2020-06-01 00:32:47 -07:00
|
|
|
/**
|
2022-01-01 06:52:31 -08:00
|
|
|
* Copyright 2022 Google LLC
|
2020-06-01 00:32:47 -07:00
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*/
|
|
|
|
|
2022-01-22 02:34:18 -08:00
|
|
|
# tfdoc:file:description Service identities and supporting resources.
|
|
|
|
|
2020-06-01 00:32:47 -07:00
|
|
|
locals {
|
2022-01-22 02:34:18 -08:00
|
|
|
_service_accounts_cmek_service_dependencies = {
|
|
|
|
"composer" : [
|
|
|
|
"composer",
|
|
|
|
"artifactregistry", "container-engine", "compute", "pubsub", "storage"
|
|
|
|
]
|
|
|
|
"dataflow" : ["dataflow", "compute"]
|
|
|
|
}
|
|
|
|
_service_accounts_robot_services = {
|
2022-10-24 08:44:21 -07:00
|
|
|
apigee = "service-%s@gcp-sa-apigee"
|
2022-01-22 02:34:18 -08:00
|
|
|
artifactregistry = "service-%s@gcp-sa-artifactregistry"
|
|
|
|
bq = "bq-%s@bigquery-encryption"
|
|
|
|
cloudasset = "service-%s@gcp-sa-cloudasset"
|
|
|
|
cloudbuild = "service-%s@gcp-sa-cloudbuild"
|
2022-02-09 02:06:51 -08:00
|
|
|
cloudfunctions = "service-%s@gcf-admin-robot"
|
|
|
|
cloudrun = "service-%s@serverless-robot-prod"
|
2022-01-22 02:34:18 -08:00
|
|
|
composer = "service-%s@cloudcomposer-accounts"
|
|
|
|
compute = "service-%s@compute-system"
|
|
|
|
container-engine = "service-%s@container-engine-robot"
|
|
|
|
containerregistry = "service-%s@containerregistry"
|
|
|
|
dataflow = "service-%s@dataflow-service-producer-prod"
|
|
|
|
dataproc = "service-%s@dataproc-accounts"
|
2022-07-15 02:56:13 -07:00
|
|
|
fleet = "service-%s@gcp-sa-gkehub"
|
2022-01-22 02:34:18 -08:00
|
|
|
gae-flex = "service-%s@gae-api-prod"
|
2022-02-09 02:06:51 -08:00
|
|
|
# TODO: deprecate gcf
|
2022-07-29 02:31:34 -07:00
|
|
|
gcf = "service-%s@gcf-admin-robot"
|
|
|
|
# TODO: jit?
|
|
|
|
gke-mcs = "service-%s@gcp-sa-mcsd"
|
2022-04-14 16:59:00 -07:00
|
|
|
monitoring-notifications = "service-%s@gcp-sa-monitoring-notification"
|
|
|
|
pubsub = "service-%s@gcp-sa-pubsub"
|
|
|
|
secretmanager = "service-%s@gcp-sa-secretmanager"
|
|
|
|
sql = "service-%s@gcp-sa-cloud-sql"
|
|
|
|
sqladmin = "service-%s@gcp-sa-cloud-sql"
|
|
|
|
storage = "service-%s@gs-project-accounts"
|
2022-01-22 02:34:18 -08:00
|
|
|
}
|
2020-06-01 00:32:47 -07:00
|
|
|
service_accounts_default = {
|
2020-06-25 01:04:57 -07:00
|
|
|
compute = "${local.project.number}-compute@developer.gserviceaccount.com"
|
|
|
|
gae = "${local.project.project_id}@appspot.gserviceaccount.com"
|
2020-06-01 00:32:47 -07:00
|
|
|
}
|
2022-01-22 02:34:18 -08:00
|
|
|
service_account_cloud_services = (
|
|
|
|
"${local.project.number}@cloudservices.gserviceaccount.com"
|
|
|
|
)
|
2022-07-29 02:31:34 -07:00
|
|
|
service_accounts_robots = merge(
|
|
|
|
{
|
|
|
|
for k, v in local._service_accounts_robot_services :
|
|
|
|
k => "${format(v, local.project.number)}.iam.gserviceaccount.com"
|
|
|
|
},
|
|
|
|
{
|
|
|
|
gke-mcs-importer = "${local.project.project_id}.svc.id.goog[gke-mcs/gke-mcs-importer]"
|
|
|
|
}
|
|
|
|
)
|
2022-01-22 02:34:18 -08:00
|
|
|
service_accounts_jit_services = [
|
2022-10-24 08:44:21 -07:00
|
|
|
"apigee.googleapis.com",
|
2022-09-20 01:36:12 -07:00
|
|
|
"artifactregistry.googleapis.com",
|
2022-04-12 10:01:34 -07:00
|
|
|
"cloudasset.googleapis.com",
|
2022-07-18 04:56:22 -07:00
|
|
|
"gkehub.googleapis.com",
|
2021-07-07 23:57:27 -07:00
|
|
|
"pubsub.googleapis.com",
|
2022-04-12 10:01:34 -07:00
|
|
|
"secretmanager.googleapis.com",
|
|
|
|
"sqladmin.googleapis.com"
|
2021-06-25 00:26:33 -07:00
|
|
|
]
|
2022-01-22 02:34:18 -08:00
|
|
|
service_accounts_cmek_service_keys = distinct(flatten([
|
|
|
|
for s in keys(var.service_encryption_key_ids) : [
|
|
|
|
for ss in try(local._service_accounts_cmek_service_dependencies[s], [s]) : [
|
|
|
|
for key in var.service_encryption_key_ids[s] : {
|
|
|
|
service = ss
|
|
|
|
key = key
|
|
|
|
} if key != null
|
|
|
|
]
|
|
|
|
]
|
|
|
|
]))
|
2020-06-01 00:32:47 -07:00
|
|
|
}
|
2021-06-11 07:00:20 -07:00
|
|
|
|
2021-06-14 15:54:59 -07:00
|
|
|
data "google_storage_project_service_account" "gcs_sa" {
|
|
|
|
count = contains(var.services, "storage.googleapis.com") ? 1 : 0
|
|
|
|
project = local.project.project_id
|
|
|
|
depends_on = [google_project_service.project_services]
|
2021-06-11 07:00:20 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
data "google_bigquery_default_service_account" "bq_sa" {
|
2021-06-14 15:54:59 -07:00
|
|
|
count = contains(var.services, "bigquery.googleapis.com") ? 1 : 0
|
|
|
|
project = local.project.project_id
|
|
|
|
depends_on = [google_project_service.project_services]
|
2021-06-11 07:00:20 -07:00
|
|
|
}
|
2021-06-14 09:35:53 -07:00
|
|
|
|
2022-03-17 06:29:28 -07:00
|
|
|
resource "google_project_service_identity" "servicenetworking" {
|
|
|
|
provider = google-beta
|
|
|
|
count = contains(var.services, "servicenetworking.googleapis.com") ? 1 : 0
|
|
|
|
project = local.project.project_id
|
|
|
|
service = "servicenetworking.googleapis.com"
|
|
|
|
depends_on = [google_project_service.project_services]
|
|
|
|
}
|
|
|
|
|
|
|
|
resource "google_project_iam_member" "servicenetworking" {
|
|
|
|
count = contains(var.services, "servicenetworking.googleapis.com") ? 1 : 0
|
|
|
|
project = local.project.project_id
|
|
|
|
role = "roles/servicenetworking.serviceAgent"
|
|
|
|
member = "serviceAccount:${google_project_service_identity.servicenetworking.0.email}"
|
|
|
|
}
|
|
|
|
|
2021-06-15 00:44:15 -07:00
|
|
|
# Secret Manager SA created just in time, we need to trigger the creation.
|
2021-06-25 00:26:33 -07:00
|
|
|
resource "google_project_service_identity" "jit_si" {
|
2022-01-22 02:34:18 -08:00
|
|
|
for_each = setintersection(var.services, local.service_accounts_jit_services)
|
2021-06-14 15:54:59 -07:00
|
|
|
provider = google-beta
|
|
|
|
project = local.project.project_id
|
2021-06-25 00:26:33 -07:00
|
|
|
service = each.value
|
2021-06-14 15:54:59 -07:00
|
|
|
depends_on = [google_project_service.project_services]
|
2021-06-14 09:35:53 -07:00
|
|
|
}
|
2022-01-22 02:34:18 -08:00
|
|
|
|
|
|
|
resource "google_kms_crypto_key_iam_member" "service_identity_cmek" {
|
|
|
|
for_each = {
|
|
|
|
for service_key in local.service_accounts_cmek_service_keys :
|
|
|
|
"${service_key.service}.${service_key.key}" => service_key
|
|
|
|
if service_key != service_key.key
|
|
|
|
}
|
|
|
|
crypto_key_id = each.value.key
|
|
|
|
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
|
|
|
|
member = "serviceAccount:${local.service_accounts_robots[each.value.service]}"
|
|
|
|
depends_on = [
|
|
|
|
google_project.project,
|
|
|
|
google_project_service.project_services,
|
|
|
|
google_project_service_identity.jit_si,
|
|
|
|
data.google_bigquery_default_service_account.bq_sa,
|
|
|
|
data.google_project.project,
|
|
|
|
data.google_storage_project_service_account.gcs_sa,
|
|
|
|
]
|
|
|
|
}
|
2022-09-29 06:10:07 -07:00
|
|
|
|
|
|
|
resource "google_project_default_service_accounts" "default_service_accounts" {
|
|
|
|
count = upper(var.default_service_account) == "KEEP" ? 0 : 1
|
|
|
|
action = upper(var.default_service_account)
|
|
|
|
project = local.project.project_id
|
|
|
|
restore_policy = "REVERT_AND_IGNORE_FAILURE"
|
|
|
|
depends_on = [google_project_service.project_services]
|
|
|
|
}
|