable "factories_config" {
|
||||
# description = "Paths to data files and folders that enable factory functionality."
|
||||
# type = object({
|
||||
# keyrings = optional(string)
|
||||
# })
|
||||
# nullable = false
|
||||
# default = {}
|
||||
# }
|
||||
|
||||
variable "iam" {
|
||||
description = "Keyring IAM bindings in {ROLE => [MEMBERS]} format."
|
||||
type = map(list(string))
|
||||
@@ -91,6 +82,8 @@ variable "keyring" {
|
||||
location = string
|
||||
name = string
|
||||
})
|
||||
nullable = true
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "keyring_create" {
|
||||
@@ -133,6 +126,24 @@ variable "keys" {
|
||||
}))
|
||||
default = {}
|
||||
nullable = false
|
||||
validation {
|
||||
condition = alltrue([
|
||||
for k, v in var.keys : contains([
|
||||
"CRYPTO_KEY_PURPOSE_UNSPECIFIED", "ENCRYPT_DECRYPT", "ASYMMETRIC_SIGN",
|
||||
"ASYMMETRIC_DECRYPT", "RAW_ENCRYPT_DECRYPT", "MAC"
|
||||
], v.purpose
|
||||
)
|
||||
])
|
||||
error_message = "Invalid key purpose."
|
||||
}
|
||||
validation {
|
||||
condition = alltrue([
|
||||
for k, v in var.keys : contains([
|
||||
"SOFTWARE", "HSM", "EXTERNAL", "EXTERNAL_VPC"
|
||||
], try(v.version_template.protection_level, "SOFTWARE"))
|
||||
])
|
||||
error_message = "Invalid version template protection level."
|
||||
}
|
||||
}
|
||||
|
||||
variable "project_id" {
|
||||
|
||||
Reference in New Issue
Block a user