Add managed folders suports to gcs module (#2530)
* Add RPO, make versioning dynamic * Add manaed folders * Change autoclass and cors defaults to null * Update README * Add iam_by_principals * Add managed folders var description * Remove need for managed folders to end in / * Add inventory to example * Update readme * Fix FAST tests
This commit is contained in:
Julio Castillo
@@ -49,11 +49,6 @@ locals {
|
||||
: null
|
||||
)
|
||||
} : {}
|
||||
gcs_storage_class = (
|
||||
length(split("-", var.log_locations.storage)) < 2
|
||||
? "MULTI_REGIONAL"
|
||||
: "REGIONAL"
|
||||
)
|
||||
log_types = toset([for k, v in var.log_sinks : v.type])
|
||||
log_keys = {
|
||||
for service, key in local._log_keys : service => key if key != null
|
||||
@@ -110,7 +105,6 @@ module "log-export-gcs" {
|
||||
name = "audit-logs"
|
||||
prefix = var.prefix
|
||||
location = replace(var.log_locations.storage, "europe", "EU")
|
||||
storage_class = local.gcs_storage_class
|
||||
encryption_key = var.enable_features.encryption ? module.log-kms[var.log_locations.storage].keys["storage"].id : null
|
||||
}
|
||||
|
||||
|
||||
@@ -182,27 +182,25 @@ module "automation-project" {
|
||||
# output files bucket
|
||||
|
||||
module "automation-tf-output-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
project_id = module.automation-project.project_id
|
||||
name = "iac-core-outputs-0"
|
||||
prefix = local.prefix
|
||||
location = local.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
depends_on = [module.organization]
|
||||
source = "../../../modules/gcs"
|
||||
project_id = module.automation-project.project_id
|
||||
name = "iac-core-outputs-0"
|
||||
prefix = local.prefix
|
||||
location = local.locations.gcs
|
||||
versioning = true
|
||||
depends_on = [module.organization]
|
||||
}
|
||||
|
||||
# this stage's bucket and service account
|
||||
|
||||
module "automation-tf-bootstrap-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
project_id = module.automation-project.project_id
|
||||
name = "iac-core-bootstrap-0"
|
||||
prefix = local.prefix
|
||||
location = local.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
depends_on = [module.organization]
|
||||
source = "../../../modules/gcs"
|
||||
project_id = module.automation-project.project_id
|
||||
name = "iac-core-bootstrap-0"
|
||||
prefix = local.prefix
|
||||
location = local.locations.gcs
|
||||
versioning = true
|
||||
depends_on = [module.organization]
|
||||
}
|
||||
|
||||
module "automation-tf-bootstrap-sa" {
|
||||
@@ -250,13 +248,12 @@ module "automation-tf-bootstrap-r-sa" {
|
||||
# resource hierarchy stage's bucket and service account
|
||||
|
||||
module "automation-tf-resman-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
project_id = module.automation-project.project_id
|
||||
name = "iac-core-resman-0"
|
||||
prefix = local.prefix
|
||||
location = local.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
project_id = module.automation-project.project_id
|
||||
name = "iac-core-resman-0"
|
||||
prefix = local.prefix
|
||||
location = local.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.automation-tf-resman-sa.iam_email]
|
||||
"roles/storage.objectViewer" = [module.automation-tf-resman-r-sa.iam_email]
|
||||
@@ -329,13 +326,12 @@ module "automation-tf-resman-r-sa" {
|
||||
# VPC SC stage's bucket and service account
|
||||
|
||||
module "automation-tf-vpcsc-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
project_id = module.automation-project.project_id
|
||||
name = "iac-core-vpcsc-0"
|
||||
prefix = local.prefix
|
||||
location = local.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
project_id = module.automation-project.project_id
|
||||
name = "iac-core-vpcsc-0"
|
||||
prefix = local.prefix
|
||||
location = local.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.automation-tf-vpcsc-sa.iam_email]
|
||||
"roles/storage.objectViewer" = [module.automation-tf-vpcsc-r-sa.iam_email]
|
||||
|
||||
@@ -128,15 +128,14 @@ check "checklist" {
|
||||
# checklist files bucket
|
||||
|
||||
module "automation-tf-checklist-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
count = local.uses_checklist ? 1 : 0
|
||||
project_id = module.automation-project.project_id
|
||||
name = "iac-core-checklist-0"
|
||||
prefix = local.prefix
|
||||
location = local.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
depends_on = [module.organization]
|
||||
source = "../../../modules/gcs"
|
||||
count = local.uses_checklist ? 1 : 0
|
||||
project_id = module.automation-project.project_id
|
||||
name = "iac-core-checklist-0"
|
||||
prefix = local.prefix
|
||||
location = local.locations.gcs
|
||||
versioning = true
|
||||
depends_on = [module.organization]
|
||||
}
|
||||
|
||||
resource "google_storage_bucket_object" "checklist_data" {
|
||||
|
||||
@@ -75,13 +75,12 @@ module "log-export-dataset" {
|
||||
}
|
||||
|
||||
module "log-export-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
count = contains(local.log_types, "storage") ? 1 : 0
|
||||
project_id = module.log-export-project.project_id
|
||||
name = "logs"
|
||||
prefix = local.prefix
|
||||
location = local.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
source = "../../../modules/gcs"
|
||||
count = contains(local.log_types, "storage") ? 1 : 0
|
||||
project_id = module.log-export-project.project_id
|
||||
name = "logs"
|
||||
prefix = local.prefix
|
||||
location = local.locations.gcs
|
||||
}
|
||||
|
||||
module "log-export-logbucket" {
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Copyright 2022 Google LLC
|
||||
* Copyright 2024 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -16,11 +16,6 @@
|
||||
|
||||
locals {
|
||||
env_default = [for k, v in var.environments : k if v.is_default][0]
|
||||
gcs_storage_class = (
|
||||
length(split("-", local.locations.gcs)) < 2
|
||||
? "MULTI_REGIONAL"
|
||||
: "REGIONAL"
|
||||
)
|
||||
principals = {
|
||||
for k, v in var.groups : k => (
|
||||
can(regex("^[a-zA-Z]+:", v))
|
||||
|
||||
@@ -169,14 +169,13 @@ module "branch-dp-prod-r-sa" {
|
||||
# automation buckets
|
||||
|
||||
module "branch-dp-dev-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.data_platform ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "dev-resman-dp-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.data_platform ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "dev-resman-dp-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.branch-dp-dev-sa[0].iam_email]
|
||||
"roles/storage.objectViewer" = [module.branch-dp-dev-r-sa[0].iam_email]
|
||||
@@ -184,14 +183,13 @@ module "branch-dp-dev-gcs" {
|
||||
}
|
||||
|
||||
module "branch-dp-prod-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.data_platform ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-dp-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.data_platform ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-dp-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.branch-dp-prod-sa[0].iam_email]
|
||||
"roles/storage.objectViewer" = [module.branch-dp-prod-r-sa[0].iam_email]
|
||||
|
||||
@@ -170,14 +170,13 @@ module "branch-gcve-prod-r-sa" {
|
||||
# automation buckets
|
||||
|
||||
module "branch-gcve-dev-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.gcve ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "dev-resman-gcve-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.gcve ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "dev-resman-gcve-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.branch-gcve-dev-sa[0].iam_email]
|
||||
"roles/storage.objectViewer" = [module.branch-gcve-dev-r-sa[0].iam_email]
|
||||
@@ -185,14 +184,13 @@ module "branch-gcve-dev-gcs" {
|
||||
}
|
||||
|
||||
module "branch-gcve-prod-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.gcve ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-gcve-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.gcve ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-gcve-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.branch-gcve-prod-sa[0].iam_email]
|
||||
"roles/storage.objectViewer" = [module.branch-gcve-prod-r-sa[0].iam_email]
|
||||
|
||||
@@ -170,14 +170,13 @@ module "branch-gke-prod-r-sa" {
|
||||
# automation buckets
|
||||
|
||||
module "branch-gke-dev-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.gke ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "dev-resman-gke-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.gke ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "dev-resman-gke-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.branch-gke-dev-sa[0].iam_email]
|
||||
"roles/storage.objectViewer" = [module.branch-gke-dev-r-sa[0].iam_email]
|
||||
@@ -185,14 +184,13 @@ module "branch-gke-dev-gcs" {
|
||||
}
|
||||
|
||||
module "branch-gke-prod-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.gke ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-gke-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.gke ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-gke-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.branch-gke-prod-sa[0].iam_email]
|
||||
"roles/storage.objectViewer" = [module.branch-gke-prod-r-sa[0].iam_email]
|
||||
|
||||
@@ -187,13 +187,12 @@ module "branch-network-r-sa" {
|
||||
# automation bucket
|
||||
|
||||
module "branch-network-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-net-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-net-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.branch-network-sa.iam_email]
|
||||
"roles/storage.objectViewer" = [module.branch-network-r-sa.iam_email]
|
||||
|
||||
@@ -79,14 +79,13 @@ moved {
|
||||
}
|
||||
|
||||
module "branch-nsec-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.nsec ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-nsec-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.nsec ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-nsec-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.branch-nsec-sa[0].iam_email]
|
||||
"roles/storage.objectViewer" = [module.branch-nsec-r-sa[0].iam_email]
|
||||
|
||||
@@ -172,13 +172,12 @@ moved {
|
||||
}
|
||||
|
||||
module "branch-pf-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
project_id = var.automation.project_id
|
||||
name = "resman-pf-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
project_id = var.automation.project_id
|
||||
name = "resman-pf-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.branch-pf-sa.iam_email]
|
||||
"roles/storage.objectViewer" = [module.branch-pf-r-sa.iam_email]
|
||||
@@ -191,13 +190,12 @@ moved {
|
||||
}
|
||||
|
||||
module "branch-pf-dev-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
project_id = var.automation.project_id
|
||||
name = "dev-resman-pf-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
project_id = var.automation.project_id
|
||||
name = "dev-resman-pf-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.branch-pf-dev-sa.iam_email]
|
||||
"roles/storage.objectViewer" = [module.branch-pf-dev-r-sa.iam_email]
|
||||
@@ -210,13 +208,12 @@ moved {
|
||||
}
|
||||
|
||||
module "branch-pf-prod-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-pf-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-pf-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.branch-pf-prod-sa.iam_email]
|
||||
"roles/storage.objectViewer" = [module.branch-pf-prod-r-sa.iam_email]
|
||||
|
||||
@@ -55,14 +55,13 @@ module "branch-sandbox-folder" {
|
||||
}
|
||||
|
||||
module "branch-sandbox-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.sandbox ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "dev-resman-sbox-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
count = var.fast_features.sandbox ? 1 : 0
|
||||
project_id = var.automation.project_id
|
||||
name = "dev-resman-sbox-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.branch-sandbox-sa[0].iam_email]
|
||||
}
|
||||
|
||||
@@ -104,13 +104,12 @@ module "branch-security-r-sa" {
|
||||
# automation bucket
|
||||
|
||||
module "branch-security-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-sec-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-sec-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.branch-security-sa.iam_email]
|
||||
"roles/storage.objectViewer" = [module.branch-security-r-sa.iam_email]
|
||||
|
||||
@@ -74,11 +74,6 @@ locals {
|
||||
]
|
||||
}
|
||||
custom_roles = coalesce(var.custom_roles, {})
|
||||
gcs_storage_class = (
|
||||
length(split("-", var.locations.gcs)) < 2
|
||||
? "MULTI_REGIONAL"
|
||||
: "REGIONAL"
|
||||
)
|
||||
identity_providers = coalesce(
|
||||
try(var.automation.federated_identity_providers, null), {}
|
||||
)
|
||||
|
||||
@@ -84,11 +84,10 @@ module "log-export-gcs" {
|
||||
count = (
|
||||
var.root_node != null && contains(local.log_types, "storage") ? 1 : 0
|
||||
)
|
||||
project_id = var.logging.project_id
|
||||
name = "logs"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
project_id = var.logging.project_id
|
||||
name = "logs"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
}
|
||||
|
||||
module "log-export-logbucket" {
|
||||
|
||||
@@ -123,14 +123,13 @@ module "top-level-sa" {
|
||||
}
|
||||
|
||||
module "top-level-bucket" {
|
||||
source = "../../../modules/gcs"
|
||||
for_each = local.top_level_automation
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-${each.key}-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
storage_class = local.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
for_each = local.top_level_automation
|
||||
project_id = var.automation.project_id
|
||||
name = "prod-resman-${each.key}-0"
|
||||
prefix = var.prefix
|
||||
location = var.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.top-level-sa[each.key].iam_email]
|
||||
"roles/storage.objectViewer" = [module.top-level-sa[each.key].iam_email]
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
*/
|
||||
|
||||
locals {
|
||||
_tenants = {
|
||||
tenants = {
|
||||
for k, v in var.tenant_configs : k => merge(v, {
|
||||
billing_account = merge(v.billing_account, {
|
||||
id = coalesce(v.billing_account.id, var.billing_account.id)
|
||||
@@ -29,15 +29,6 @@ locals {
|
||||
organization = coalesce(v.cloud_identity, var.organization)
|
||||
})
|
||||
}
|
||||
tenants = {
|
||||
for k, v in local._tenants : k => merge(v, {
|
||||
gcs_storage_class = (
|
||||
length(split("-", v.locations.gcs)) < 2
|
||||
? "MULTI_REGIONAL"
|
||||
: "REGIONAL"
|
||||
)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
module "organization" {
|
||||
|
||||
@@ -173,27 +173,25 @@ module "tenant-automation-project-iam" {
|
||||
# output files bucket
|
||||
|
||||
module "tenant-automation-tf-output-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
for_each = local.fast_tenants
|
||||
project_id = module.tenant-automation-project[each.key].project_id
|
||||
name = "iac-core-outputs-0"
|
||||
prefix = each.value.stage_0_prefix
|
||||
location = each.value.locations.gcs
|
||||
storage_class = each.value.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
for_each = local.fast_tenants
|
||||
project_id = module.tenant-automation-project[each.key].project_id
|
||||
name = "iac-core-outputs-0"
|
||||
prefix = each.value.stage_0_prefix
|
||||
location = each.value.locations.gcs
|
||||
versioning = true
|
||||
}
|
||||
|
||||
# resource hierarchy stage's bucket and service account
|
||||
|
||||
module "tenant-automation-tf-resman-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
for_each = local.fast_tenants
|
||||
project_id = module.tenant-automation-project[each.key].project_id
|
||||
name = "iac-core-resman-0"
|
||||
prefix = each.value.stage_0_prefix
|
||||
location = each.value.locations.gcs
|
||||
storage_class = each.value.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
for_each = local.fast_tenants
|
||||
project_id = module.tenant-automation-project[each.key].project_id
|
||||
name = "iac-core-resman-0"
|
||||
prefix = each.value.stage_0_prefix
|
||||
location = each.value.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [
|
||||
module.tenant-automation-tf-resman-sa[each.key].iam_email
|
||||
|
||||
@@ -111,14 +111,13 @@ module "tenant-sa" {
|
||||
# automation bucket
|
||||
|
||||
module "tenant-gcs" {
|
||||
source = "../../../modules/gcs"
|
||||
for_each = local.tenants
|
||||
project_id = var.automation.project_id
|
||||
name = "tenant-${each.key}-0"
|
||||
prefix = var.prefix
|
||||
location = each.value.locations.gcs
|
||||
storage_class = each.value.gcs_storage_class
|
||||
versioning = true
|
||||
source = "../../../modules/gcs"
|
||||
for_each = local.tenants
|
||||
project_id = var.automation.project_id
|
||||
name = "tenant-${each.key}-0"
|
||||
prefix = var.prefix
|
||||
location = each.value.locations.gcs
|
||||
versioning = true
|
||||
iam = {
|
||||
"roles/storage.objectAdmin" = [module.tenant-sa[each.key].iam_email]
|
||||
}
|
||||
|
||||
@@ -9,6 +9,7 @@
|
||||
- [Object upload](#object-upload)
|
||||
- [IAM](#iam)
|
||||
- [Tag Bindings](#tag-bindings)
|
||||
- [Managed Folders](#managed-folders)
|
||||
- [Variables](#variables)
|
||||
- [Outputs](#outputs)
|
||||
<!-- END TOC -->
|
||||
@@ -281,15 +282,37 @@ module "bucket" {
|
||||
}
|
||||
# tftest modules=2 resources=6
|
||||
```
|
||||
|
||||
## Managed Folders
|
||||
```hcl
|
||||
module "bucket" {
|
||||
source = "./fabric/modules/gcs"
|
||||
project_id = var.project_id
|
||||
prefix = var.prefix
|
||||
name = "my-bucket"
|
||||
location = "EU"
|
||||
managed_folders = {
|
||||
folder1 = {
|
||||
iam = {
|
||||
"roles/storage.admin" = ["user:user1@example.com"]
|
||||
}
|
||||
}
|
||||
"folder1/subfolder" = {
|
||||
force_destroy = true
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest inventory=managed-folders.yaml
|
||||
```
|
||||
<!-- BEGIN TFDOC -->
|
||||
## Variables
|
||||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [location](variables.tf#L149) | Bucket location. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L164) | Bucket name suffix. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L220) | Bucket project id. | <code>string</code> | ✓ | |
|
||||
| [autoclass](variables.tf#L17) | Enable autoclass to automatically transition objects to appropriate storage classes based on their access pattern. If set to true, storage_class must be set to STANDARD. Defaults to false. | <code>bool</code> | | <code>false</code> |
|
||||
| [location](variables.tf#L156) | Bucket location. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L199) | Bucket name suffix. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L255) | Bucket project id. | <code>string</code> | ✓ | |
|
||||
| [autoclass](variables.tf#L17) | Enable autoclass to automatically transition objects to appropriate storage classes based on their access pattern. If set to true, storage_class must be set to STANDARD. Defaults to false. | <code>bool</code> | | <code>null</code> |
|
||||
| [cors](variables.tf#L23) | CORS configuration for the bucket. Defaults to null. | <code title="object({ origin = optional(list(string)) method = optional(list(string)) response_header = optional(list(string)) max_age_seconds = optional(number) })">object({…})</code> | | <code>null</code> |
|
||||
| [custom_placement_config](variables.tf#L34) | The bucket's custom location configuration, which specifies the individual regions that comprise a dual-region bucket. If the bucket is designated as REGIONAL or MULTI_REGIONAL, the parameters are empty. | <code>list(string)</code> | | <code>null</code> |
|
||||
| [default_event_based_hold](variables.tf#L40) | Enable event based hold to new objects added to specific bucket, defaults to false. | <code>bool</code> | | <code>null</code> |
|
||||
@@ -298,21 +321,24 @@ module "bucket" {
|
||||
| [iam](variables.tf#L58) | IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [iam_bindings](variables.tf#L64) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code title="map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_bindings_additive](variables.tf#L79) | Individual additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [labels](variables.tf#L94) | Labels to be attached to all buckets. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [lifecycle_rules](variables.tf#L100) | Bucket lifecycle rule. | <code title="map(object({ action = object({ type = string storage_class = optional(string) }) condition = object({ age = optional(number) created_before = optional(string) custom_time_before = optional(string) days_since_custom_time = optional(number) days_since_noncurrent_time = optional(number) matches_prefix = optional(list(string)) matches_storage_class = optional(list(string)) # STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE, DURABLE_REDUCED_AVAILABILITY matches_suffix = optional(list(string)) noncurrent_time_before = optional(string) num_newer_versions = optional(number) with_state = optional(string) # "LIVE", "ARCHIVED", "ANY" }) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [logging_config](variables.tf#L155) | Bucket logging configuration. | <code title="object({ log_bucket = string log_object_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [notification_config](variables.tf#L169) | GCS Notification configuration. | <code title="object({ enabled = bool payload_format = string topic_name = string sa_email = string create_topic = optional(bool, true) event_types = optional(list(string)) custom_attributes = optional(map(string)) object_name_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [objects_to_upload](variables.tf#L184) | Objects to be uploaded to bucket. | <code title="map(object({ name = string metadata = optional(map(string)) content = optional(string) source = optional(string) cache_control = optional(string) content_disposition = optional(string) content_encoding = optional(string) content_language = optional(string) content_type = optional(string) event_based_hold = optional(bool) temporary_hold = optional(bool) detect_md5hash = optional(string) storage_class = optional(string) kms_key_name = optional(string) customer_encryption = optional(object({ encryption_algorithm = optional(string) encryption_key = string })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L210) | Optional prefix used to generate the bucket name. | <code>string</code> | | <code>null</code> |
|
||||
| [public_access_prevention](variables.tf#L225) | Prevents public access to a bucket. Acceptable values are inherited or enforced. If inherited, the bucket uses public access prevention, only if the bucket is subject to the public access prevention organization policy constraint. | <code>string</code> | | <code>null</code> |
|
||||
| [requester_pays](variables.tf#L231) | Enables Requester Pays on a storage bucket. | <code>bool</code> | | <code>null</code> |
|
||||
| [retention_policy](variables.tf#L237) | Bucket retention policy. | <code title="object({ retention_period = number is_locked = optional(bool) })">object({…})</code> | | <code>null</code> |
|
||||
| [soft_delete_retention](variables.tf#L246) | The duration in seconds that soft-deleted objects in the bucket will be retained and cannot be permanently deleted. Set to 0 to override the default and disable. | <code>number</code> | | <code>null</code> |
|
||||
| [storage_class](variables.tf#L252) | Bucket storage class. | <code>string</code> | | <code>"MULTI_REGIONAL"</code> |
|
||||
| [tag_bindings](variables.tf#L262) | Tag bindings for this folder, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [uniform_bucket_level_access](variables.tf#L269) | Allow using object ACLs (false) or not (true, this is the recommended behavior) , defaults to true (which is the recommended practice, but not the behavior of storage API). | <code>bool</code> | | <code>true</code> |
|
||||
| [versioning](variables.tf#L275) | Enable versioning, defaults to false. | <code>bool</code> | | <code>false</code> |
|
||||
| [website](variables.tf#L281) | Bucket website. | <code title="object({ main_page_suffix = optional(string) not_found_page = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [iam_by_principals](variables.tf#L94) | Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid cycle errors. Merged internally with the `iam` variable. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [labels](variables.tf#L101) | Labels to be attached to all buckets. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [lifecycle_rules](variables.tf#L107) | Bucket lifecycle rule. | <code title="map(object({ action = object({ type = string storage_class = optional(string) }) condition = object({ age = optional(number) created_before = optional(string) custom_time_before = optional(string) days_since_custom_time = optional(number) days_since_noncurrent_time = optional(number) matches_prefix = optional(list(string)) matches_storage_class = optional(list(string)) # STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE, DURABLE_REDUCED_AVAILABILITY matches_suffix = optional(list(string)) noncurrent_time_before = optional(string) num_newer_versions = optional(number) with_state = optional(string) # "LIVE", "ARCHIVED", "ANY" }) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [logging_config](variables.tf#L162) | Bucket logging configuration. | <code title="object({ log_bucket = string log_object_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [managed_folders](variables.tf#L171) | Managed folders to create within the bucket in {PATH => CONFIG} format. | <code title="map(object({ force_destroy = optional(bool, false) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [notification_config](variables.tf#L204) | GCS Notification configuration. | <code title="object({ enabled = bool payload_format = string topic_name = string sa_email = string create_topic = optional(bool, true) event_types = optional(list(string)) custom_attributes = optional(map(string)) object_name_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [objects_to_upload](variables.tf#L219) | Objects to be uploaded to bucket. | <code title="map(object({ name = string metadata = optional(map(string)) content = optional(string) source = optional(string) cache_control = optional(string) content_disposition = optional(string) content_encoding = optional(string) content_language = optional(string) content_type = optional(string) event_based_hold = optional(bool) temporary_hold = optional(bool) detect_md5hash = optional(string) storage_class = optional(string) kms_key_name = optional(string) customer_encryption = optional(object({ encryption_algorithm = optional(string) encryption_key = string })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L245) | Optional prefix used to generate the bucket name. | <code>string</code> | | <code>null</code> |
|
||||
| [public_access_prevention](variables.tf#L260) | Prevents public access to the bucket. | <code>string</code> | | <code>null</code> |
|
||||
| [requester_pays](variables.tf#L270) | Enables Requester Pays on a storage bucket. | <code>bool</code> | | <code>null</code> |
|
||||
| [retention_policy](variables.tf#L276) | Bucket retention policy. | <code title="object({ retention_period = number is_locked = optional(bool) })">object({…})</code> | | <code>null</code> |
|
||||
| [rpo](variables.tf#L285) | Bucket recovery point objective. | <code>string</code> | | <code>null</code> |
|
||||
| [soft_delete_retention](variables.tf#L295) | The duration in seconds that soft-deleted objects in the bucket will be retained and cannot be permanently deleted. Set to 0 to override the default and disable. | <code>number</code> | | <code>null</code> |
|
||||
| [storage_class](variables.tf#L301) | Bucket storage class. | <code>string</code> | | <code>"STANDARD"</code> |
|
||||
| [tag_bindings](variables.tf#L311) | Tag bindings for this folder, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [uniform_bucket_level_access](variables.tf#L318) | Allow using object ACLs (false) or not (true, this is the recommended behavior) , defaults to true (which is the recommended practice, but not the behavior of storage API). | <code>bool</code> | | <code>true</code> |
|
||||
| [versioning](variables.tf#L324) | Enable versioning, defaults to false. | <code>bool</code> | | <code>null</code> |
|
||||
| [website](variables.tf#L330) | Bucket website. | <code title="object({ main_page_suffix = optional(string) not_found_page = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Copyright 2023 Google LLC
|
||||
* Copyright 2024 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -16,8 +16,25 @@
|
||||
|
||||
# tfdoc:file:description IAM bindings
|
||||
|
||||
locals {
|
||||
_iam_principal_roles = distinct(flatten(values(var.iam_by_principals)))
|
||||
_iam_principals = {
|
||||
for r in local._iam_principal_roles : r => [
|
||||
for k, v in var.iam_by_principals :
|
||||
k if try(index(v, r), null) != null
|
||||
]
|
||||
}
|
||||
iam = {
|
||||
for role in distinct(concat(keys(var.iam), keys(local._iam_principals))) :
|
||||
role => concat(
|
||||
try(var.iam[role], []),
|
||||
try(local._iam_principals[role], [])
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
resource "google_storage_bucket_iam_binding" "authoritative" {
|
||||
for_each = var.iam
|
||||
for_each = local.iam
|
||||
bucket = google_storage_bucket.bucket.name
|
||||
role = each.key
|
||||
members = each.value
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Copyright 2023 Google LLC
|
||||
* Copyright 2024 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -30,8 +30,13 @@ resource "google_storage_bucket" "bucket" {
|
||||
default_event_based_hold = var.default_event_based_hold
|
||||
requester_pays = var.requester_pays
|
||||
public_access_prevention = var.public_access_prevention
|
||||
versioning {
|
||||
enabled = var.versioning
|
||||
rpo = var.rpo
|
||||
|
||||
dynamic "versioning" {
|
||||
for_each = var.versioning == null ? [] : [""]
|
||||
content {
|
||||
enabled = var.versioning
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "autoclass" {
|
||||
@@ -165,12 +170,14 @@ resource "google_storage_notification" "notification" {
|
||||
object_name_prefix = var.notification_config.object_name_prefix
|
||||
depends_on = [google_pubsub_topic_iam_binding.binding]
|
||||
}
|
||||
|
||||
resource "google_pubsub_topic_iam_binding" "binding" {
|
||||
count = try(var.notification_config.create_topic, null) == true ? 1 : 0
|
||||
topic = google_pubsub_topic.topic[0].id
|
||||
role = "roles/pubsub.publisher"
|
||||
members = ["serviceAccount:${var.notification_config.sa_email}"]
|
||||
}
|
||||
|
||||
resource "google_pubsub_topic" "topic" {
|
||||
count = try(var.notification_config.create_topic, null) == true ? 1 : 0
|
||||
project = var.project_id
|
||||
|
||||
109
modules/gcs/managed-folders.tf
Normal file
109
modules/gcs/managed-folders.tf
Normal file
@@ -0,0 +1,109 @@
|
||||
/**
|
||||
* Copyright 2024 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
locals {
|
||||
# ensure all keys end with / as required by
|
||||
# google_storage_managed_folder
|
||||
managed_folders = {
|
||||
for k, v in var.managed_folders :
|
||||
(endswith(k, "/") ? k : "${k}/") => v
|
||||
}
|
||||
|
||||
managed_folder_iam = flatten([
|
||||
for k, v in local.managed_folders : [
|
||||
for role, members in v.iam : {
|
||||
managed_folder = k
|
||||
role = role
|
||||
members = members
|
||||
}
|
||||
]
|
||||
])
|
||||
managed_folder_iam_bindings = merge([
|
||||
for k, v in local.managed_folders : {
|
||||
for binding_key, data in v.iam_bindings :
|
||||
"${k}.${binding_key}" => {
|
||||
managed_folder = k
|
||||
role = data.role
|
||||
members = data.members
|
||||
condition = data.condition
|
||||
}
|
||||
}
|
||||
]...)
|
||||
managed_folder_iam_bindings_additive = merge([
|
||||
for k, v in local.managed_folders : {
|
||||
for binding_key, data in v.iam_bindings_additive :
|
||||
"${k}.${binding_key}" => {
|
||||
managed_folder = k
|
||||
role = data.role
|
||||
member = data.member
|
||||
condition = data.condition
|
||||
}
|
||||
}
|
||||
]...)
|
||||
}
|
||||
|
||||
|
||||
resource "google_storage_managed_folder" "folder" {
|
||||
for_each = local.managed_folders
|
||||
bucket = google_storage_bucket.bucket.name
|
||||
name = each.key
|
||||
force_destroy = each.value.force_destroy
|
||||
}
|
||||
|
||||
resource "google_storage_managed_folder_iam_binding" "authoritative" {
|
||||
for_each = {
|
||||
for binding in local.managed_folder_iam :
|
||||
"${binding.managed_folder}.${binding.role}" => binding
|
||||
}
|
||||
role = each.value.role
|
||||
members = each.value.members
|
||||
bucket = google_storage_bucket.bucket.name
|
||||
managed_folder = google_storage_managed_folder.folder[each.value.managed_folder].name
|
||||
}
|
||||
|
||||
resource "google_storage_managed_folder_iam_binding" "bindings" {
|
||||
for_each = local.managed_folder_iam_bindings
|
||||
role = each.value.role
|
||||
members = each.value.members
|
||||
bucket = google_storage_bucket.bucket.name
|
||||
managed_folder = google_storage_managed_folder.folder[each.value.managed_folder].name
|
||||
|
||||
dynamic "condition" {
|
||||
for_each = each.value.condition == null ? [] : [""]
|
||||
content {
|
||||
expression = each.value.condition.expression
|
||||
title = each.value.condition.title
|
||||
description = each.value.condition.description
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "google_storage_managed_folder_iam_member" "members" {
|
||||
for_each = local.managed_folder_iam_bindings_additive
|
||||
role = each.value.role
|
||||
member = each.value.member
|
||||
bucket = google_storage_bucket.bucket.name
|
||||
managed_folder = google_storage_managed_folder.folder[each.value.managed_folder].name
|
||||
|
||||
dynamic "condition" {
|
||||
for_each = each.value.condition == null ? [] : [""]
|
||||
content {
|
||||
expression = each.value.condition.expression
|
||||
title = each.value.condition.title
|
||||
description = each.value.condition.description
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Copyright 2023 Google LLC
|
||||
* Copyright 2024 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -17,7 +17,7 @@
|
||||
variable "autoclass" {
|
||||
description = "Enable autoclass to automatically transition objects to appropriate storage classes based on their access pattern. If set to true, storage_class must be set to STANDARD. Defaults to false."
|
||||
type = bool
|
||||
default = false
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "cors" {
|
||||
@@ -91,6 +91,13 @@ variable "iam_bindings_additive" {
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "iam_by_principals" {
|
||||
description = "Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid cycle errors. Merged internally with the `iam` variable."
|
||||
type = map(list(string))
|
||||
default = {}
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "labels" {
|
||||
description = "Labels to be attached to all buckets."
|
||||
type = map(string)
|
||||
@@ -161,6 +168,34 @@ variable "logging_config" {
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "managed_folders" {
|
||||
description = "Managed folders to create within the bucket in {PATH => CONFIG} format."
|
||||
type = map(object({
|
||||
force_destroy = optional(bool, false)
|
||||
iam = optional(map(list(string)), {})
|
||||
iam_bindings = optional(map(object({
|
||||
members = list(string)
|
||||
role = string
|
||||
condition = optional(object({
|
||||
expression = string
|
||||
title = string
|
||||
description = optional(string)
|
||||
}))
|
||||
})), {})
|
||||
iam_bindings_additive = optional(map(object({
|
||||
member = string
|
||||
role = string
|
||||
condition = optional(object({
|
||||
expression = string
|
||||
title = string
|
||||
description = optional(string)
|
||||
}))
|
||||
})), {})
|
||||
}))
|
||||
default = {}
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "name" {
|
||||
description = "Bucket name suffix."
|
||||
type = string
|
||||
@@ -223,9 +258,13 @@ variable "project_id" {
|
||||
}
|
||||
|
||||
variable "public_access_prevention" {
|
||||
description = "Prevents public access to a bucket. Acceptable values are inherited or enforced. If inherited, the bucket uses public access prevention, only if the bucket is subject to the public access prevention organization policy constraint."
|
||||
description = "Prevents public access to the bucket."
|
||||
type = string
|
||||
default = null
|
||||
validation {
|
||||
condition = var.public_access_prevention == null || contains(["enforced", "inherited"], coalesce(var.public_access_prevention, "none"))
|
||||
error_message = "public_access_prevention must be either enforced or inherited."
|
||||
}
|
||||
}
|
||||
|
||||
variable "requester_pays" {
|
||||
@@ -243,6 +282,16 @@ variable "retention_policy" {
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "rpo" {
|
||||
description = "Bucket recovery point objective."
|
||||
type = string
|
||||
default = null
|
||||
validation {
|
||||
condition = var.rpo == null || contains(["ASYNC_TURBO", "DEFAULT"], coalesce(var.rpo, "none"))
|
||||
error_message = "rpo must be one of ASYNC_TURBO, DEFAULT."
|
||||
}
|
||||
}
|
||||
|
||||
variable "soft_delete_retention" {
|
||||
description = "The duration in seconds that soft-deleted objects in the bucket will be retained and cannot be permanently deleted. Set to 0 to override the default and disable."
|
||||
type = number
|
||||
@@ -252,7 +301,7 @@ variable "soft_delete_retention" {
|
||||
variable "storage_class" {
|
||||
description = "Bucket storage class."
|
||||
type = string
|
||||
default = "MULTI_REGIONAL"
|
||||
default = "STANDARD"
|
||||
validation {
|
||||
condition = contains(["STANDARD", "MULTI_REGIONAL", "REGIONAL", "NEARLINE", "COLDLINE", "ARCHIVE"], var.storage_class)
|
||||
error_message = "Storage class must be one of STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE."
|
||||
@@ -275,7 +324,7 @@ variable "uniform_bucket_level_access" {
|
||||
variable "versioning" {
|
||||
description = "Enable versioning, defaults to false."
|
||||
type = bool
|
||||
default = false
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "website" {
|
||||
|
||||
@@ -79,7 +79,7 @@ module "automation-buckets" {
|
||||
}
|
||||
labels = lookup(each.value, "labels", {})
|
||||
location = lookup(each.value, "location", "EU")
|
||||
storage_class = lookup(each.value, "storage_class", "MULTI_REGIONAL")
|
||||
storage_class = lookup(each.value, "storage_class", "STANDARD")
|
||||
uniform_bucket_level_access = lookup(each.value, "uniform_bucket_level_access", true)
|
||||
versioning = lookup(each.value, "versioning", false)
|
||||
}
|
||||
|
||||
@@ -699,8 +699,7 @@ values:
|
||||
service: servicenetworking.googleapis.com
|
||||
timeouts: null
|
||||
module.automation-tf-bootstrap-gcs.google_storage_bucket.bucket:
|
||||
autoclass:
|
||||
- enabled: false
|
||||
autoclass: []
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
@@ -715,7 +714,7 @@ values:
|
||||
project: fast-prod-iac-core-0
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
storage_class: STANDARD
|
||||
timeouts: null
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
@@ -761,8 +760,7 @@ values:
|
||||
condition: []
|
||||
role: roles/storage.admin
|
||||
module.automation-tf-checklist-gcs[0].google_storage_bucket.bucket:
|
||||
autoclass:
|
||||
- enabled: false
|
||||
autoclass: []
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
@@ -777,14 +775,13 @@ values:
|
||||
project: fast-prod-iac-core-0
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
storage_class: STANDARD
|
||||
timeouts: null
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
- enabled: true
|
||||
module.automation-tf-output-gcs.google_storage_bucket.bucket:
|
||||
autoclass:
|
||||
- enabled: false
|
||||
autoclass: []
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
@@ -799,14 +796,13 @@ values:
|
||||
project: fast-prod-iac-core-0
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
storage_class: STANDARD
|
||||
timeouts: null
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
- enabled: true
|
||||
module.automation-tf-resman-gcs.google_storage_bucket.bucket:
|
||||
autoclass:
|
||||
- enabled: false
|
||||
autoclass: []
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
@@ -821,7 +817,7 @@ values:
|
||||
project: fast-prod-iac-core-0
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
storage_class: STANDARD
|
||||
timeouts: null
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
@@ -871,8 +867,7 @@ values:
|
||||
condition: []
|
||||
role: roles/storage.admin
|
||||
module.automation-tf-vpcsc-gcs.google_storage_bucket.bucket:
|
||||
autoclass:
|
||||
- enabled: false
|
||||
autoclass: []
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
@@ -887,7 +882,7 @@ values:
|
||||
project: fast-prod-iac-core-0
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
storage_class: STANDARD
|
||||
timeouts: null
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
|
||||
@@ -121,8 +121,7 @@ values:
|
||||
condition: []
|
||||
role: roles/storage.objectCreator
|
||||
module.gcs.google_storage_bucket.bucket:
|
||||
autoclass:
|
||||
- enabled: false
|
||||
autoclass: []
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
@@ -137,10 +136,8 @@ values:
|
||||
project: project-id
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
storage_class: STANDARD
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
- enabled: false
|
||||
module.pubsub.google_pubsub_topic.default:
|
||||
kms_key_name: null
|
||||
labels: null
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Copyright 2023 Google LLC
|
||||
# Copyright 2024 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
@@ -27,13 +27,10 @@ values:
|
||||
project: project-id
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
storage_class: STANDARD
|
||||
timeouts: null
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
- enabled: false
|
||||
autoclass:
|
||||
- enabled: false
|
||||
autoclass: []
|
||||
module.bucket.google_storage_bucket_iam_binding.authoritative["roles/storage.admin"]:
|
||||
bucket: test-my-bucket
|
||||
condition: []
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Copyright 2023 Google LLC
|
||||
# Copyright 2024 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
@@ -27,13 +27,10 @@ values:
|
||||
project: project-id
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
storage_class: STANDARD
|
||||
timeouts: null
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
- enabled: false
|
||||
autoclass:
|
||||
- enabled: false
|
||||
autoclass: []
|
||||
module.bucket.google_storage_bucket_iam_member.bindings["storage-admin-with-delegated_roles"]:
|
||||
bucket: test-my-bucket
|
||||
condition:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Copyright 2023 Google LLC
|
||||
# Copyright 2024 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
@@ -27,13 +27,10 @@ values:
|
||||
project: project-id
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
storage_class: STANDARD
|
||||
timeouts: null
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
- enabled: false
|
||||
autoclass:
|
||||
- enabled: false
|
||||
autoclass: []
|
||||
module.bucket.google_storage_bucket_iam_binding.bindings["storage-admin-with-delegated_roles"]:
|
||||
bucket: test-my-bucket
|
||||
condition:
|
||||
|
||||
60
tests/modules/gcs/examples/managed-folders.yaml
Normal file
60
tests/modules/gcs/examples/managed-folders.yaml
Normal file
@@ -0,0 +1,60 @@
|
||||
# Copyright 2024 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
values:
|
||||
module.bucket.google_storage_bucket.bucket:
|
||||
autoclass: []
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
enable_object_retention: null
|
||||
encryption: []
|
||||
force_destroy: false
|
||||
labels: null
|
||||
lifecycle_rule: []
|
||||
location: EU
|
||||
logging: []
|
||||
name: test-my-bucket
|
||||
project: project-id
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: STANDARD
|
||||
timeouts: null
|
||||
uniform_bucket_level_access: true
|
||||
module.bucket.google_storage_managed_folder.folder["folder1/"]:
|
||||
bucket: test-my-bucket
|
||||
force_destroy: false
|
||||
name: folder1/
|
||||
timeouts: null
|
||||
module.bucket.google_storage_managed_folder.folder["folder1/subfolder/"]:
|
||||
bucket: test-my-bucket
|
||||
force_destroy: true
|
||||
name: folder1/subfolder/
|
||||
timeouts: null
|
||||
module.bucket.google_storage_managed_folder_iam_binding.authoritative["folder1/.roles/storage.admin"]:
|
||||
bucket: test-my-bucket
|
||||
condition: []
|
||||
managed_folder: folder1/
|
||||
members:
|
||||
- user:user1@example.com
|
||||
role: roles/storage.admin
|
||||
|
||||
counts:
|
||||
google_storage_bucket: 1
|
||||
google_storage_managed_folder: 2
|
||||
google_storage_managed_folder_iam_binding: 1
|
||||
modules: 1
|
||||
resources: 4
|
||||
|
||||
outputs: {}
|
||||
@@ -1,4 +1,4 @@
|
||||
# Copyright 2023 Google LLC
|
||||
# Copyright 2024 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
@@ -14,8 +14,7 @@
|
||||
|
||||
values:
|
||||
module.bucket.google_storage_bucket.bucket:
|
||||
autoclass:
|
||||
- enabled: false
|
||||
autoclass: []
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
@@ -30,7 +29,7 @@ values:
|
||||
project: project-id
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
storage_class: STANDARD
|
||||
timeouts: null
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
|
||||
@@ -14,8 +14,7 @@
|
||||
|
||||
values:
|
||||
module.bucket.google_storage_bucket.bucket:
|
||||
autoclass:
|
||||
- enabled: false
|
||||
autoclass: []
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
@@ -30,11 +29,9 @@ values:
|
||||
project: project-id
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
storage_class: STANDARD
|
||||
timeouts: null
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
- enabled: false
|
||||
module.bucket.google_tags_tag_binding.binding["env-sandbox"]:
|
||||
parent: //storage.googleapis.com/projects/_/buckets/test-my-bucket
|
||||
timeouts: null
|
||||
|
||||
@@ -49,8 +49,7 @@ values:
|
||||
project: test-dest-prj
|
||||
service: logging.googleapis.com
|
||||
module.gcs.google_storage_bucket.bucket:
|
||||
autoclass:
|
||||
- enabled: false
|
||||
autoclass: []
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
@@ -65,10 +64,8 @@ values:
|
||||
project: project-id
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
storage_class: STANDARD
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
- enabled: false
|
||||
module.org.google_bigquery_dataset_iam_member.bq-sinks-binding["info"]:
|
||||
condition: []
|
||||
role: roles/bigquery.dataEditor
|
||||
|
||||
@@ -47,8 +47,7 @@ values:
|
||||
project: project-id
|
||||
timeouts: null
|
||||
module.gcs.google_storage_bucket.bucket:
|
||||
autoclass:
|
||||
- enabled: false
|
||||
autoclass: []
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
@@ -63,11 +62,9 @@ values:
|
||||
project: project-id
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
storage_class: STANDARD
|
||||
timeouts: null
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
- enabled: false
|
||||
module.host-project.google_compute_shared_vpc_host_project.shared_vpc_host[0]:
|
||||
project: test-host
|
||||
timeouts: null
|
||||
|
||||
@@ -49,8 +49,7 @@ values:
|
||||
project: test-dest-prj
|
||||
service: logging.googleapis.com
|
||||
module.gcs.google_storage_bucket.bucket:
|
||||
autoclass:
|
||||
- enabled: false
|
||||
autoclass: []
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
@@ -65,10 +64,8 @@ values:
|
||||
project: project-id
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
storage_class: STANDARD
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
- enabled: false
|
||||
module.project-host.google_bigquery_dataset_iam_member.bq-sinks-binding["info"]:
|
||||
condition: []
|
||||
role: roles/bigquery.dataEditor
|
||||
|
||||
@@ -14,8 +14,7 @@
|
||||
|
||||
values:
|
||||
module.project-factory.module.automation-buckets["dev-tb-app0-0/state"].google_storage_bucket.bucket:
|
||||
autoclass:
|
||||
- enabled: false
|
||||
autoclass: []
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
@@ -30,11 +29,9 @@ values:
|
||||
project: test-pf-teams-iac-0
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
storage_class: STANDARD
|
||||
timeouts: null
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
- enabled: false
|
||||
? module.project-factory.module.automation-buckets["dev-tb-app0-0/state"].google_storage_bucket_iam_binding.authoritative["roles/storage.objectCreator"]
|
||||
: bucket: test-pf-dev-tb-app0-0-state
|
||||
condition: []
|
||||
|
||||
Reference in New Issue
Block a user