a5bbd09776
We have a use case, Local Controls, that requires to configure CMEK with Logging buckets. This commit adds an optional variable to configure CMEK in the `logging-bucket` module. By default the Logging bucket won't use CMEK encryption. To configure CMEK for Logging buckets it's also required to add the correct permissions to the bucket service account. For more information and a Terraform example, see: https://cloud.google.com/logging/docs/routing/managed-encryption-storage https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/logging_project_bucket_config#example-usage
59 lines
1.8 KiB
HCL
59 lines
1.8 KiB
HCL
/**
|
|
* Copyright 2022 Google LLC
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
resource "google_logging_project_bucket_config" "bucket" {
|
|
count = var.parent_type == "project" ? 1 : 0
|
|
project = var.parent
|
|
location = var.location
|
|
retention_days = var.retention
|
|
bucket_id = var.id
|
|
description = var.description
|
|
|
|
dynamic "cmek_settings" {
|
|
for_each = var.kms_key_name == null ? [] : [""]
|
|
content {
|
|
kms_key_name = var.kms_key_name
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "google_logging_folder_bucket_config" "bucket" {
|
|
count = var.parent_type == "folder" ? 1 : 0
|
|
folder = var.parent
|
|
location = var.location
|
|
retention_days = var.retention
|
|
bucket_id = var.id
|
|
description = var.description
|
|
}
|
|
|
|
resource "google_logging_organization_bucket_config" "bucket" {
|
|
count = var.parent_type == "organization" ? 1 : 0
|
|
organization = var.parent
|
|
location = var.location
|
|
retention_days = var.retention
|
|
bucket_id = var.id
|
|
description = var.description
|
|
}
|
|
|
|
resource "google_logging_billing_account_bucket_config" "bucket" {
|
|
count = var.parent_type == "billing_account" ? 1 : 0
|
|
billing_account = var.parent
|
|
location = var.location
|
|
retention_days = var.retention
|
|
bucket_id = var.id
|
|
description = var.description
|
|
}
|