kovagoadi/hunfabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
f6775aca1b1f2264f9686f24fa58de482eeafa8b
hunfabric/data-solutions/cmek-via-centralized-kms
History
Ludovico Magnocavallo f6775aca1b Use the same versions file everywhere, pin to tf 1.0+ provider 4.0+ (#355) 
* add default versions file, remove old providers and versions

* use default versions file everywhere

* fix kms module

* re-add provider configuration for data platform step 2

* update kms module outputs sorting

* update kms documentation

* fix data solutions tests

* fix GKE workload identity attribute name

* work around firewall provider issue in datafusion example
2021-11-03 15:05:43 +01:00
..
backend.tf.sample
Update copyright to 2021
2021-02-15 09:38:10 +01:00
diagram.png
- Rename example to cmek-via-centralized-kms
2020-06-10 15:22:43 +02:00
main.tf
Use the same versions file everywhere, pin to tf 1.0+ provider 4.0+ (#355)
2021-11-03 15:05:43 +01:00
outputs.tf
Refactor compute-vm to remove multiple instance support (#314)
2021-10-04 10:46:44 +02:00
README.md
Refactor compute-vm to remove multiple instance support (#314)
2021-10-04 10:46:44 +02:00
variables.tf
Add more validations to linter
2021-10-08 18:26:04 +02:00
versions.tf
Use the same versions file everywhere, pin to tf 1.0+ provider 4.0+ (#355)
2021-11-03 15:05:43 +01:00

README.md

GCE and GCS CMEK via centralized Cloud KMS

This example creates a sample centralized Cloud KMS configuration, and uses it to implement CMEK for Cloud Storage and Compute Engine in a separate project.

The example is designed to match real-world use cases with a minimum amount of resources, and be used as a starting point for scenarios where application projects implement CMEK using keys managed by a central team. It also includes the IAM wiring needed to make such scenarios work.

This is the high level diagram:

High-level diagram

Managed resources and services

This sample creates several distinct groups of resources:

  • projects
    • Cloud KMS project
    • Service Project configured for GCE instances and GCS buckets
  • networking
    • VPC network
    • One subnet
    • Firewall rules for SSH access via IAP and open communication within the VPC
  • IAM
    • One service account for the GGE instance
  • KMS
    • One key ring
    • One crypto key (Procection level: softwere) for Cloud Engine
    • One crypto key (Protection level: softwere) for Cloud Storage
  • GCE
    • One instance encrypted with a CMEK Cryptokey hosted in Cloud KMS
  • GCS
    • One bucket encrypted with a CMEK Cryptokey hosted in Cloud KMS

Variables

name description type required default
billing_account Billing account id used as default for new projects. string ✓
root_node The resource name of the parent Folder or Organization. Must be of the form folders/folder_id or organizations/org_id. string ✓
location The location where resources will be deployed. string europe
project_kms_name Name for the new KMS Project. string my-project-kms-001
project_service_name Name for the new Service Project. string my-project-service-001
region The region where resources will be deployed. string europe-west1
vpc_ip_cidr_range Ip range used in the subnet deployef in the Service Project. string 10.0.0.0/20
vpc_name Name of the VPC created in the Service Project. string local
vpc_subnet_name Name of the subnet created in the Service Project. string subnet

Outputs

name description sensitive
bucket GCS Bucket URL.
bucket_keys GCS Bucket Cloud KMS crypto keys.
projects Project ids.
vm GCE VM.
vm_keys GCE VM Cloud KMS crypto keys.