hunfabric/modules/secure-source-manager-instance

Secure Source Manager

This module allows to create a Secure Source Manager instance and repositories in it. Additionally it allows creating instance IAM bindings and repository IAM bindings.

Examples

• Examples
  • Public instance
  • Public instance with CMEK
  • Private instance
  • IAM
  • Branch Protection Rules
  • Initial Configuration
• Variables
• Outputs

Public instance

module "ssm_instance" {
  source      = "./fabric/modules/secure-source-manager-instance"
  project_id  = var.project_id
  instance_id = "my-instance"
  location    = var.region
  repositories = {
    my-repository = {
      location = var.region
    }
  }
}
# tftest modules=1 resources=2 inventory=public-instance.yaml

Public instance with CMEK

module "ssm_instance" {
  source      = "./fabric/modules/secure-source-manager-instance"
  project_id  = var.project_id
  instance_id = "my-instance"
  location    = var.region
  kms_key     = "projects/another-project-id/locations/${var.region}/keyRings/my-key-ring/cryptoKeys/my-key"
  repositories = {
    my-repository = {}
  }
}
# tftest modules=1 resources=2 inventory=public-instance-with-cmek.yaml

Private instance

module "ssm_instance" {
  source      = "./fabric/modules/secure-source-manager-instance"
  project_id  = var.project_id
  instance_id = "my-instance"
  location    = var.region
  private_configs = {
    is_private = true
  }
  repositories = {
    my-repository = {}
  }
}
# tftest modules=1 resources=2 inventory=private-instance.yaml

You can optionally specify a Certificate Authority (CAS) pool and use your own certificate.

module "ssm_instance" {
  source      = "./fabric/modules/secure-source-manager-instance"
  project_id  = var.project_id
  instance_id = "my-instance"
  location    = var.region
  private_configs = {
    is_private = true
    ca_pool_id = "projects/another-project/locations/${var.region}/caPools/my-ca-pool"
  }
  repositories = {
    my-repository = {}
  }
}
# tftest modules=1 resources=2 inventory=private-instance-ca-pool.yaml

IAM

module "ssm_instance" {
  source      = "./fabric/modules/secure-source-manager-instance"
  project_id  = var.project_id
  instance_id = "my-instance"
  location    = var.region
  iam = {
    "roles/securesourcemanager.instanceOwner" = [
      "group:my-instance-admins@myorg.com"
    ]
  }
  repositories = {
    my-repository = {
      iam = {
        "roles/securesourcemanager.repoAdmin" = [
          "group:my-repo-admins@myorg.com"
        ]
      }
    }
  }
}
# tftest modules=1 resources=4 inventory=iam.yaml

module "ssm_instance" {
  source      = "./fabric/modules/secure-source-manager-instance"
  project_id  = var.project_id
  instance_id = "my-instance"
  location    = var.region
  iam_bindings_additive = {
    my-instance-admin = {
      role   = "roles/securesourcemanager.instanceOwner"
      member = "group:my-instance-admins@myorg.com"
    }
  }
  repositories = {
    my-repository = {
      iam_bindings_additive = {
        my-repository-admin = {
          role   = "roles/securesourcemanager.repoAdmin"
          member = "group:my-repo-admins@myorg.com"
        }
      }
    }
  }
}
# tftest modules=1 resources=4 inventory=iam-bindings.yaml

module "ssm_instance" {
  source      = "./fabric/modules/secure-source-manager-instance"
  project_id  = var.project_id
  instance_id = "my-instance"
  location    = var.region
  iam_bindings = {
    my-instance-admin = {
      role = "roles/securesourcemanager.instanceOwner"
      members = [
        "group:my-instance-admins@myorg.com"
      ]
    }
  }
  repositories = {
    my-repository = {
      iam_bindings = {
        my-repository-admin = {
          role = "roles/securesourcemanager.repoAdmin"
          members = [
            "group:my-repo-admins@myorg.com"
          ]
        }
      }
    }
  }
}
# tftest modules=1 resources=4 inventory=iam-bindings-additive.yaml

Branch Protection Rules

module "ssm_instance" {
  source      = "./fabric/modules/secure-source-manager-instance"
  project_id  = var.project_id
  instance_id = "my-instance"
  location    = var.region
  repositories = {
    my-repository = {
      branch_rules = {
        rule1 = {
          disabled                  = false
          include_pattern           = "main"
          require_pull_request      = true
          minimum_approvals_count   = 1
          minimum_reviews_count     = 1
          require_comments_resolved = true
          allow_stale_reviews       = false
          require_linear_history    = true
        }
      }
    }
  }
}
# tftest modules=1 resources=3 inventory=branch-protection-rules.yaml

Initial Configuration

module "ssm_instance" {
  source      = "./fabric/modules/secure-source-manager-instance"
  project_id  = var.project_id
  instance_id = "my-instance"
  location    = var.region
  repositories = {
    my-repository = {
      initial_config = {
        default_branch = "main"
        gitignores     = ["terraform.tfstate"]
      }
    }
  }
}
# tftest inventory=initial-config.yaml

Variables

name	description	type	required	default
instance_id	Instance ID.	string	✓
location	Location.	string	✓
project_id	Project ID.	string	✓
repositories	Repositories.	map(object({…}))	✓
iam	IAM bindings.	map(list(string))		{}
iam_bindings	IAM bindings.	map(object({…}))		{}
iam_bindings_additive	IAM bindings.	map(object({…}))		{}
instance_create	Create SSM Instance. When set to false, uses instance_id to reference existing SSM instance.	bool		true
kms_key	KMS key.	string		null
labels	Instance labels.	map(string)		null
private_configs	The configurations for SSM private instances.	object({…})		{}

Outputs

name	description	sensitive
instance	Instance.
instance_id	Instance id.
repositories	Repositories.
repository_ids	Repository ids.