hunfabric/modules/logging-bucket/README.md

Google Cloud Logging Buckets Module

This module manages logging buckets for a project, folder, organization or billing account.

Note that some logging buckets are automatically created for a given folder, project, organization, and billing account cannot be deleted. Creating a resource of this type will acquire and update the resource that already exists at the desired location. These buckets cannot be removed so deleting this resource will remove the bucket config from your terraform state but will leave the logging bucket unchanged. The buckets that are currently automatically created are "_Default" and "_Required".

See also the logging_sinks argument within the project, folder and organization modules.

• Custom logging bucket in a project
• Custom logging bucket in a project with Log Analytics
• Change retention period of a folder _Default bucket
• Organization and billing account buckets
• Custom bucket with views
• Variables
• Outputs

Custom logging bucket in a project

module "bucket" {
  source = "./fabric/modules/logging-bucket"
  parent = var.project_id
  name   = "mybucket"
}
# tftest modules=1 resources=1 inventory=project.yaml

Custom logging bucket in a project with Log Analytics

module "bucket" {
  source = "./fabric/modules/logging-bucket"
  parent = var.project_id
  name   = "mybucket"
  log_analytics = {
    enable          = true
    dataset_link_id = "log"
  }
}
# tftest modules=1 resources=2 inventory=log_analytics.yaml

Change retention period of a folder _Default bucket

module "folder" {
  source = "./fabric/modules/folder"
  parent = "folders/657104291943"
  name   = "my folder"
}

module "bucket-default" {
  source      = "./fabric/modules/logging-bucket"
  parent_type = "folder"
  parent      = module.folder.id
  name        = "_Default"
  retention   = 10
}
# tftest modules=2 resources=2 inventory=retention.yaml

Organization and billing account buckets

module "bucket-organization" {
  source      = "./fabric/modules/logging-bucket"
  parent_type = "organization"
  parent      = "organizations/012345"
  name        = "mybucket"
}

module "bucket-billing-account" {
  source      = "./fabric/modules/logging-bucket"
  parent_type = "billing_account"
  parent      = "012345"
  name        = "mybucket"
}
# tftest modules=2 resources=2 inventory=org-ba.yaml

Custom bucket with views

Views support our standard IAM interface via the following variables:

• iam and iam_by_principals configure authoritative bindings that manage individual roles exclusively, and are internally merged
• iam_bindings configure authoritative bindings with optional support for conditions, and are not internally merged with the previous two variables
• iam_bindings_additive configure additive bindings via individual role/member pairs with optional support conditions

The authoritative and additive approaches can be used together, provided different roles are managed by each. Some care must also be taken with the iam_by_principals variable to ensure that variable keys are static values, so that Terraform is able to compute the dependency graph.

Refer to the project module for examples of the IAM interface. IAM also supports variable interpolation for both roles and principals and for the foreign resources where the service account is the principal, via the respective attributes in the var.context variable. Basic usage is shown in the example below.

module "bucket" {
  source = "./fabric/modules/logging-bucket"
  parent = var.project_id
  name   = "mybucket"
  context = {
    iam_principals = {
      myuser = "user:user@example.com"
    }
  }
  views = {
    myview = {
      filter = "LOG_ID(\"stdout\")"
      iam = {
        "roles/logging.viewAccessor" = ["$iam_principals:myuser"]
      }
    }
  }
}
# tftest modules=1 resources=3 inventory=views.yaml

Variables

name	description	type	required	default
name	Name of the logging bucket.	string	✓
parent	ID of the parent resource containing the bucket in the format 'project_id' 'folders/folder_id', 'organizations/organization_id' or 'billing_account_id'.	string	✓
context	Context-specific interpolations.	object({…})		{}
description	Human-readable description for the logging bucket.	string		null
kms_key_name	To enable CMEK for a project logging bucket, set this field to a valid name. The associated service account requires cloudkms.cryptoKeyEncrypterDecrypter roles assigned for the key.	string		null
location	Location of the bucket.	string		"global"
locked	Whether the bucket is locked. Locked buckets may only be deleted if they are empty. This can only be set for project-level buckets.	bool		null
log_analytics	Enable and configure Analytics Log.	object({…})		{}
parent_type	Parent object type for the bucket (project, folder, organization, billing_account).	string		"project"
retention	Retention time in days for the logging bucket.	number		30
tag_bindings	Tag bindings for this bucket, in key => tag value id format.	map(string)		{}
views	Log views for this bucket.	map(object({…}))		{}

Outputs

name	description	sensitive
id	Fully qualified logging bucket id.
view_ids	The automatic and user-created views in this bucket.