2020-07-07 01:23:26 -07:00
# VPC Service Control Module
This module allows managing VPC Service Control (VPC-SC) properties:
- [Access Policy ](https://cloud.google.com/access-context-manager/docs/create-access-policy )
- [Access Levels ](https://cloud.google.com/access-context-manager/docs/manage-access-levels )
- [VPC-SC Perimeters ](https://cloud.google.com/vpc-service-controls/docs/service-perimeters )
2020-07-09 22:22:57 -07:00
The Use of this module requires credentials with the [correct permissions ](https://cloud.google.com/access-context-manager/docs/access-control ) to use Access Context Manager.
2020-07-07 01:23:26 -07:00
## Example VCP-SC standard perimeter
```hcl
module "vpc-sc" {
2020-11-07 01:28:33 -08:00
source = "./modules/vpc-sc"
org_id = 112233
2020-07-07 01:23:26 -07:00
access_policy_title = "My Access Policy"
access_levels = {
2020-11-07 01:28:33 -08:00
my_trusted_proxy = {
2020-07-07 01:23:26 -07:00
combining_function = "AND"
2020-11-07 01:28:33 -08:00
conditions = [{
ip_subnetworks = ["85.85.85.52/32"]
members = []
negate = false
2020-07-07 01:23:26 -07:00
}]
}
}
access_level_perimeters = {
2020-11-07 01:28:33 -08:00
my_trusted_proxy = {
my_trusted_proxy = ["perimeter"]
}
}
perimeters = {
2020-07-07 01:23:26 -07:00
perimeter = {
2020-11-07 01:28:33 -08:00
type = "PERIMETER_TYPE_REGULAR"
dry_run_config = null
enforced_config = {
restricted_services = ["storage.googleapis.com"]
vpc_accessible_services = ["storage.googleapis.com"]
2020-07-07 01:23:26 -07:00
}
}
}
perimeter_projects = {
perimeter = {
2020-11-07 01:28:33 -08:00
enforced = [111111111, 222222222]
2020-07-07 01:23:26 -07:00
}
}
}
2020-11-07 01:28:33 -08:00
# tftest:modules=1:resources=3
2020-07-07 01:23:26 -07:00
```
## Example VCP-SC standard perimeter with one service and one project in dry run mode
```hcl
module "vpc-sc" {
2020-11-07 01:28:33 -08:00
source = "./modules/vpc-sc"
org_id = 112233
2020-07-07 01:23:26 -07:00
access_policy_title = "My Access Policy"
access_levels = {
2020-11-07 01:28:33 -08:00
my_trusted_proxy = {
2020-07-07 01:23:26 -07:00
combining_function = "AND"
2020-11-07 01:28:33 -08:00
conditions = [{
ip_subnetworks = ["85.85.85.52/32"]
members = []
negate = false
2020-07-07 01:23:26 -07:00
}]
}
}
access_level_perimeters = {
enforced = {
2020-11-07 01:28:33 -08:00
my_trusted_proxy = ["perimeter"]
2020-07-07 01:23:26 -07:00
}
2020-11-07 01:28:33 -08:00
}
perimeters = {
2020-07-07 01:23:26 -07:00
perimeter = {
2020-11-07 01:28:33 -08:00
type = "PERIMETER_TYPE_REGULAR"
dry_run_config = {
2020-07-07 01:23:26 -07:00
restricted_services = ["storage.googleapis.com", "bigquery.googleapis.com"]
vpc_accessible_services = ["storage.googleapis.com", "bigquery.googleapis.com"]
}
2020-11-07 01:28:33 -08:00
enforced_config = {
restricted_services = ["storage.googleapis.com"]
vpc_accessible_services = ["storage.googleapis.com"]
2020-07-07 01:23:26 -07:00
}
}
}
perimeter_projects = {
perimeter = {
2020-11-07 01:28:33 -08:00
enforced = [111111111, 222222222]
2020-07-07 01:23:26 -07:00
dry_run = [333333333]
}
}
}
2020-11-07 01:28:33 -08:00
# tftest:modules=1:resources=3
2020-07-07 01:23:26 -07:00
```
<!-- BEGIN TFDOC -->
## Variables
| name | description | type | required | default |
|---|---|:---: |:---:|:---:|
| access_policy_title | Access Policy title to be created. | < code title = "" > string< / code > | ✓ | |
| org_id | Organization id in nnnnnn format. | < code title = "" > number< / code > | ✓ | |
| *access_level_perimeters* | Enforced mode -> Access Level -> Perimeters mapping. Enforced mode can be 'enforced' or 'dry_run' | < code title = "map(map(list(string)))" > map(map(list(string)))</ code > | | < code title = "" > {}</ code > |
2020-08-15 01:12:43 -07:00
| *access_levels* | Access Levels. | < code title = "map(object({ combining_function = string conditions = list(object({ ip_subnetworks = list(string) members = list(string) negate = string })) }))" > map(object({...}))</ code > | | < code title = "" > {}</ code > |
2020-07-07 01:23:26 -07:00
| *perimeter_projects* | Perimeter -> Enforced Mode -> Projects Number mapping. Enforced mode can be 'enforced' or 'dry_run'. | < code title = "map(map(list(number)))" > map(map(list(number)))</ code > | | < code title = "" > {}</ code > |
2020-08-15 01:12:43 -07:00
| *perimeters* | Set of Perimeters. | < code title = "map(object({ type = string dry_run_config = object({ restricted_services = list(string) vpc_accessible_services = list(string) }) enforced_config = object({ restricted_services = list(string) vpc_accessible_services = list(string) }) }))" > map(object({...}))</ code > | | < code title = "" > {}</ code > |
2020-07-07 01:23:26 -07:00
## Outputs
| name | description | sensitive |
|---|---|:---:|
| access_levels | Access Levels. | |
| access_policy_name | Access Policy resource | |
| org_id | Organization id dependent on module resources. | |
| perimeters_bridge | VPC-SC bridge perimeter resources. | |
| perimeters_standard | VPC-SC standard perimeter resources. | |
<!-- END TFDOC -->