Ludovico Magnocavallo
36648b6b63
FAST light implementation ( #3255 )
...
* data wip
* wip data
* update org schema, add note on expansion
* all schemas, workload notes
* Update WORKLOG.md
* Update WORKLOG.md
* Update WORKLOG.md
* Update WORKLOG.md
* wip
* data wip
* wip
* wip
* wip
* wip
* org module IAM context (using lookup)
* new-style context expansion in project IAM
* remove spurious file
* project module contexts
* finalize context replacement format for project module
* revert org module changes
* fix tag id interpolation in project
* fix tag id interpolation in project
* organization module context
* organization context test
* context expansion for folder tag bindings
* test context expansion for tag bindings
* service account module context
* simplify context local
* context for iam service account
* nuke blueprints
* remove links to blueprints
* vpc sc context in project module
* Add context to GCS module
* Add inline deps to plan_summary script
* Make context a top-level variable for folder, organization, sa
* Add add context top-level to VPC-SC
* move context out of factories_config variable
* tfdoc
* fix merge
* fix merge
* fix examples
* net-vpc module context
* add parent ids to folder context
* rename folder parent context
* fix folder parent check
* new project factory stub
* wip
* wip
* refactor defaults
* project iam
* bueckts and service accounts
* start adding context replacements
* better test data
* automation resources for folders and projects
* automation
* add support for project id interpolation
* first tested apply
* improve IAM description in gcs module
* add context to billing account module
* add notification channels to billing account module context
* add billing budgets to new pf
* schemas and defaults
* bootstrap wip
* bootstrap wip
* bootstrap wip
* pf outputs
* pf fixes
* fix pf sample data
* bootstrap lite fixes
* add locations to organization module contexts
* bootstrap lite fixes
* org fixes, billing accounts
* fix default project parent
* bootstrap lite wip
* add locations to gcs module context
* add context support to logging bucket module
* add context to pubsub module
* split out iam variables in gcs module
* fix logging bucket context test
* bootstrap log sink destinations
* streamline logging-bucket module variables
* fix logging bucket context test
* align logging bucket module interface in fast bootstrap
* add support for project-level log buckets to project factory
* support full context expansion in organization module log sinks
* log buckets in fast-lite bootstrap
* make og sink type optional in organization module
* log sinks in fast-lite bootstrap
* set tag values in factory context
* bootstrap lite data
* output files schema
* billing account schema
* output files
* output providers
* gcs output files
* boilerplate
* tflint
* check documentation
* check docs
* fix project module parent variable validation
* fix log bucket examples
* allow null parent in project module
* silence folder test errors
* fix billing account sink example
* fix project example
* fix billing account module
* fix folder tests
* fix FAST
* fix fast
* tfvars outputs
* wif
* cicd service accounts
* cicd
* allow defaults in context, minimal org policies
* support gcs managed folders in project factory and bootstrap lite
* support prefix in provider output files
* rename bootstrap stage
* gitignore
* gitignore
* security folder, billing IAM
* wip tfvars
* fix typo
* security IAM
* control tag iam/context via variables in organization module
* split tag creation from tag IAM to avoid circular refs
* port organization module tag changes to project module
* implement new-style context expansion in vpc-sc module
* fix fast vpc-sc tests
* boilerplate
* vpc sc stage
* schemas
* fast-lite compatibility for vpc sc stage
* make log project number optional in vpc-sc stage
* networking
* networking
* networking
* networking
* rename and move new stage under fast
* clone pf tests
* use context replacement for internal notification channels in billing account module
* support service agents in project module iam context replacements
* support service agents in project module iam context replacements
* add support for kms keys to project module context
* experimental pf example test and fixes
* fix schemas
* fix tests
* tfdoc
* tfdoc
* pf config
* experimental pf
* remove redundant dot from gcs managed folder IAM keys
* bootstrap experimental test
* project factory exp stage test
* skip tflint for bootstrap experimental test
* tflint
* fix gcs test
* documentation work
* documentation work
* Update README.md
* tfdoc
* tfdoc
* readme
* tfdoc
* readme
* readme
* readme
* readme
* support universe in pf exp projects
* missing universe service agents
* org policies import, non-admin billing IAM
* todo
* fix test
* custom constraints
* fast classic dataset
* fix test data
* context replacements in billing module log sinks
* fix typo
* add support for billing log sinks
* update docs
* readme
* cicd fix and test
---------
Co-authored-by: Julio Castillo <jccb@google.com >
2025-09-02 08:38:57 +02:00
Ludovico Magnocavallo
53f691320e
Support IAM tag factory context expansion in organization / project modules and FAST resman stage ( #3226 )
...
* tag factory context
* support tag factory contexts in resman
* schemas
* fix schema
2025-07-09 09:04:17 +02:00
Liam Nesteroff
1fbb2cb330
Added tag factory option for organization module ( #3178 )
...
* Added tag factory option for organization module
* added tags-factory tests
* added tag factory for project module
* missing header
* added lookup catch for org tag values and fixed incorrect link in doco
* fixed factory locals from copy/paste
* added full doco/tests for project tags factory. fixed failed test looking for ID in yamls
* added context option for factories_config to configure existing K/Vs
---------
Co-authored-by: Ludovico Magnocavallo <ludomagno@google.com >
2025-06-23 16:24:43 +10:00
Julio Castillo
3ffe838e06
Add context to organization policiy factories ( #2876 )
2025-02-10 22:24:01 +00:00
Julio Castillo
68a5a701e7
Expose parameters module in org policy variables
2025-02-07 10:55:05 +01:00
Julio Castillo
c59470a4fb
Update logging_data_access type ( #2816 )
...
* Update logging_data_access variables to use types
* Fix dependencies
* fix schema
* Add missing comma
* Fix try
2025-01-14 16:00:35 +00:00
Julio Castillo
7eff7b19dc
Add iam_by_principals_additive to project, organization and folder modules ( #2814 )
...
* First attempt at iam_by_principals_additive
* Remove validation
* Update IAM ADR
* Apply to organization and project modules
* Update READMEs
* Add tests
* Remove "cycle errors"
2025-01-14 12:32:19 +00:00
rshokati2
b4abbfe9d0
Add intercepting sinks to the organization and folder modules ( #2799 )
...
* RS-469: add support for intercept child on audit logging
* RS-469: add validation to ensure sink is set to project
* RS-469: add further validation to ensure include_children is also set to true when intercept is selected
* Update README
* RS-469: include optional flag for include and intercept
* RS-469: add intercept feature to folder module
* Fix organization README
* Fix condition
---------
Co-authored-by: Emile Hofsink <72841492+EmileHofsink@users.noreply.github.com >
Co-authored-by: Julio Castillo <jccb@google.com >
2025-01-10 10:36:08 +00:00
Ludovico Magnocavallo
4a61dba841
organization module factory schemas ( #2491 )
2024-08-09 10:22:57 +00:00
Ludovico Magnocavallo
41e583ffc9
add network tags outputs and examples to project module ( #2350 )
2024-06-09 07:52:15 +02:00
Ludovico Magnocavallo
dc686c3a84
Remove default location from gcs module ( #2303 )
...
* gcs module
* blueprints/apigee/bigquery-analytics
* tfdoc
* pubsub README md syntax
2024-05-24 07:02:33 +00:00
Ludovico Magnocavallo
e4941c27f2
Implement the full IAM interface for tags ( #2269 )
...
* IAM authoritative bindings in org module
* remove extra newline
* organization module
* project module
* tfdoc
2024-05-13 20:18:51 +02:00
Ludovico Magnocavallo
604920dec9
add logging settings to folder module ( #2268 )
2024-05-13 09:24:17 +02:00
Julio Castillo
759e85d6af
Logging updates ( #2139 )
...
* Add support for logging settings to the organization module
* Enable log analytics on FAST-managed logging buckets
* Fix README
* Fix tests
2024-03-08 10:07:12 +01:00
Ludovico Magnocavallo
e12cf83188
add links to factories doc ( #2134 )
2024-03-06 08:25:43 +01:00
Wiktor Niesiobędzki
9a95ac10ed
Once again fix e2e tests
2024-02-23 19:21:39 +01:00
Wiktor Niesiobędzki
8fd8ee0541
Fix too long project names on e2e tests
2024-02-23 11:41:58 +01:00
Julio Castillo
5197d5ca8d
Allow projects as destinations for log sinks ( #2102 )
...
* Add project log sink destination to project module
* Add project log sink destination to folder module
* Add project log sink destination to organization module
* Fix typos
* Add project log sink destination to billing-account module
* Make filter field optional
* Update READMEs
---------
Co-authored-by: Ludovico Magnocavallo <ludomagno@google.com >
2024-02-21 08:41:13 +01:00
Ludovico Magnocavallo
71a64487d5
Extend FAST to support different principal types ( #2064 )
...
* add doc draft
* typos
* typo
* typo
* typos
* rewording
* Update 0-domainless-iam.md
* Update 0-domainless-iam.md
* Update 0-domainless-iam.md
* Update 0-domainless-iam.md
* Update 0-domainless-iam.md
* Update 0-domainless-iam.md
* Update 0-domainless-iam.md
* Update 0-domainless-iam.md
* Update 0-domainless-iam.md
* Update 0-domainless-iam.md
* move iam variables to a separate file
* move billing-account module to iam_principals
* move data-catalog-policy-tag module to iam_principals
* move dataplex-datascan module to iam_principals
* move dataproc module to iam_principals
* move folder module to iam_principals
* copyright
* move organization module to iam_principals
* move project module to iam_principals
* move source-repository module to iam_principals
* update blueprints for iam_principals interface
* FAST bootstrap
* module READMEs fixes
* FAST bootstrap
* FAST networking stages
* FAST security stage
* FAST gke stage
* FAST multitenant bootstrap stage
* FAST multitenant resman stage
* tfdoc
* Update 0-domainless-iam.md
* Update 0-domainless-iam.md
* Update 0-domainless-iam.md
* Update 0-domainless-iam.md
* fix module test
* Update 0-domainless-iam.md
* Update 0-domainless-iam.md
* Rename iam_principals to iam_by_principals
* Update IAM template to include iam_by_principals
* Update Resman README
* Fix ADR link format
---------
Co-authored-by: Julio Castillo <jccb@google.com >
2024-02-12 14:35:30 +01:00
Ludovico Magnocavallo
bf93b6fb4e
fix typo in logging sinks interface ( #2015 )
2024-01-28 10:27:28 +01:00
Julio Castillo
01bd0b7b01
Add project-scoped secure tags ( #1933 )
2023-12-18 18:24:05 +01:00
Julio Castillo
b6e0557bbb
Simplify organization tags.tf locals ( #1932 )
...
* Simplify organization tags.tf locals
* Fix boilerplate
* Override github provider version for tests
2023-12-18 16:09:22 +00:00
Ludovico Magnocavallo
bba814c091
Custom role factories for organization and project modules ( #1912 )
...
* backport custom role factories
* backport from fast ci/cd branch
* indent
* tfdoc
* fix module tests
2023-12-11 14:16:39 +00:00
Wiktor Niesiobędzki
d9f9410ae5
Use unique names for logging buckets in examples
...
Logging bucket name can be reused only after 7 days (when it is actually
deleted). When different tests reuse the same name, the ones that are
executed as 2nd and later will fail with message:
```
Error updating Logging Bucket Config [...]: googleapi: Error 400: Buckets
must be in an ACTIVE state to be modified
```
As their actual state is:
```
lifecycleState: DELETE_REQUESTED
```
2023-12-03 10:03:22 +00:00
Wiktor Niesiobędzki
03bf0b15b3
Organization module end-to-end tests ( #1860 )
...
* added tag serial to mark tests to be run serially
* always run tests using loadgroup distribution to make use of serial tag
* added end-to-end tests for organization, not adding to custom constraints as the name has to be unique
* fixed granting custom roles created in the same module call
2023-11-14 18:54:59 +01:00
apichick
0f91a964da
Added back sink iam flag as module users might not have access to the sink destination and the role might need to be granted somewhere else
2023-11-07 08:11:23 +01:00
Simone Ruffilli
4decc641bb
Stop wrapping yamldecode with try() ( #1812 )
2023-10-25 16:16:05 +02:00
Ludovico Magnocavallo
ec3b705f53
Change type of iam_bindings variable to allow multiple conditional bindings ( #1658 )
...
* modules
* fast
* dns readme
2023-09-08 08:56:31 +02:00
Julio Castillo
04721a35ef
Allow single hfw policy association in folder and organization modules
2023-08-28 16:00:48 +02:00
Ludovico Magnocavallo
819894d2ba
IAM interface refactor ( #1595 )
...
* IAM modules refactor proposal
* policy
* subheading
* Update 20230816-iam-refactor.md
* log Julio's +1
* data-catalog-policy-tag
* dataproc
* dataproc
* folder
* folder
* folder
* folder
* project
* better filtering in test examples
* project
* folder
* folder
* organization
* fix variable descriptions
* kms
* net-vpc
* dataplex-datascan
* modules/iam-service-account
* modules/source-repository/
* blueprints/cloud-operations/vm-migration/
* blueprints/third-party-solutions/wordpress
* dataplex-datascan
* blueprints/cloud-operations/workload-identity-federation
* blueprints/data-solutions/cloudsql-multiregion/
* blueprints/data-solutions/composer-2
* Update 20230816-iam-refactor.md
* Update 20230816-iam-refactor.md
* capture discussion in architectural doc
* update variable names and refactor proposal
* project
* blueprints first round
* folder
* organization
* data-catalog-policy-tag
* re-enable folder inventory
* project module style fix
* dataproc
* source-repository
* source-repository tests
* dataplex-datascan
* dataplex-datascan tests
* net-vpc
* net-vpc test examples
* iam-service-account
* iam-service-account test examples
* kms
* boilerplate
* tfdoc
* fix module tests
* more blueprint fixes
* fix typo in data blueprints
* incomplete refactor of data platform foundations
* tfdoc
* data platform foundation
* refactor data platform foundation iam locals
* remove redundant example test
* shielded folder fix
* fix typo
* project factory
* project factory outputs
* tfdoc
* test workflow: less verbose tests, fix tf version
* re-enable -vv, shorter traceback, fix action version
* ignore github extension warning, re-enable action version
* fast bootstrap IAM, untested
* bootstrap stage IAM fixes
* stage 0 tests
* fast stage 1
* tenant stage 1
* minor changes to fast stage 0 and 1
* fast security stage
* fast mt stage 0
* fast mt stage 0
* fast pf
2023-08-20 09:44:20 +02:00
Ludovico Magnocavallo
def2f476d1
Add support for conditions to iam_members module variables ( #1594 )
...
* project
* data-catalog-policy-tag
* dataproc
* folder
* iam-service-account
* kms
* net-vpc
* organization
* source-repository
* dataplex-datascan
2023-08-15 16:28:23 +02:00
Ludovico Magnocavallo
adf2621727
Add new iam_members variable to IAM additive module interfaces ( #1589 )
...
* resource management modules
* data catalog policy
* dataproc
* service account
* kms
* net-vpc
* source repository
* dataplex datascan
* service account module variable order
2023-08-14 09:54:50 +00:00
Ludovico Magnocavallo
79373721df
Remove firewall policy management from resource management modules ( #1581 )
...
* rename firewall policy module, fix outputs
* add TOC to firewall policy module
* don't depend policy on parent id
* remove firewall policy from resource management modules
* remove factory conditionals
* fast net a and b
* fast stages
* fast tfdoc
* fast tfdoc
* remove unused test
* fix shielded folder blueprint
* fix shielded folder blueprint
2023-08-09 11:23:07 +00:00
Julio Castillo
1fdec356e2
Update large TOCs
2023-07-28 15:43:51 +02:00
Julio Castillo
4f123ccc74
Extend tfdoc to generate TOCs
2023-07-28 14:18:28 +02:00
Julio Castillo
74c50f95a8
Add output to org module with custom constraint details and depends_on
2023-07-17 18:49:36 +02:00
Ludovico Magnocavallo
551dc581e8
Implement proper support for data access logs in resource manager modules ( #1497 )
...
* organization module
* rename iam_bindings_authoritative to iam_policy, fix tests
* add support for data access logs and iam policy to folder module
* test inventories
* add support for data access logs and iam policy to project module
2023-07-10 08:08:02 +00:00
Ludovico Magnocavallo
6fcb010ff2
Add ToCs to resource manager modules ( #1471 )
...
* organization module
* folder
* project module
2023-06-27 09:36:28 +00:00
Alejandro Leal
15ae95df90
Fixing typos
...
- modules/organization/variables.tf
- modules/organization/README.md
- blueprints/data-solutions/shielded-folder/main.tf
2023-06-23 00:14:02 -04:00
lcaggio
39b27ac25e
Add support for Log Analytics on logging-bucket module and bump provider version ( #1423 )
...
* first commit
* Bump provider versions
* Fix tests
2023-06-07 23:23:28 +02:00
Ludovico Magnocavallo
884cb8b4bf
Ensure all modules have an id output ( #1410 )
...
* net-vpc
* a-d
* complete modules
* fix error
2023-06-02 16:07:22 +02:00
Julio Castillo
a5e905cb80
Update remaining org policies
2023-02-21 15:49:16 +01:00
Julio Castillo
62834ca83a
Update READMEs
2023-02-21 15:49:16 +01:00
Julio Castillo
6b767c9035
Simplify org policies data model in resman modules.
2023-02-21 15:49:16 +01:00
Ludovico Magnocavallo
5453c585e0
FAST multitenant bootstrap and resource management, rename org-level FAST stages ( #1052 )
...
* rename stages
* remove support for external org billing, rename output files
* resman: make groups optional, align on new billing account variable
* bootstrap: multitenant outputs
* tenant bootstrap stage, untested
* fix folder name
* fix stage 0 output names
* optional creation for tag keys in organization module
* single tenant bootstrap minus tag
* rename output files, add tenant tag key
* fix organization module tag values output
* test skipping creation for tags in organization module
* single tenant bootstrap plan working
* multitenant bootstrap
* tfdoc
* fix check links error messages
* fix links
* tfdoc
* fix links
* rename fast tests, fix bootstrap tests
* multitenant stages have their own folder, simplify stage numbering
* stage renumbering
* wip
* rename tests
* exclude fast providers in fixture
* stage 0 tests
* stage 1 tests
* network stages tests
* stage tests
* tfdoc
* fix links
* tfdoc
* multitenant tests
* remove local files
* stage links command
* fix links script, TODO
* wip
* wip single tenant bootstrap
* working tenant bootstrap
* update gitignore
* remove local files
* tfdoc
* remove local files
* allow tests for tenant bootstrap stage
* tenant bootstrap proxies stage 1 tfvars
* stage 2 and 3 service accounts and IAM in tenant bootstrap
* wip
* wip
* wip
* drop multitenant bootstrap
* tfdoc
* add missing stage 2 SAs, fix org-level IAM condition
* wip
* wip
* optional tag value creation in organization module
* stage 1 working
* linting
* linting
* READMEs
* wip
* Make stage-links script work in old macos bash
* stage links command help
* fix output file names
* diagrams
* fix svg
* stage 0 skeleton and diagram
* test svg
* test svg
* test diagram
* diagram
* readme
* fix stage links script
* stage 0 readme
* README changes
* stage readmes
* fix outputs order
* fix link
* fix tests
* stage 1 test
* skip stage example
* boilerplate
* fix tftest skip
* default bootstrap stage log sinks to log buckets
* add logging to tenant bootstrap
* move iam variables out of tenant config
* fix cicd, reintroduce missing variable
* use optional in stage 1 cicd variable
* rename extras stage
* rename and move identity providers local, use optional for cicd variable
* tfdoc
* add support for wif pool and providers, ci/cd
* tfdoc
* fix links
* better handling of modules repository
* add missing role on logging project
* fix cicd pools in locals, test cicd
* fix workflow extension
* fix module source replacement
* allow tenant bootstrap cicd sa to impersonate resman sa
* tenant workflow templates fix for no providers file
* fix output files, push github workflow template to new repository
* remove try from outpout files
* align stage 1 cicd internals to stage 0
* tfdoc
* tests
* fix tests
* tests
* improve variable descriptions
* use optional in fast features
* actually create tenant log sinks, and allow the resman sa to do it
* test
* tests
* aaaand tests again
* fast features tenant override
* fast features tenant override
* fix wording
* add missing comment
* configure pf service accounts
* add missing comment
* tfdoc
* tests
* IAM docs
* update copyright
---------
Co-authored-by: Julio Castillo <jccb@google.com >
2023-02-04 15:00:45 +01:00
Julio Castillo
e700a27079
Enforce terraform fmt in examples
2022-12-18 14:00:19 +01:00
Julio Castillo
513fdfe91a
Make directive for supporting files in examples more explicit
2022-12-18 14:00:19 +01:00
Julio Castillo
b5ca8932dc
Migrate organization to example-based tests
2022-12-18 14:00:19 +01:00
Ludovico Magnocavallo
f3788fcd27
fix tag outputs ( #1012 )
2022-11-25 13:06:31 +00:00
Julio Castillo
d41dc678e6
Fix organization module
2022-11-21 13:17:55 +01:00
