hunfabric/tests/modules/organization/context.yaml

# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

values:
  google_bigquery_dataset_iam_member.bq-sinks-binding["test-bq"]:
    condition: []
    dataset_id: logs
    project: test-prod-audit-logs-0
    role: roles/bigquery.dataEditor
  google_logging_organization_settings.default[0]:
    organization: '1234567890'
    storage_location: europe-west8
  google_logging_organization_sink.sink["test-bq"]:
    bigquery_options:
    - use_partitioned_tables: false
    description: test-bq (Terraform-managed).
    destination: bigquery.googleapis.com/projects/test-prod-audit-logs-0/datasets/logs
    disabled: false
    exclusions: []
    filter: log_id('cloudaudit.googleapis.com/activity')
    include_children: true
    intercept_children: false
    name: test-bq
    org_id: '1234567890'
  google_logging_organization_sink.sink["test-logging"]:
    description: test-logging (Terraform-managed).
    destination: logging.googleapis.com/projects/test-prod-audit-logs-0/locations/europe-west8/buckets/audit-logs
    disabled: false
    exclusions: []
    filter: log_id('cloudaudit.googleapis.com/activity')
    include_children: true
    intercept_children: false
    name: test-logging
    org_id: '1234567890'
  google_logging_organization_sink.sink["test-project"]:
    description: test-project (Terraform-managed).
    destination: logging.googleapis.com/projects/test-prod-audit-logs-0
    disabled: false
    exclusions: []
    filter: log_id('cloudaudit.googleapis.com/activity')
    include_children: true
    intercept_children: false
    name: test-project
    org_id: '1234567890'
  google_logging_organization_sink.sink["test-pubsub"]:
    description: test-pubsub (Terraform-managed).
    destination: pubsub.googleapis.com/projects/test-prod-audit-logs-0/topics/audit-logs
    disabled: false
    exclusions: []
    filter: log_id('cloudaudit.googleapis.com/activity')
    include_children: true
    intercept_children: false
    name: test-pubsub
    org_id: '1234567890'
  google_logging_organization_sink.sink["test-storage"]:
    description: test-storage (Terraform-managed).
    destination: storage.googleapis.com/test-prod-logs-audit-0
    disabled: false
    exclusions: []
    filter: log_id('cloudaudit.googleapis.com/activity')
    include_children: true
    intercept_children: false
    name: test-storage
    org_id: '1234567890'
  google_organization_iam_binding.authoritative["$custom_roles:myrole_one"]:
    condition: []
    members:
    - group:test-group@example.com
    - user:test-user@example.com
    org_id: '1234567890'
    role: organizations/366118655033/roles/myRoleOne
  google_organization_iam_binding.authoritative["roles/owner"]:
    condition: []
    members:
    - group:test-group@example.com
    org_id: '1234567890'
    role: roles/owner
  google_organization_iam_binding.authoritative["roles/viewer"]:
    condition: []
    members:
    - serviceAccount:test@test-project.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/viewer
  google_organization_iam_binding.bindings["myrole_two"]:
    condition:
    - description: null
      expression: resource.matchTag('1234567890/environment', 'development')
      title: Test
    members:
    - serviceAccount:test@test-project.iam.gserviceaccount.com
    org_id: '1234567890'
    role: organizations/366118655033/roles/myRoleTwo
  google_organization_iam_member.bindings["myrole_two"]:
    condition: []
    member: user:test-user@example.com
    org_id: '1234567890'
    role: organizations/366118655033/roles/myRoleTwo
  google_privileged_access_manager_entitlement.default["net-admins"]:
    additional_notification_targets: []
    approval_workflow:
    - manual_approvals:
      - require_approver_justification: true
        steps:
        - approvals_needed: 1
          approver_email_recipients: null
          approvers:
          - principals:
            - group:test-group@example.com
    eligible_users:
    - principals:
      - group:test-group@example.com
    entitlement_id: net-admins
    location: global
    max_request_duration: 3600s
    parent: organizations/1234567890
    privileged_access:
    - gcp_iam_access:
      - resource: //cloudresourcemanager.googleapis.com/organizations/1234567890
        resource_type: cloudresourcemanager.googleapis.com/Organization
        role_bindings:
        - condition_expression: null
          role: roles/compute.networkAdmin
        - condition_expression: null
          role: roles/compute.admin
        - condition_expression: null
          role: organizations/366118655033/roles/myRoleTwo
    requester_justification_config:
    - not_mandatory: []
      unstructured:
      - {}
  google_project_iam_member.bucket-sinks-binding["test-logging"]:
    condition:
    - expression: resource.name.endsWith('projects/test-prod-audit-logs-0/locations/europe-west8/buckets/audit-logs')
      title: test-logging bucket writer
    project: test-prod-audit-logs-0
    role: roles/logging.bucketWriter
  google_project_iam_member.project-sinks-binding["test-project"]:
    condition: []
    project: projects/test-prod-audit-logs-0
    role: roles/logging.logWriter
  google_pubsub_topic_iam_member.pubsub-sinks-binding["test-pubsub"]:
    condition: []
    project: test-prod-audit-logs-0
    role: roles/pubsub.publisher
    topic: audit-logs
  google_storage_bucket_iam_member.storage-sinks-binding["test-storage"]:
    bucket: test-prod-logs-audit-0
    condition: []
    role: roles/storage.objectCreator
  google_tags_tag_binding.binding["foo"]:
    parent: //cloudresourcemanager.googleapis.com/organizations/1234567890
    tag_value: tagValues/1234567890
  google_tags_tag_key_iam_binding.bindings["test:tag_user"]:
    condition: []
    members:
    - user:test-user@example.com
    role: roles/tagUser
    tag_key: tagKeys/1234567890
  google_tags_tag_key_iam_binding.default["test:roles/tagAdmin"]:
    condition: []
    members:
    - group:test-group@example.com
    role: roles/tagAdmin
    tag_key: tagKeys/1234567890
  google_tags_tag_key_iam_member.bindings["test:tag_viewer"]:
    condition: []
    member: serviceAccount:test@test-project.iam.gserviceaccount.com
    role: roles/tagViewer
    tag_key: tagKeys/1234567890
  google_tags_tag_value_iam_binding.bindings["test/one:tag_user"]:
    condition: []
    members:
    - user:test-user@example.com
    role: roles/tagUser
    tag_value: tagValues/1234567890
  google_tags_tag_value_iam_binding.default["test/one:roles/tagAdmin"]:
    condition: []
    members:
    - group:test-group@example.com
    role: roles/tagAdmin
    tag_value: tagValues/1234567890
  google_tags_tag_value_iam_member.bindings["test/one:tag_viewer"]:
    condition: []
    member: serviceAccount:test@test-project.iam.gserviceaccount.com
    role: roles/tagViewer
    tag_value: tagValues/1234567890

counts:
  google_bigquery_dataset_iam_member: 1
  google_logging_organization_settings: 1
  google_logging_organization_sink: 5
  google_organization_iam_binding: 4
  google_organization_iam_member: 1
  google_privileged_access_manager_entitlement: 1
  google_project_iam_member: 2
  google_pubsub_topic_iam_member: 1
  google_storage_bucket_iam_member: 1
  google_tags_tag_binding: 1
  google_tags_tag_key_iam_binding: 2
  google_tags_tag_key_iam_member: 1
  google_tags_tag_value_iam_binding: 2
  google_tags_tag_value_iam_member: 1
  modules: 0
  resources: 24