diff --git a/blueprints/data-solutions/shielded-folder/log-export.tf b/blueprints/data-solutions/shielded-folder/log-export.tf index ee4420f19..5f8353d2c 100644 --- a/blueprints/data-solutions/shielded-folder/log-export.tf +++ b/blueprints/data-solutions/shielded-folder/log-export.tf @@ -49,11 +49,6 @@ locals { : null ) } : {} - gcs_storage_class = ( - length(split("-", var.log_locations.storage)) < 2 - ? "MULTI_REGIONAL" - : "REGIONAL" - ) log_types = toset([for k, v in var.log_sinks : v.type]) log_keys = { for service, key in local._log_keys : service => key if key != null @@ -110,7 +105,6 @@ module "log-export-gcs" { name = "audit-logs" prefix = var.prefix location = replace(var.log_locations.storage, "europe", "EU") - storage_class = local.gcs_storage_class encryption_key = var.enable_features.encryption ? module.log-kms[var.log_locations.storage].keys["storage"].id : null } diff --git a/fast/stages/0-bootstrap/automation.tf b/fast/stages/0-bootstrap/automation.tf index 772079b06..117716a15 100644 --- a/fast/stages/0-bootstrap/automation.tf +++ b/fast/stages/0-bootstrap/automation.tf @@ -182,27 +182,25 @@ module "automation-project" { # output files bucket module "automation-tf-output-gcs" { - source = "../../../modules/gcs" - project_id = module.automation-project.project_id - name = "iac-core-outputs-0" - prefix = local.prefix - location = local.locations.gcs - storage_class = local.gcs_storage_class - versioning = true - depends_on = [module.organization] + source = "../../../modules/gcs" + project_id = module.automation-project.project_id + name = "iac-core-outputs-0" + prefix = local.prefix + location = local.locations.gcs + versioning = true + depends_on = [module.organization] } # this stage's bucket and service account module "automation-tf-bootstrap-gcs" { - source = "../../../modules/gcs" - project_id = module.automation-project.project_id - name = "iac-core-bootstrap-0" - prefix = local.prefix - location = local.locations.gcs - storage_class = local.gcs_storage_class - versioning = true - depends_on = [module.organization] + source = "../../../modules/gcs" + project_id = module.automation-project.project_id + name = "iac-core-bootstrap-0" + prefix = local.prefix + location = local.locations.gcs + versioning = true + depends_on = [module.organization] } module "automation-tf-bootstrap-sa" { @@ -250,13 +248,12 @@ module "automation-tf-bootstrap-r-sa" { # resource hierarchy stage's bucket and service account module "automation-tf-resman-gcs" { - source = "../../../modules/gcs" - project_id = module.automation-project.project_id - name = "iac-core-resman-0" - prefix = local.prefix - location = local.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + project_id = module.automation-project.project_id + name = "iac-core-resman-0" + prefix = local.prefix + location = local.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.automation-tf-resman-sa.iam_email] "roles/storage.objectViewer" = [module.automation-tf-resman-r-sa.iam_email] @@ -329,13 +326,12 @@ module "automation-tf-resman-r-sa" { # VPC SC stage's bucket and service account module "automation-tf-vpcsc-gcs" { - source = "../../../modules/gcs" - project_id = module.automation-project.project_id - name = "iac-core-vpcsc-0" - prefix = local.prefix - location = local.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + project_id = module.automation-project.project_id + name = "iac-core-vpcsc-0" + prefix = local.prefix + location = local.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.automation-tf-vpcsc-sa.iam_email] "roles/storage.objectViewer" = [module.automation-tf-vpcsc-r-sa.iam_email] diff --git a/fast/stages/0-bootstrap/checklist.tf b/fast/stages/0-bootstrap/checklist.tf index ad129f3b8..0c52f41ed 100644 --- a/fast/stages/0-bootstrap/checklist.tf +++ b/fast/stages/0-bootstrap/checklist.tf @@ -128,15 +128,14 @@ check "checklist" { # checklist files bucket module "automation-tf-checklist-gcs" { - source = "../../../modules/gcs" - count = local.uses_checklist ? 1 : 0 - project_id = module.automation-project.project_id - name = "iac-core-checklist-0" - prefix = local.prefix - location = local.locations.gcs - storage_class = local.gcs_storage_class - versioning = true - depends_on = [module.organization] + source = "../../../modules/gcs" + count = local.uses_checklist ? 1 : 0 + project_id = module.automation-project.project_id + name = "iac-core-checklist-0" + prefix = local.prefix + location = local.locations.gcs + versioning = true + depends_on = [module.organization] } resource "google_storage_bucket_object" "checklist_data" { diff --git a/fast/stages/0-bootstrap/log-export.tf b/fast/stages/0-bootstrap/log-export.tf index ad8e68f51..ccecd693e 100644 --- a/fast/stages/0-bootstrap/log-export.tf +++ b/fast/stages/0-bootstrap/log-export.tf @@ -75,13 +75,12 @@ module "log-export-dataset" { } module "log-export-gcs" { - source = "../../../modules/gcs" - count = contains(local.log_types, "storage") ? 1 : 0 - project_id = module.log-export-project.project_id - name = "logs" - prefix = local.prefix - location = local.locations.gcs - storage_class = local.gcs_storage_class + source = "../../../modules/gcs" + count = contains(local.log_types, "storage") ? 1 : 0 + project_id = module.log-export-project.project_id + name = "logs" + prefix = local.prefix + location = local.locations.gcs } module "log-export-logbucket" { diff --git a/fast/stages/0-bootstrap/main.tf b/fast/stages/0-bootstrap/main.tf index 6ab534e74..dfd6d34d7 100644 --- a/fast/stages/0-bootstrap/main.tf +++ b/fast/stages/0-bootstrap/main.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -16,11 +16,6 @@ locals { env_default = [for k, v in var.environments : k if v.is_default][0] - gcs_storage_class = ( - length(split("-", local.locations.gcs)) < 2 - ? "MULTI_REGIONAL" - : "REGIONAL" - ) principals = { for k, v in var.groups : k => ( can(regex("^[a-zA-Z]+:", v)) diff --git a/fast/stages/1-resman/branch-data-platform.tf b/fast/stages/1-resman/branch-data-platform.tf index 42cbb3f0a..d168a02f4 100644 --- a/fast/stages/1-resman/branch-data-platform.tf +++ b/fast/stages/1-resman/branch-data-platform.tf @@ -169,14 +169,13 @@ module "branch-dp-prod-r-sa" { # automation buckets module "branch-dp-dev-gcs" { - source = "../../../modules/gcs" - count = var.fast_features.data_platform ? 1 : 0 - project_id = var.automation.project_id - name = "dev-resman-dp-0" - prefix = var.prefix - location = var.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + count = var.fast_features.data_platform ? 1 : 0 + project_id = var.automation.project_id + name = "dev-resman-dp-0" + prefix = var.prefix + location = var.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.branch-dp-dev-sa[0].iam_email] "roles/storage.objectViewer" = [module.branch-dp-dev-r-sa[0].iam_email] @@ -184,14 +183,13 @@ module "branch-dp-dev-gcs" { } module "branch-dp-prod-gcs" { - source = "../../../modules/gcs" - count = var.fast_features.data_platform ? 1 : 0 - project_id = var.automation.project_id - name = "prod-resman-dp-0" - prefix = var.prefix - location = var.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + count = var.fast_features.data_platform ? 1 : 0 + project_id = var.automation.project_id + name = "prod-resman-dp-0" + prefix = var.prefix + location = var.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.branch-dp-prod-sa[0].iam_email] "roles/storage.objectViewer" = [module.branch-dp-prod-r-sa[0].iam_email] diff --git a/fast/stages/1-resman/branch-gcve.tf b/fast/stages/1-resman/branch-gcve.tf index 8b86517b7..04627dadc 100644 --- a/fast/stages/1-resman/branch-gcve.tf +++ b/fast/stages/1-resman/branch-gcve.tf @@ -170,14 +170,13 @@ module "branch-gcve-prod-r-sa" { # automation buckets module "branch-gcve-dev-gcs" { - source = "../../../modules/gcs" - count = var.fast_features.gcve ? 1 : 0 - project_id = var.automation.project_id - name = "dev-resman-gcve-0" - prefix = var.prefix - location = var.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + count = var.fast_features.gcve ? 1 : 0 + project_id = var.automation.project_id + name = "dev-resman-gcve-0" + prefix = var.prefix + location = var.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.branch-gcve-dev-sa[0].iam_email] "roles/storage.objectViewer" = [module.branch-gcve-dev-r-sa[0].iam_email] @@ -185,14 +184,13 @@ module "branch-gcve-dev-gcs" { } module "branch-gcve-prod-gcs" { - source = "../../../modules/gcs" - count = var.fast_features.gcve ? 1 : 0 - project_id = var.automation.project_id - name = "prod-resman-gcve-0" - prefix = var.prefix - location = var.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + count = var.fast_features.gcve ? 1 : 0 + project_id = var.automation.project_id + name = "prod-resman-gcve-0" + prefix = var.prefix + location = var.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.branch-gcve-prod-sa[0].iam_email] "roles/storage.objectViewer" = [module.branch-gcve-prod-r-sa[0].iam_email] diff --git a/fast/stages/1-resman/branch-gke.tf b/fast/stages/1-resman/branch-gke.tf index 02ebe698f..d28e019ea 100644 --- a/fast/stages/1-resman/branch-gke.tf +++ b/fast/stages/1-resman/branch-gke.tf @@ -170,14 +170,13 @@ module "branch-gke-prod-r-sa" { # automation buckets module "branch-gke-dev-gcs" { - source = "../../../modules/gcs" - count = var.fast_features.gke ? 1 : 0 - project_id = var.automation.project_id - name = "dev-resman-gke-0" - prefix = var.prefix - location = var.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + count = var.fast_features.gke ? 1 : 0 + project_id = var.automation.project_id + name = "dev-resman-gke-0" + prefix = var.prefix + location = var.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.branch-gke-dev-sa[0].iam_email] "roles/storage.objectViewer" = [module.branch-gke-dev-r-sa[0].iam_email] @@ -185,14 +184,13 @@ module "branch-gke-dev-gcs" { } module "branch-gke-prod-gcs" { - source = "../../../modules/gcs" - count = var.fast_features.gke ? 1 : 0 - project_id = var.automation.project_id - name = "prod-resman-gke-0" - prefix = var.prefix - location = var.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + count = var.fast_features.gke ? 1 : 0 + project_id = var.automation.project_id + name = "prod-resman-gke-0" + prefix = var.prefix + location = var.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.branch-gke-prod-sa[0].iam_email] "roles/storage.objectViewer" = [module.branch-gke-prod-r-sa[0].iam_email] diff --git a/fast/stages/1-resman/branch-networking.tf b/fast/stages/1-resman/branch-networking.tf index 68314a18a..c875fccbc 100644 --- a/fast/stages/1-resman/branch-networking.tf +++ b/fast/stages/1-resman/branch-networking.tf @@ -187,13 +187,12 @@ module "branch-network-r-sa" { # automation bucket module "branch-network-gcs" { - source = "../../../modules/gcs" - project_id = var.automation.project_id - name = "prod-resman-net-0" - prefix = var.prefix - location = var.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + project_id = var.automation.project_id + name = "prod-resman-net-0" + prefix = var.prefix + location = var.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.branch-network-sa.iam_email] "roles/storage.objectViewer" = [module.branch-network-r-sa.iam_email] diff --git a/fast/stages/1-resman/branch-nsec.tf b/fast/stages/1-resman/branch-nsec.tf index cb1c56cd1..604033501 100644 --- a/fast/stages/1-resman/branch-nsec.tf +++ b/fast/stages/1-resman/branch-nsec.tf @@ -79,14 +79,13 @@ moved { } module "branch-nsec-gcs" { - source = "../../../modules/gcs" - count = var.fast_features.nsec ? 1 : 0 - project_id = var.automation.project_id - name = "prod-resman-nsec-0" - prefix = var.prefix - location = var.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + count = var.fast_features.nsec ? 1 : 0 + project_id = var.automation.project_id + name = "prod-resman-nsec-0" + prefix = var.prefix + location = var.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.branch-nsec-sa[0].iam_email] "roles/storage.objectViewer" = [module.branch-nsec-r-sa[0].iam_email] diff --git a/fast/stages/1-resman/branch-project-factory.tf b/fast/stages/1-resman/branch-project-factory.tf index 0e6c6134c..46135221d 100644 --- a/fast/stages/1-resman/branch-project-factory.tf +++ b/fast/stages/1-resman/branch-project-factory.tf @@ -172,13 +172,12 @@ moved { } module "branch-pf-gcs" { - source = "../../../modules/gcs" - project_id = var.automation.project_id - name = "resman-pf-0" - prefix = var.prefix - location = var.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + project_id = var.automation.project_id + name = "resman-pf-0" + prefix = var.prefix + location = var.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.branch-pf-sa.iam_email] "roles/storage.objectViewer" = [module.branch-pf-r-sa.iam_email] @@ -191,13 +190,12 @@ moved { } module "branch-pf-dev-gcs" { - source = "../../../modules/gcs" - project_id = var.automation.project_id - name = "dev-resman-pf-0" - prefix = var.prefix - location = var.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + project_id = var.automation.project_id + name = "dev-resman-pf-0" + prefix = var.prefix + location = var.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.branch-pf-dev-sa.iam_email] "roles/storage.objectViewer" = [module.branch-pf-dev-r-sa.iam_email] @@ -210,13 +208,12 @@ moved { } module "branch-pf-prod-gcs" { - source = "../../../modules/gcs" - project_id = var.automation.project_id - name = "prod-resman-pf-0" - prefix = var.prefix - location = var.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + project_id = var.automation.project_id + name = "prod-resman-pf-0" + prefix = var.prefix + location = var.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.branch-pf-prod-sa.iam_email] "roles/storage.objectViewer" = [module.branch-pf-prod-r-sa.iam_email] diff --git a/fast/stages/1-resman/branch-sandbox.tf b/fast/stages/1-resman/branch-sandbox.tf index 8e7de8498..6c38c5efa 100644 --- a/fast/stages/1-resman/branch-sandbox.tf +++ b/fast/stages/1-resman/branch-sandbox.tf @@ -55,14 +55,13 @@ module "branch-sandbox-folder" { } module "branch-sandbox-gcs" { - source = "../../../modules/gcs" - count = var.fast_features.sandbox ? 1 : 0 - project_id = var.automation.project_id - name = "dev-resman-sbox-0" - prefix = var.prefix - location = var.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + count = var.fast_features.sandbox ? 1 : 0 + project_id = var.automation.project_id + name = "dev-resman-sbox-0" + prefix = var.prefix + location = var.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.branch-sandbox-sa[0].iam_email] } diff --git a/fast/stages/1-resman/branch-security.tf b/fast/stages/1-resman/branch-security.tf index 1742f0355..34dd347f1 100644 --- a/fast/stages/1-resman/branch-security.tf +++ b/fast/stages/1-resman/branch-security.tf @@ -104,13 +104,12 @@ module "branch-security-r-sa" { # automation bucket module "branch-security-gcs" { - source = "../../../modules/gcs" - project_id = var.automation.project_id - name = "prod-resman-sec-0" - prefix = var.prefix - location = var.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + project_id = var.automation.project_id + name = "prod-resman-sec-0" + prefix = var.prefix + location = var.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.branch-security-sa.iam_email] "roles/storage.objectViewer" = [module.branch-security-r-sa.iam_email] diff --git a/fast/stages/1-resman/main.tf b/fast/stages/1-resman/main.tf index 80beb5b49..c0a5c8ab6 100644 --- a/fast/stages/1-resman/main.tf +++ b/fast/stages/1-resman/main.tf @@ -74,11 +74,6 @@ locals { ] } custom_roles = coalesce(var.custom_roles, {}) - gcs_storage_class = ( - length(split("-", var.locations.gcs)) < 2 - ? "MULTI_REGIONAL" - : "REGIONAL" - ) identity_providers = coalesce( try(var.automation.federated_identity_providers, null), {} ) diff --git a/fast/stages/1-resman/tenant-logging.tf b/fast/stages/1-resman/tenant-logging.tf index 2f3f38cb0..d573b9e7d 100644 --- a/fast/stages/1-resman/tenant-logging.tf +++ b/fast/stages/1-resman/tenant-logging.tf @@ -84,11 +84,10 @@ module "log-export-gcs" { count = ( var.root_node != null && contains(local.log_types, "storage") ? 1 : 0 ) - project_id = var.logging.project_id - name = "logs" - prefix = var.prefix - location = var.locations.gcs - storage_class = local.gcs_storage_class + project_id = var.logging.project_id + name = "logs" + prefix = var.prefix + location = var.locations.gcs } module "log-export-logbucket" { diff --git a/fast/stages/1-resman/top-level-folders.tf b/fast/stages/1-resman/top-level-folders.tf index d7feeb8c1..266846810 100644 --- a/fast/stages/1-resman/top-level-folders.tf +++ b/fast/stages/1-resman/top-level-folders.tf @@ -123,14 +123,13 @@ module "top-level-sa" { } module "top-level-bucket" { - source = "../../../modules/gcs" - for_each = local.top_level_automation - project_id = var.automation.project_id - name = "prod-resman-${each.key}-0" - prefix = var.prefix - location = var.locations.gcs - storage_class = local.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + for_each = local.top_level_automation + project_id = var.automation.project_id + name = "prod-resman-${each.key}-0" + prefix = var.prefix + location = var.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.top-level-sa[each.key].iam_email] "roles/storage.objectViewer" = [module.top-level-sa[each.key].iam_email] diff --git a/fast/stages/1-tenant-factory/main.tf b/fast/stages/1-tenant-factory/main.tf index ac72a27f9..4d07c34af 100644 --- a/fast/stages/1-tenant-factory/main.tf +++ b/fast/stages/1-tenant-factory/main.tf @@ -15,7 +15,7 @@ */ locals { - _tenants = { + tenants = { for k, v in var.tenant_configs : k => merge(v, { billing_account = merge(v.billing_account, { id = coalesce(v.billing_account.id, var.billing_account.id) @@ -29,15 +29,6 @@ locals { organization = coalesce(v.cloud_identity, var.organization) }) } - tenants = { - for k, v in local._tenants : k => merge(v, { - gcs_storage_class = ( - length(split("-", v.locations.gcs)) < 2 - ? "MULTI_REGIONAL" - : "REGIONAL" - ) - }) - } } module "organization" { diff --git a/fast/stages/1-tenant-factory/tenant-fast-automation.tf b/fast/stages/1-tenant-factory/tenant-fast-automation.tf index 9146b2606..8873f9cff 100644 --- a/fast/stages/1-tenant-factory/tenant-fast-automation.tf +++ b/fast/stages/1-tenant-factory/tenant-fast-automation.tf @@ -173,27 +173,25 @@ module "tenant-automation-project-iam" { # output files bucket module "tenant-automation-tf-output-gcs" { - source = "../../../modules/gcs" - for_each = local.fast_tenants - project_id = module.tenant-automation-project[each.key].project_id - name = "iac-core-outputs-0" - prefix = each.value.stage_0_prefix - location = each.value.locations.gcs - storage_class = each.value.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + for_each = local.fast_tenants + project_id = module.tenant-automation-project[each.key].project_id + name = "iac-core-outputs-0" + prefix = each.value.stage_0_prefix + location = each.value.locations.gcs + versioning = true } # resource hierarchy stage's bucket and service account module "tenant-automation-tf-resman-gcs" { - source = "../../../modules/gcs" - for_each = local.fast_tenants - project_id = module.tenant-automation-project[each.key].project_id - name = "iac-core-resman-0" - prefix = each.value.stage_0_prefix - location = each.value.locations.gcs - storage_class = each.value.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + for_each = local.fast_tenants + project_id = module.tenant-automation-project[each.key].project_id + name = "iac-core-resman-0" + prefix = each.value.stage_0_prefix + location = each.value.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [ module.tenant-automation-tf-resman-sa[each.key].iam_email diff --git a/fast/stages/1-tenant-factory/tenant.tf b/fast/stages/1-tenant-factory/tenant.tf index ab0c578e6..79c202ef7 100644 --- a/fast/stages/1-tenant-factory/tenant.tf +++ b/fast/stages/1-tenant-factory/tenant.tf @@ -111,14 +111,13 @@ module "tenant-sa" { # automation bucket module "tenant-gcs" { - source = "../../../modules/gcs" - for_each = local.tenants - project_id = var.automation.project_id - name = "tenant-${each.key}-0" - prefix = var.prefix - location = each.value.locations.gcs - storage_class = each.value.gcs_storage_class - versioning = true + source = "../../../modules/gcs" + for_each = local.tenants + project_id = var.automation.project_id + name = "tenant-${each.key}-0" + prefix = var.prefix + location = each.value.locations.gcs + versioning = true iam = { "roles/storage.objectAdmin" = [module.tenant-sa[each.key].iam_email] } diff --git a/modules/gcs/README.md b/modules/gcs/README.md index d9e2bba09..ae9ebc487 100644 --- a/modules/gcs/README.md +++ b/modules/gcs/README.md @@ -9,6 +9,7 @@ - [Object upload](#object-upload) - [IAM](#iam) - [Tag Bindings](#tag-bindings) +- [Managed Folders](#managed-folders) - [Variables](#variables) - [Outputs](#outputs) @@ -281,15 +282,37 @@ module "bucket" { } # tftest modules=2 resources=6 ``` + +## Managed Folders +```hcl +module "bucket" { + source = "./fabric/modules/gcs" + project_id = var.project_id + prefix = var.prefix + name = "my-bucket" + location = "EU" + managed_folders = { + folder1 = { + iam = { + "roles/storage.admin" = ["user:user1@example.com"] + } + } + "folder1/subfolder" = { + force_destroy = true + } + } +} +# tftest inventory=managed-folders.yaml +``` ## Variables | name | description | type | required | default | |---|---|:---:|:---:|:---:| -| [location](variables.tf#L149) | Bucket location. | string | ✓ | | -| [name](variables.tf#L164) | Bucket name suffix. | string | ✓ | | -| [project_id](variables.tf#L220) | Bucket project id. | string | ✓ | | -| [autoclass](variables.tf#L17) | Enable autoclass to automatically transition objects to appropriate storage classes based on their access pattern. If set to true, storage_class must be set to STANDARD. Defaults to false. | bool | | false | +| [location](variables.tf#L156) | Bucket location. | string | ✓ | | +| [name](variables.tf#L199) | Bucket name suffix. | string | ✓ | | +| [project_id](variables.tf#L255) | Bucket project id. | string | ✓ | | +| [autoclass](variables.tf#L17) | Enable autoclass to automatically transition objects to appropriate storage classes based on their access pattern. If set to true, storage_class must be set to STANDARD. Defaults to false. | bool | | null | | [cors](variables.tf#L23) | CORS configuration for the bucket. Defaults to null. | object({…}) | | null | | [custom_placement_config](variables.tf#L34) | The bucket's custom location configuration, which specifies the individual regions that comprise a dual-region bucket. If the bucket is designated as REGIONAL or MULTI_REGIONAL, the parameters are empty. | list(string) | | null | | [default_event_based_hold](variables.tf#L40) | Enable event based hold to new objects added to specific bucket, defaults to false. | bool | | null | @@ -298,21 +321,24 @@ module "bucket" { | [iam](variables.tf#L58) | IAM bindings in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | | [iam_bindings](variables.tf#L64) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | map(object({…})) | | {} | | [iam_bindings_additive](variables.tf#L79) | Individual additive IAM bindings. Keys are arbitrary. | map(object({…})) | | {} | -| [labels](variables.tf#L94) | Labels to be attached to all buckets. | map(string) | | {} | -| [lifecycle_rules](variables.tf#L100) | Bucket lifecycle rule. | map(object({…})) | | {} | -| [logging_config](variables.tf#L155) | Bucket logging configuration. | object({…}) | | null | -| [notification_config](variables.tf#L169) | GCS Notification configuration. | object({…}) | | null | -| [objects_to_upload](variables.tf#L184) | Objects to be uploaded to bucket. | map(object({…})) | | {} | -| [prefix](variables.tf#L210) | Optional prefix used to generate the bucket name. | string | | null | -| [public_access_prevention](variables.tf#L225) | Prevents public access to a bucket. Acceptable values are inherited or enforced. If inherited, the bucket uses public access prevention, only if the bucket is subject to the public access prevention organization policy constraint. | string | | null | -| [requester_pays](variables.tf#L231) | Enables Requester Pays on a storage bucket. | bool | | null | -| [retention_policy](variables.tf#L237) | Bucket retention policy. | object({…}) | | null | -| [soft_delete_retention](variables.tf#L246) | The duration in seconds that soft-deleted objects in the bucket will be retained and cannot be permanently deleted. Set to 0 to override the default and disable. | number | | null | -| [storage_class](variables.tf#L252) | Bucket storage class. | string | | "MULTI_REGIONAL" | -| [tag_bindings](variables.tf#L262) | Tag bindings for this folder, in key => tag value id format. | map(string) | | {} | -| [uniform_bucket_level_access](variables.tf#L269) | Allow using object ACLs (false) or not (true, this is the recommended behavior) , defaults to true (which is the recommended practice, but not the behavior of storage API). | bool | | true | -| [versioning](variables.tf#L275) | Enable versioning, defaults to false. | bool | | false | -| [website](variables.tf#L281) | Bucket website. | object({…}) | | null | +| [iam_by_principals](variables.tf#L94) | Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid cycle errors. Merged internally with the `iam` variable. | map(list(string)) | | {} | +| [labels](variables.tf#L101) | Labels to be attached to all buckets. | map(string) | | {} | +| [lifecycle_rules](variables.tf#L107) | Bucket lifecycle rule. | map(object({…})) | | {} | +| [logging_config](variables.tf#L162) | Bucket logging configuration. | object({…}) | | null | +| [managed_folders](variables.tf#L171) | Managed folders to create within the bucket in {PATH => CONFIG} format. | map(object({…})) | | {} | +| [notification_config](variables.tf#L204) | GCS Notification configuration. | object({…}) | | null | +| [objects_to_upload](variables.tf#L219) | Objects to be uploaded to bucket. | map(object({…})) | | {} | +| [prefix](variables.tf#L245) | Optional prefix used to generate the bucket name. | string | | null | +| [public_access_prevention](variables.tf#L260) | Prevents public access to the bucket. | string | | null | +| [requester_pays](variables.tf#L270) | Enables Requester Pays on a storage bucket. | bool | | null | +| [retention_policy](variables.tf#L276) | Bucket retention policy. | object({…}) | | null | +| [rpo](variables.tf#L285) | Bucket recovery point objective. | string | | null | +| [soft_delete_retention](variables.tf#L295) | The duration in seconds that soft-deleted objects in the bucket will be retained and cannot be permanently deleted. Set to 0 to override the default and disable. | number | | null | +| [storage_class](variables.tf#L301) | Bucket storage class. | string | | "STANDARD" | +| [tag_bindings](variables.tf#L311) | Tag bindings for this folder, in key => tag value id format. | map(string) | | {} | +| [uniform_bucket_level_access](variables.tf#L318) | Allow using object ACLs (false) or not (true, this is the recommended behavior) , defaults to true (which is the recommended practice, but not the behavior of storage API). | bool | | true | +| [versioning](variables.tf#L324) | Enable versioning, defaults to false. | bool | | null | +| [website](variables.tf#L330) | Bucket website. | object({…}) | | null | ## Outputs diff --git a/modules/gcs/iam.tf b/modules/gcs/iam.tf index 42bad0288..87a975871 100644 --- a/modules/gcs/iam.tf +++ b/modules/gcs/iam.tf @@ -1,5 +1,5 @@ /** - * Copyright 2023 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -16,8 +16,25 @@ # tfdoc:file:description IAM bindings +locals { + _iam_principal_roles = distinct(flatten(values(var.iam_by_principals))) + _iam_principals = { + for r in local._iam_principal_roles : r => [ + for k, v in var.iam_by_principals : + k if try(index(v, r), null) != null + ] + } + iam = { + for role in distinct(concat(keys(var.iam), keys(local._iam_principals))) : + role => concat( + try(var.iam[role], []), + try(local._iam_principals[role], []) + ) + } +} + resource "google_storage_bucket_iam_binding" "authoritative" { - for_each = var.iam + for_each = local.iam bucket = google_storage_bucket.bucket.name role = each.key members = each.value diff --git a/modules/gcs/main.tf b/modules/gcs/main.tf index 0e2623ad7..aa4258a08 100644 --- a/modules/gcs/main.tf +++ b/modules/gcs/main.tf @@ -1,5 +1,5 @@ /** - * Copyright 2023 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -30,8 +30,13 @@ resource "google_storage_bucket" "bucket" { default_event_based_hold = var.default_event_based_hold requester_pays = var.requester_pays public_access_prevention = var.public_access_prevention - versioning { - enabled = var.versioning + rpo = var.rpo + + dynamic "versioning" { + for_each = var.versioning == null ? [] : [""] + content { + enabled = var.versioning + } } dynamic "autoclass" { @@ -165,12 +170,14 @@ resource "google_storage_notification" "notification" { object_name_prefix = var.notification_config.object_name_prefix depends_on = [google_pubsub_topic_iam_binding.binding] } + resource "google_pubsub_topic_iam_binding" "binding" { count = try(var.notification_config.create_topic, null) == true ? 1 : 0 topic = google_pubsub_topic.topic[0].id role = "roles/pubsub.publisher" members = ["serviceAccount:${var.notification_config.sa_email}"] } + resource "google_pubsub_topic" "topic" { count = try(var.notification_config.create_topic, null) == true ? 1 : 0 project = var.project_id diff --git a/modules/gcs/managed-folders.tf b/modules/gcs/managed-folders.tf new file mode 100644 index 000000000..326615d74 --- /dev/null +++ b/modules/gcs/managed-folders.tf @@ -0,0 +1,109 @@ +/** + * Copyright 2024 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +locals { + # ensure all keys end with / as required by + # google_storage_managed_folder + managed_folders = { + for k, v in var.managed_folders : + (endswith(k, "/") ? k : "${k}/") => v + } + + managed_folder_iam = flatten([ + for k, v in local.managed_folders : [ + for role, members in v.iam : { + managed_folder = k + role = role + members = members + } + ] + ]) + managed_folder_iam_bindings = merge([ + for k, v in local.managed_folders : { + for binding_key, data in v.iam_bindings : + "${k}.${binding_key}" => { + managed_folder = k + role = data.role + members = data.members + condition = data.condition + } + } + ]...) + managed_folder_iam_bindings_additive = merge([ + for k, v in local.managed_folders : { + for binding_key, data in v.iam_bindings_additive : + "${k}.${binding_key}" => { + managed_folder = k + role = data.role + member = data.member + condition = data.condition + } + } + ]...) +} + + +resource "google_storage_managed_folder" "folder" { + for_each = local.managed_folders + bucket = google_storage_bucket.bucket.name + name = each.key + force_destroy = each.value.force_destroy +} + +resource "google_storage_managed_folder_iam_binding" "authoritative" { + for_each = { + for binding in local.managed_folder_iam : + "${binding.managed_folder}.${binding.role}" => binding + } + role = each.value.role + members = each.value.members + bucket = google_storage_bucket.bucket.name + managed_folder = google_storage_managed_folder.folder[each.value.managed_folder].name +} + +resource "google_storage_managed_folder_iam_binding" "bindings" { + for_each = local.managed_folder_iam_bindings + role = each.value.role + members = each.value.members + bucket = google_storage_bucket.bucket.name + managed_folder = google_storage_managed_folder.folder[each.value.managed_folder].name + + dynamic "condition" { + for_each = each.value.condition == null ? [] : [""] + content { + expression = each.value.condition.expression + title = each.value.condition.title + description = each.value.condition.description + } + } +} + +resource "google_storage_managed_folder_iam_member" "members" { + for_each = local.managed_folder_iam_bindings_additive + role = each.value.role + member = each.value.member + bucket = google_storage_bucket.bucket.name + managed_folder = google_storage_managed_folder.folder[each.value.managed_folder].name + + dynamic "condition" { + for_each = each.value.condition == null ? [] : [""] + content { + expression = each.value.condition.expression + title = each.value.condition.title + description = each.value.condition.description + } + } +} diff --git a/modules/gcs/variables.tf b/modules/gcs/variables.tf index 97b6b09af..49d9fb202 100644 --- a/modules/gcs/variables.tf +++ b/modules/gcs/variables.tf @@ -1,5 +1,5 @@ /** - * Copyright 2023 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -17,7 +17,7 @@ variable "autoclass" { description = "Enable autoclass to automatically transition objects to appropriate storage classes based on their access pattern. If set to true, storage_class must be set to STANDARD. Defaults to false." type = bool - default = false + default = null } variable "cors" { @@ -91,6 +91,13 @@ variable "iam_bindings_additive" { default = {} } +variable "iam_by_principals" { + description = "Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid cycle errors. Merged internally with the `iam` variable." + type = map(list(string)) + default = {} + nullable = false +} + variable "labels" { description = "Labels to be attached to all buckets." type = map(string) @@ -161,6 +168,34 @@ variable "logging_config" { default = null } +variable "managed_folders" { + description = "Managed folders to create within the bucket in {PATH => CONFIG} format." + type = map(object({ + force_destroy = optional(bool, false) + iam = optional(map(list(string)), {}) + iam_bindings = optional(map(object({ + members = list(string) + role = string + condition = optional(object({ + expression = string + title = string + description = optional(string) + })) + })), {}) + iam_bindings_additive = optional(map(object({ + member = string + role = string + condition = optional(object({ + expression = string + title = string + description = optional(string) + })) + })), {}) + })) + default = {} + nullable = false +} + variable "name" { description = "Bucket name suffix." type = string @@ -223,9 +258,13 @@ variable "project_id" { } variable "public_access_prevention" { - description = "Prevents public access to a bucket. Acceptable values are inherited or enforced. If inherited, the bucket uses public access prevention, only if the bucket is subject to the public access prevention organization policy constraint." + description = "Prevents public access to the bucket." type = string default = null + validation { + condition = var.public_access_prevention == null || contains(["enforced", "inherited"], coalesce(var.public_access_prevention, "none")) + error_message = "public_access_prevention must be either enforced or inherited." + } } variable "requester_pays" { @@ -243,6 +282,16 @@ variable "retention_policy" { default = null } +variable "rpo" { + description = "Bucket recovery point objective." + type = string + default = null + validation { + condition = var.rpo == null || contains(["ASYNC_TURBO", "DEFAULT"], coalesce(var.rpo, "none")) + error_message = "rpo must be one of ASYNC_TURBO, DEFAULT." + } +} + variable "soft_delete_retention" { description = "The duration in seconds that soft-deleted objects in the bucket will be retained and cannot be permanently deleted. Set to 0 to override the default and disable." type = number @@ -252,7 +301,7 @@ variable "soft_delete_retention" { variable "storage_class" { description = "Bucket storage class." type = string - default = "MULTI_REGIONAL" + default = "STANDARD" validation { condition = contains(["STANDARD", "MULTI_REGIONAL", "REGIONAL", "NEARLINE", "COLDLINE", "ARCHIVE"], var.storage_class) error_message = "Storage class must be one of STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE." @@ -275,7 +324,7 @@ variable "uniform_bucket_level_access" { variable "versioning" { description = "Enable versioning, defaults to false." type = bool - default = false + default = null } variable "website" { diff --git a/modules/project-factory/automation.tf b/modules/project-factory/automation.tf index b5ff81451..34a1fd07d 100644 --- a/modules/project-factory/automation.tf +++ b/modules/project-factory/automation.tf @@ -79,7 +79,7 @@ module "automation-buckets" { } labels = lookup(each.value, "labels", {}) location = lookup(each.value, "location", "EU") - storage_class = lookup(each.value, "storage_class", "MULTI_REGIONAL") + storage_class = lookup(each.value, "storage_class", "STANDARD") uniform_bucket_level_access = lookup(each.value, "uniform_bucket_level_access", true) versioning = lookup(each.value, "versioning", false) } diff --git a/tests/fast/stages/s0_bootstrap/checklist.yaml b/tests/fast/stages/s0_bootstrap/checklist.yaml index d10b3d98d..86f58ee38 100644 --- a/tests/fast/stages/s0_bootstrap/checklist.yaml +++ b/tests/fast/stages/s0_bootstrap/checklist.yaml @@ -699,8 +699,7 @@ values: service: servicenetworking.googleapis.com timeouts: null module.automation-tf-bootstrap-gcs.google_storage_bucket.bucket: - autoclass: - - enabled: false + autoclass: [] cors: [] custom_placement_config: [] default_event_based_hold: null @@ -715,7 +714,7 @@ values: project: fast-prod-iac-core-0 requester_pays: null retention_policy: [] - storage_class: MULTI_REGIONAL + storage_class: STANDARD timeouts: null uniform_bucket_level_access: true versioning: @@ -761,8 +760,7 @@ values: condition: [] role: roles/storage.admin module.automation-tf-checklist-gcs[0].google_storage_bucket.bucket: - autoclass: - - enabled: false + autoclass: [] cors: [] custom_placement_config: [] default_event_based_hold: null @@ -777,14 +775,13 @@ values: project: fast-prod-iac-core-0 requester_pays: null retention_policy: [] - storage_class: MULTI_REGIONAL + storage_class: STANDARD timeouts: null uniform_bucket_level_access: true versioning: - enabled: true module.automation-tf-output-gcs.google_storage_bucket.bucket: - autoclass: - - enabled: false + autoclass: [] cors: [] custom_placement_config: [] default_event_based_hold: null @@ -799,14 +796,13 @@ values: project: fast-prod-iac-core-0 requester_pays: null retention_policy: [] - storage_class: MULTI_REGIONAL + storage_class: STANDARD timeouts: null uniform_bucket_level_access: true versioning: - enabled: true module.automation-tf-resman-gcs.google_storage_bucket.bucket: - autoclass: - - enabled: false + autoclass: [] cors: [] custom_placement_config: [] default_event_based_hold: null @@ -821,7 +817,7 @@ values: project: fast-prod-iac-core-0 requester_pays: null retention_policy: [] - storage_class: MULTI_REGIONAL + storage_class: STANDARD timeouts: null uniform_bucket_level_access: true versioning: @@ -871,8 +867,7 @@ values: condition: [] role: roles/storage.admin module.automation-tf-vpcsc-gcs.google_storage_bucket.bucket: - autoclass: - - enabled: false + autoclass: [] cors: [] custom_placement_config: [] default_event_based_hold: null @@ -887,7 +882,7 @@ values: project: fast-prod-iac-core-0 requester_pays: null retention_policy: [] - storage_class: MULTI_REGIONAL + storage_class: STANDARD timeouts: null uniform_bucket_level_access: true versioning: diff --git a/tests/modules/folder/examples/logging.yaml b/tests/modules/folder/examples/logging.yaml index 267bcedb4..17379adcf 100644 --- a/tests/modules/folder/examples/logging.yaml +++ b/tests/modules/folder/examples/logging.yaml @@ -121,8 +121,7 @@ values: condition: [] role: roles/storage.objectCreator module.gcs.google_storage_bucket.bucket: - autoclass: - - enabled: false + autoclass: [] cors: [] custom_placement_config: [] default_event_based_hold: null @@ -137,10 +136,8 @@ values: project: project-id requester_pays: null retention_policy: [] - storage_class: MULTI_REGIONAL + storage_class: STANDARD uniform_bucket_level_access: true - versioning: - - enabled: false module.pubsub.google_pubsub_topic.default: kms_key_name: null labels: null diff --git a/tests/modules/gcs/examples/iam-authoritative.yaml b/tests/modules/gcs/examples/iam-authoritative.yaml index 84b93b1c5..6ff73f80d 100644 --- a/tests/modules/gcs/examples/iam-authoritative.yaml +++ b/tests/modules/gcs/examples/iam-authoritative.yaml @@ -1,4 +1,4 @@ -# Copyright 2023 Google LLC +# Copyright 2024 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -27,13 +27,10 @@ values: project: project-id requester_pays: null retention_policy: [] - storage_class: MULTI_REGIONAL + storage_class: STANDARD timeouts: null uniform_bucket_level_access: true - versioning: - - enabled: false - autoclass: - - enabled: false + autoclass: [] module.bucket.google_storage_bucket_iam_binding.authoritative["roles/storage.admin"]: bucket: test-my-bucket condition: [] diff --git a/tests/modules/gcs/examples/iam-bindings-additive.yaml b/tests/modules/gcs/examples/iam-bindings-additive.yaml index 341911455..87fdf77b6 100644 --- a/tests/modules/gcs/examples/iam-bindings-additive.yaml +++ b/tests/modules/gcs/examples/iam-bindings-additive.yaml @@ -1,4 +1,4 @@ -# Copyright 2023 Google LLC +# Copyright 2024 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -27,13 +27,10 @@ values: project: project-id requester_pays: null retention_policy: [] - storage_class: MULTI_REGIONAL + storage_class: STANDARD timeouts: null uniform_bucket_level_access: true - versioning: - - enabled: false - autoclass: - - enabled: false + autoclass: [] module.bucket.google_storage_bucket_iam_member.bindings["storage-admin-with-delegated_roles"]: bucket: test-my-bucket condition: diff --git a/tests/modules/gcs/examples/iam-bindings.yaml b/tests/modules/gcs/examples/iam-bindings.yaml index 23d98f729..3109109a7 100644 --- a/tests/modules/gcs/examples/iam-bindings.yaml +++ b/tests/modules/gcs/examples/iam-bindings.yaml @@ -1,4 +1,4 @@ -# Copyright 2023 Google LLC +# Copyright 2024 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -27,13 +27,10 @@ values: project: project-id requester_pays: null retention_policy: [] - storage_class: MULTI_REGIONAL + storage_class: STANDARD timeouts: null uniform_bucket_level_access: true - versioning: - - enabled: false - autoclass: - - enabled: false + autoclass: [] module.bucket.google_storage_bucket_iam_binding.bindings["storage-admin-with-delegated_roles"]: bucket: test-my-bucket condition: diff --git a/tests/modules/gcs/examples/managed-folders.yaml b/tests/modules/gcs/examples/managed-folders.yaml new file mode 100644 index 000000000..30addbf13 --- /dev/null +++ b/tests/modules/gcs/examples/managed-folders.yaml @@ -0,0 +1,60 @@ +# Copyright 2024 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.bucket.google_storage_bucket.bucket: + autoclass: [] + cors: [] + custom_placement_config: [] + default_event_based_hold: null + enable_object_retention: null + encryption: [] + force_destroy: false + labels: null + lifecycle_rule: [] + location: EU + logging: [] + name: test-my-bucket + project: project-id + requester_pays: null + retention_policy: [] + storage_class: STANDARD + timeouts: null + uniform_bucket_level_access: true + module.bucket.google_storage_managed_folder.folder["folder1/"]: + bucket: test-my-bucket + force_destroy: false + name: folder1/ + timeouts: null + module.bucket.google_storage_managed_folder.folder["folder1/subfolder/"]: + bucket: test-my-bucket + force_destroy: true + name: folder1/subfolder/ + timeouts: null + module.bucket.google_storage_managed_folder_iam_binding.authoritative["folder1/.roles/storage.admin"]: + bucket: test-my-bucket + condition: [] + managed_folder: folder1/ + members: + - user:user1@example.com + role: roles/storage.admin + +counts: + google_storage_bucket: 1 + google_storage_managed_folder: 2 + google_storage_managed_folder_iam_binding: 1 + modules: 1 + resources: 4 + +outputs: {} diff --git a/tests/modules/gcs/examples/simple.yaml b/tests/modules/gcs/examples/simple.yaml index fe18f9238..eb2476d98 100644 --- a/tests/modules/gcs/examples/simple.yaml +++ b/tests/modules/gcs/examples/simple.yaml @@ -1,4 +1,4 @@ -# Copyright 2023 Google LLC +# Copyright 2024 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -14,8 +14,7 @@ values: module.bucket.google_storage_bucket.bucket: - autoclass: - - enabled: false + autoclass: [] cors: [] custom_placement_config: [] default_event_based_hold: null @@ -30,7 +29,7 @@ values: project: project-id requester_pays: null retention_policy: [] - storage_class: MULTI_REGIONAL + storage_class: STANDARD timeouts: null uniform_bucket_level_access: true versioning: diff --git a/tests/modules/gcs/examples/tags.yaml b/tests/modules/gcs/examples/tags.yaml index bf5123fd6..fbee98e97 100644 --- a/tests/modules/gcs/examples/tags.yaml +++ b/tests/modules/gcs/examples/tags.yaml @@ -14,8 +14,7 @@ values: module.bucket.google_storage_bucket.bucket: - autoclass: - - enabled: false + autoclass: [] cors: [] custom_placement_config: [] default_event_based_hold: null @@ -30,11 +29,9 @@ values: project: project-id requester_pays: null retention_policy: [] - storage_class: MULTI_REGIONAL + storage_class: STANDARD timeouts: null uniform_bucket_level_access: true - versioning: - - enabled: false module.bucket.google_tags_tag_binding.binding["env-sandbox"]: parent: //storage.googleapis.com/projects/_/buckets/test-my-bucket timeouts: null diff --git a/tests/modules/organization/examples/logging.yaml b/tests/modules/organization/examples/logging.yaml index de050845b..f358cb5cf 100644 --- a/tests/modules/organization/examples/logging.yaml +++ b/tests/modules/organization/examples/logging.yaml @@ -49,8 +49,7 @@ values: project: test-dest-prj service: logging.googleapis.com module.gcs.google_storage_bucket.bucket: - autoclass: - - enabled: false + autoclass: [] cors: [] custom_placement_config: [] default_event_based_hold: null @@ -65,10 +64,8 @@ values: project: project-id requester_pays: null retention_policy: [] - storage_class: MULTI_REGIONAL + storage_class: STANDARD uniform_bucket_level_access: true - versioning: - - enabled: false module.org.google_bigquery_dataset_iam_member.bq-sinks-binding["info"]: condition: [] role: roles/bigquery.dataEditor diff --git a/tests/modules/project/examples/data.yaml b/tests/modules/project/examples/data.yaml index ea22dcee2..f7cca9f07 100644 --- a/tests/modules/project/examples/data.yaml +++ b/tests/modules/project/examples/data.yaml @@ -47,8 +47,7 @@ values: project: project-id timeouts: null module.gcs.google_storage_bucket.bucket: - autoclass: - - enabled: false + autoclass: [] cors: [] custom_placement_config: [] default_event_based_hold: null @@ -63,11 +62,9 @@ values: project: project-id requester_pays: null retention_policy: [] - storage_class: MULTI_REGIONAL + storage_class: STANDARD timeouts: null uniform_bucket_level_access: true - versioning: - - enabled: false module.host-project.google_compute_shared_vpc_host_project.shared_vpc_host[0]: project: test-host timeouts: null diff --git a/tests/modules/project/examples/logging.yaml b/tests/modules/project/examples/logging.yaml index f992623f4..4b652f3a3 100644 --- a/tests/modules/project/examples/logging.yaml +++ b/tests/modules/project/examples/logging.yaml @@ -49,8 +49,7 @@ values: project: test-dest-prj service: logging.googleapis.com module.gcs.google_storage_bucket.bucket: - autoclass: - - enabled: false + autoclass: [] cors: [] custom_placement_config: [] default_event_based_hold: null @@ -65,10 +64,8 @@ values: project: project-id requester_pays: null retention_policy: [] - storage_class: MULTI_REGIONAL + storage_class: STANDARD uniform_bucket_level_access: true - versioning: - - enabled: false module.project-host.google_bigquery_dataset_iam_member.bq-sinks-binding["info"]: condition: [] role: roles/bigquery.dataEditor diff --git a/tests/modules/project_factory/examples/example.yaml b/tests/modules/project_factory/examples/example.yaml index 788f85f0e..416732aef 100644 --- a/tests/modules/project_factory/examples/example.yaml +++ b/tests/modules/project_factory/examples/example.yaml @@ -14,8 +14,7 @@ values: module.project-factory.module.automation-buckets["dev-tb-app0-0/state"].google_storage_bucket.bucket: - autoclass: - - enabled: false + autoclass: [] cors: [] custom_placement_config: [] default_event_based_hold: null @@ -30,11 +29,9 @@ values: project: test-pf-teams-iac-0 requester_pays: null retention_policy: [] - storage_class: MULTI_REGIONAL + storage_class: STANDARD timeouts: null uniform_bucket_level_access: true - versioning: - - enabled: false ? module.project-factory.module.automation-buckets["dev-tb-app0-0/state"].google_storage_bucket_iam_binding.authoritative["roles/storage.objectCreator"] : bucket: test-pf-dev-tb-app0-0-state condition: []