Merge pull request #1681 from GoogleCloudPlatform/jccb/subnet-iam
Embed subnet-level IAM in the variables controlling creation of subnets
This commit is contained in:
Julio Castillo
GitHub
commit
0221198b2f
|
|
@ -1,4 +1,4 @@
|
|||
# Copyright 2022 Google LLC
|
||||
# Copyright 2023 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
|
|
@ -102,6 +102,11 @@ module "vpc-shared" {
|
|||
ip_cidr_range = var.ip_ranges.gce
|
||||
name = "gce"
|
||||
region = var.region
|
||||
iam = {
|
||||
"roles/compute.networkUser" = concat(var.owners_gce, [
|
||||
"serviceAccount:${module.project-svc-gce.service_accounts.cloud_services}",
|
||||
])
|
||||
}
|
||||
},
|
||||
{
|
||||
ip_cidr_range = var.ip_ranges.gke
|
||||
|
|
@ -111,24 +116,17 @@ module "vpc-shared" {
|
|||
pods = var.ip_secondary_ranges.gke-pods
|
||||
services = var.ip_secondary_ranges.gke-services
|
||||
}
|
||||
iam = {
|
||||
"roles/compute.networkUser" = concat(var.owners_gke, [
|
||||
"serviceAccount:${module.project-svc-gke.service_accounts.cloud_services}",
|
||||
"serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}",
|
||||
])
|
||||
"roles/compute.securityAdmin" = [
|
||||
"serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}",
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
subnet_iam = {
|
||||
"${var.region}/gce" = {
|
||||
"roles/compute.networkUser" = concat(var.owners_gce, [
|
||||
"serviceAccount:${module.project-svc-gce.service_accounts.cloud_services}",
|
||||
])
|
||||
}
|
||||
"${var.region}/gke" = {
|
||||
"roles/compute.networkUser" = concat(var.owners_gke, [
|
||||
"serviceAccount:${module.project-svc-gke.service_accounts.cloud_services}",
|
||||
"serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}",
|
||||
])
|
||||
"roles/compute.securityAdmin" = [
|
||||
"serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}",
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
module "vpc-shared-firewall" {
|
||||
|
|
|
|||
|
|
@ -55,7 +55,9 @@ module "landing-vpc" {
|
|||
private = true
|
||||
restricted = true
|
||||
}
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/landing"
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/landing"
|
||||
}
|
||||
}
|
||||
|
||||
module "landing-firewall" {
|
||||
|
|
|
|||
|
|
@ -46,12 +46,14 @@ module "dev-spoke-project" {
|
|||
}
|
||||
|
||||
module "dev-spoke-vpc" {
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.dev-spoke-project.project_id
|
||||
name = "dev-spoke-0"
|
||||
mtu = 1500
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/dev"
|
||||
psa_config = try(var.psa_ranges.dev, null)
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.dev-spoke-project.project_id
|
||||
name = "dev-spoke-0"
|
||||
mtu = 1500
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/dev"
|
||||
}
|
||||
psa_config = try(var.psa_ranges.dev, null)
|
||||
# set explicit routes for googleapis in case the default route is deleted
|
||||
create_googleapis_routes = {
|
||||
private = true
|
||||
|
|
|
|||
|
|
@ -45,12 +45,14 @@ module "prod-spoke-project" {
|
|||
}
|
||||
|
||||
module "prod-spoke-vpc" {
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.prod-spoke-project.project_id
|
||||
name = "prod-spoke-0"
|
||||
mtu = 1500
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/prod"
|
||||
psa_config = try(var.psa_ranges.prod, null)
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.prod-spoke-project.project_id
|
||||
name = "prod-spoke-0"
|
||||
mtu = 1500
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/prod"
|
||||
}
|
||||
psa_config = try(var.psa_ranges.prod, null)
|
||||
# set explicit routes for googleapis in case the default route is deleted
|
||||
create_googleapis_routes = {
|
||||
private = true
|
||||
|
|
|
|||
|
|
@ -55,7 +55,9 @@ module "landing-vpc" {
|
|||
private = true
|
||||
restricted = true
|
||||
}
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/landing"
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/landing"
|
||||
}
|
||||
}
|
||||
|
||||
module "landing-firewall" {
|
||||
|
|
|
|||
|
|
@ -46,12 +46,14 @@ module "dev-spoke-project" {
|
|||
}
|
||||
|
||||
module "dev-spoke-vpc" {
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.dev-spoke-project.project_id
|
||||
name = "dev-spoke-0"
|
||||
mtu = 1500
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/dev"
|
||||
psa_config = try(var.psa_ranges.dev, null)
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.dev-spoke-project.project_id
|
||||
name = "dev-spoke-0"
|
||||
mtu = 1500
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/dev"
|
||||
}
|
||||
psa_config = try(var.psa_ranges.dev, null)
|
||||
# set explicit routes for googleapis in case the default route is deleted
|
||||
create_googleapis_routes = {
|
||||
private = true
|
||||
|
|
|
|||
|
|
@ -45,12 +45,14 @@ module "prod-spoke-project" {
|
|||
}
|
||||
|
||||
module "prod-spoke-vpc" {
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.prod-spoke-project.project_id
|
||||
name = "prod-spoke-0"
|
||||
mtu = 1500
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/prod"
|
||||
psa_config = try(var.psa_ranges.prod, null)
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.prod-spoke-project.project_id
|
||||
name = "prod-spoke-0"
|
||||
mtu = 1500
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/prod"
|
||||
}
|
||||
psa_config = try(var.psa_ranges.prod, null)
|
||||
# set explicit routes for googleapis in case the default route is deleted
|
||||
create_googleapis_routes = {
|
||||
private = true
|
||||
|
|
|
|||
|
|
@ -54,7 +54,9 @@ module "landing-untrusted-vpc" {
|
|||
logging = false
|
||||
}
|
||||
create_googleapis_routes = null
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted"
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted"
|
||||
}
|
||||
}
|
||||
|
||||
module "landing-untrusted-firewall" {
|
||||
|
|
@ -110,7 +112,9 @@ module "landing-trusted-vpc" {
|
|||
name = "prod-trusted-landing-0"
|
||||
delete_default_routes_on_create = true
|
||||
mtu = 1500
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/landing-trusted"
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/landing-trusted"
|
||||
}
|
||||
dns_policy = {
|
||||
inbound = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -45,11 +45,13 @@ module "dev-spoke-project" {
|
|||
}
|
||||
|
||||
module "dev-spoke-vpc" {
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.dev-spoke-project.project_id
|
||||
name = "dev-spoke-0"
|
||||
mtu = 1500
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/dev"
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.dev-spoke-project.project_id
|
||||
name = "dev-spoke-0"
|
||||
mtu = 1500
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/dev"
|
||||
}
|
||||
delete_default_routes_on_create = true
|
||||
psa_config = try(var.psa_ranges.dev, null)
|
||||
# Set explicit routes for googleapis; send everything else to NVAs
|
||||
|
|
|
|||
|
|
@ -44,11 +44,13 @@ module "prod-spoke-project" {
|
|||
}
|
||||
|
||||
module "prod-spoke-vpc" {
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.prod-spoke-project.project_id
|
||||
name = "prod-spoke-0"
|
||||
mtu = 1500
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/prod"
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.prod-spoke-project.project_id
|
||||
name = "prod-spoke-0"
|
||||
mtu = 1500
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/prod"
|
||||
}
|
||||
delete_default_routes_on_create = true
|
||||
psa_config = try(var.psa_ranges.prod, null)
|
||||
# Set explicit routes for googleapis; send everything else to NVAs
|
||||
|
|
|
|||
|
|
@ -46,12 +46,14 @@ module "dev-spoke-project" {
|
|||
}
|
||||
|
||||
module "dev-spoke-vpc" {
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.dev-spoke-project.project_id
|
||||
name = "dev-spoke-0"
|
||||
mtu = 1500
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/dev"
|
||||
psa_config = try(var.psa_ranges.dev, null)
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.dev-spoke-project.project_id
|
||||
name = "dev-spoke-0"
|
||||
mtu = 1500
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/dev"
|
||||
}
|
||||
psa_config = try(var.psa_ranges.dev, null)
|
||||
# set explicit routes for googleapis in case the default route is deleted
|
||||
create_googleapis_routes = {
|
||||
private = true
|
||||
|
|
|
|||
|
|
@ -45,12 +45,14 @@ module "prod-spoke-project" {
|
|||
}
|
||||
|
||||
module "prod-spoke-vpc" {
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.prod-spoke-project.project_id
|
||||
name = "prod-spoke-0"
|
||||
mtu = 1500
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/prod"
|
||||
psa_config = try(var.psa_ranges.prod, null)
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.prod-spoke-project.project_id
|
||||
name = "prod-spoke-0"
|
||||
mtu = 1500
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/prod"
|
||||
}
|
||||
psa_config = try(var.psa_ranges.prod, null)
|
||||
# set explicit routes for googleapis in case the default route is deleted
|
||||
create_googleapis_routes = {
|
||||
private = true
|
||||
|
|
|
|||
|
|
@ -55,7 +55,9 @@ module "landing-untrusted-vpc" {
|
|||
logging = false
|
||||
}
|
||||
create_googleapis_routes = null
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted"
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted"
|
||||
}
|
||||
}
|
||||
|
||||
module "landing-untrusted-firewall" {
|
||||
|
|
@ -111,7 +113,9 @@ module "landing-trusted-vpc" {
|
|||
name = "prod-trusted-landing-0"
|
||||
delete_default_routes_on_create = true
|
||||
mtu = 1500
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/landing-trusted"
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/landing-trusted"
|
||||
}
|
||||
dns_policy = {
|
||||
inbound = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -45,11 +45,13 @@ module "dev-spoke-project" {
|
|||
}
|
||||
|
||||
module "dev-spoke-vpc" {
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.dev-spoke-project.project_id
|
||||
name = "dev-spoke-0"
|
||||
mtu = 1500
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/dev"
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.dev-spoke-project.project_id
|
||||
name = "dev-spoke-0"
|
||||
mtu = 1500
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/dev"
|
||||
}
|
||||
delete_default_routes_on_create = true
|
||||
psa_config = try(var.psa_ranges.dev, null)
|
||||
# Set explicit routes for googleapis; send everything else to NVAs
|
||||
|
|
|
|||
|
|
@ -44,11 +44,13 @@ module "prod-spoke-project" {
|
|||
}
|
||||
|
||||
module "prod-spoke-vpc" {
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.prod-spoke-project.project_id
|
||||
name = "prod-spoke-0"
|
||||
mtu = 1500
|
||||
data_folder = "${var.factories_config.data_dir}/subnets/prod"
|
||||
source = "../../../modules/net-vpc"
|
||||
project_id = module.prod-spoke-project.project_id
|
||||
name = "prod-spoke-0"
|
||||
mtu = 1500
|
||||
factories_config = {
|
||||
subnets_folder = "${var.factories_config.data_dir}/subnets/prod"
|
||||
}
|
||||
delete_default_routes_on_create = true
|
||||
psa_config = try(var.psa_ranges.prod, null)
|
||||
# Set explicit routes for googleapis; send everything else to NVAs
|
||||
|
|
|
|||
|
|
@ -112,38 +112,34 @@ module "vpc" {
|
|||
name = "subnet-1"
|
||||
region = "europe-west1"
|
||||
ip_cidr_range = "10.0.1.0/24"
|
||||
iam = {
|
||||
"roles/compute.networkUser" = [
|
||||
"user:user1@example.com", "group:group1@example.com"
|
||||
]
|
||||
}
|
||||
iam_bindings = {
|
||||
"roles/compute.networkUser" = {
|
||||
members = ["group:group2@example.com"]
|
||||
condition = {
|
||||
expression = "resource.matchTag('123456789012/env', 'prod')"
|
||||
title = "test_condition"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
name = "subnet-2"
|
||||
region = "europe-west1"
|
||||
ip_cidr_range = "10.0.1.0/24"
|
||||
}
|
||||
]
|
||||
subnet_iam = {
|
||||
"europe-west1/subnet-1" = {
|
||||
"roles/compute.networkUser" = [
|
||||
"user:user1@example.com", "group:group1@example.com"
|
||||
]
|
||||
}
|
||||
}
|
||||
subnet_iam_bindings = {
|
||||
"europe-west1/subnet-1" = {
|
||||
"roles/compute.networkUser" = {
|
||||
members = ["group:group2@example.com"]
|
||||
condition = {
|
||||
expression = "resource.matchTag('123456789012/env', 'prod')"
|
||||
title = "test_condition"
|
||||
iam_bindings_additive = {
|
||||
subnet-2-am1 = {
|
||||
member = "user:am1@example.com"
|
||||
role = "roles/compute.networkUser"
|
||||
subnet = "europe-west1/subnet-2"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
subnet_iam_bindings_additive = {
|
||||
subnet-2-am1 = {
|
||||
member = "user:am1@example.com"
|
||||
role = "roles/compute.networkUser"
|
||||
subnet = "europe-west1/subnet-2"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
# tftest modules=1 resources=8 inventory=subnet-iam.yaml
|
||||
```
|
||||
|
|
@ -212,6 +208,15 @@ module "vpc-host" {
|
|||
pods = "172.16.0.0/20"
|
||||
services = "192.168.0.0/24"
|
||||
}
|
||||
iam = {
|
||||
"roles/compute.networkUser" = [
|
||||
local.service_project_1.cloud_services_service_account,
|
||||
local.service_project_1.gke_service_account
|
||||
]
|
||||
"roles/compute.securityAdmin" = [
|
||||
local.service_project_1.gke_service_account
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
shared_vpc_host = true
|
||||
|
|
@ -219,17 +224,6 @@ module "vpc-host" {
|
|||
local.service_project_1.project_id,
|
||||
local.service_project_2.project_id
|
||||
]
|
||||
subnet_iam = {
|
||||
"europe-west1/subnet-1" = {
|
||||
"roles/compute.networkUser" = [
|
||||
local.service_project_1.cloud_services_service_account,
|
||||
local.service_project_1.gke_service_account
|
||||
]
|
||||
"roles/compute.securityAdmin" = [
|
||||
local.service_project_1.gke_service_account
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=9 inventory=shared-vpc.yaml
|
||||
```
|
||||
|
|
@ -350,10 +344,12 @@ The `net-vpc` module includes a subnet factory (see [Resource Factories](../../b
|
|||
|
||||
```hcl
|
||||
module "vpc" {
|
||||
source = "./fabric/modules/net-vpc"
|
||||
project_id = "my-project"
|
||||
name = "my-network"
|
||||
data_folder = "config/subnets"
|
||||
source = "./fabric/modules/net-vpc"
|
||||
project_id = "my-project"
|
||||
name = "my-network"
|
||||
factories_config = {
|
||||
subnets_folder = "config/subnets"
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=10 files=subnet-simple,subnet-simple-2,subnet-detailed,subnet-proxy,subnet-proxy-global,subnet-psc inventory=factory.yaml
|
||||
```
|
||||
|
|
@ -379,38 +375,39 @@ description: Sample description
|
|||
ip_cidr_range: 10.0.0.0/24
|
||||
# optional attributes
|
||||
enable_private_access: false # defaults to true
|
||||
iam: # grant roles/compute.networkUser
|
||||
- group:lorem@example.com
|
||||
- serviceAccount:fbz@prj.iam.gserviceaccount.com
|
||||
- user:foobar@example.com
|
||||
iam:
|
||||
roles/compute.networkUser:
|
||||
- group:lorem@example.com
|
||||
- serviceAccount:fbz@prj.iam.gserviceaccount.com
|
||||
- user:foobar@example.com
|
||||
secondary_ip_ranges: # map of secondary ip ranges
|
||||
secondary-range-a: 192.168.0.0/24
|
||||
flow_logs: # enable, set to empty map to use defaults
|
||||
flow_logs_config: # enable, set to empty map to use defaults
|
||||
aggregation_interval: "INTERVAL_5_SEC"
|
||||
flow_sampling: 0.5
|
||||
metadata: "INCLUDE_ALL_METADATA"
|
||||
filter_expression: null
|
||||
```
|
||||
|
||||
```yaml
|
||||
# tftest-file id=subnet-proxy path=config/subnets/subnet-proxy.yaml
|
||||
region: europe-west4
|
||||
ip_cidr_range: 10.1.0.0/24
|
||||
purpose: REGIONAL_MANAGED_PROXY
|
||||
proxy_only: true
|
||||
```
|
||||
|
||||
```yaml
|
||||
# tftest-file id=subnet-proxy-global path=config/subnets/subnet-proxy-global.yaml
|
||||
region: australia-southeast2
|
||||
ip_cidr_range: 10.4.0.0/24
|
||||
purpose: GLOBAL_MANAGED_PROXY
|
||||
proxy_only: true
|
||||
global: true
|
||||
```
|
||||
|
||||
```yaml
|
||||
# tftest-file id=subnet-psc path=config/subnets/subnet-psc.yaml
|
||||
region: europe-west4
|
||||
ip_cidr_range: 10.2.0.0/24
|
||||
purpose: PRIVATE_SERVICE_CONNECT
|
||||
psc: true
|
||||
```
|
||||
|
||||
### Custom Routes
|
||||
|
|
@ -539,30 +536,27 @@ module "vpc" {
|
|||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [name](variables.tf#L93) | The name of the network being created. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L109) | The ID of the project where this VPC will be created. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L95) | The name of the network being created. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L111) | The ID of the project where this VPC will be created. | <code>string</code> | ✓ | |
|
||||
| [auto_create_subnetworks](variables.tf#L17) | Set to true to create an auto mode subnet, defaults to custom mode. | <code>bool</code> | | <code>false</code> |
|
||||
| [create_googleapis_routes](variables.tf#L23) | Toggle creation of googleapis private/restricted routes. Disabled when vpc creation is turned off, or when set to null. | <code title="object({ private = optional(bool, true) private-6 = optional(bool, false) restricted = optional(bool, true) restricted-6 = optional(bool, false) })">object({…})</code> | | <code>{}</code> |
|
||||
| [data_folder](variables.tf#L34) | An optional folder containing the subnet configurations in YaML format. | <code>string</code> | | <code>null</code> |
|
||||
| [delete_default_routes_on_create](variables.tf#L40) | Set to true to delete the default routes at creation time. | <code>bool</code> | | <code>false</code> |
|
||||
| [description](variables.tf#L46) | An optional description of this resource (triggers recreation on change). | <code>string</code> | | <code>"Terraform-managed."</code> |
|
||||
| [dns_policy](variables.tf#L52) | DNS policy setup for the VPC. | <code title="object({ inbound = optional(bool) logging = optional(bool) outbound = optional(object({ private_ns = list(string) public_ns = list(string) })) })">object({…})</code> | | <code>null</code> |
|
||||
| [firewall_policy_enforcement_order](variables.tf#L65) | Order that Firewall Rules and Firewall Policies are evaluated. Can be either 'BEFORE_CLASSIC_FIREWALL' or 'AFTER_CLASSIC_FIREWALL'. | <code>string</code> | | <code>"AFTER_CLASSIC_FIREWALL"</code> |
|
||||
| [ipv6_config](variables.tf#L77) | Optional IPv6 configuration for this network. | <code title="object({ enable_ula_internal = optional(bool) internal_range = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [mtu](variables.tf#L87) | Maximum Transmission Unit in bytes. The minimum value for this field is 1460 (the default) and the maximum value is 1500 bytes. | <code>number</code> | | <code>null</code> |
|
||||
| [peering_config](variables.tf#L98) | VPC peering configuration. | <code title="object({ peer_vpc_self_link = string create_remote_peer = optional(bool, true) export_routes = optional(bool) import_routes = optional(bool) })">object({…})</code> | | <code>null</code> |
|
||||
| [psa_config](variables.tf#L114) | The Private Service Access configuration for Service Networking. | <code title="object({ ranges = map(string) export_routes = optional(bool, false) import_routes = optional(bool, false) })">object({…})</code> | | <code>null</code> |
|
||||
| [routes](variables.tf#L124) | Network routes, keyed by name. | <code title="map(object({ description = optional(string, "Terraform-managed.") dest_range = string next_hop_type = string # gateway, instance, ip, vpn_tunnel, ilb next_hop = string priority = optional(number) tags = optional(list(string)) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [routing_mode](variables.tf#L145) | The network routing mode (default 'GLOBAL'). | <code>string</code> | | <code>"GLOBAL"</code> |
|
||||
| [shared_vpc_host](variables.tf#L155) | Enable shared VPC for this project. | <code>bool</code> | | <code>false</code> |
|
||||
| [shared_vpc_service_projects](variables.tf#L161) | Shared VPC service projects to register with this host. | <code>list(string)</code> | | <code>[]</code> |
|
||||
| [subnet_iam](variables.tf#L167) | Subnet IAM bindings in {REGION/NAME => {ROLE => [MEMBERS]} format. | <code>map(map(list(string)))</code> | | <code>{}</code> |
|
||||
| [subnet_iam_bindings](variables.tf#L173) | Authoritative IAM bindings in {REGION/NAME => {ROLE => {members = [], condition = {}}}}. | <code title="map(map(object({ members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })))">map(map(object({…})))</code> | | <code>{}</code> |
|
||||
| [subnet_iam_bindings_additive](variables.tf#L187) | Individual additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string subnet = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [subnets](variables.tf#L203) | Subnet configuration. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) enable_private_access = optional(bool, true) flow_logs_config = optional(object({ aggregation_interval = optional(string) filter_expression = optional(string) flow_sampling = optional(number) metadata = optional(string) metadata_fields = optional(list(string)) })) ipv6 = optional(object({ access_type = optional(string, "INTERNAL") })) secondary_ip_ranges = optional(map(string)) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [subnets_proxy_only](variables.tf#L230) | List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) active = bool global = optional(bool, false) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [subnets_psc](variables.tf#L244) | List of subnets for Private Service Connect service producers. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [vpc_create](variables.tf#L256) | Create VPC. When set to false, uses a data source to reference existing VPC. | <code>bool</code> | | <code>true</code> |
|
||||
| [delete_default_routes_on_create](variables.tf#L34) | Set to true to delete the default routes at creation time. | <code>bool</code> | | <code>false</code> |
|
||||
| [description](variables.tf#L40) | An optional description of this resource (triggers recreation on change). | <code>string</code> | | <code>"Terraform-managed."</code> |
|
||||
| [dns_policy](variables.tf#L46) | DNS policy setup for the VPC. | <code title="object({ inbound = optional(bool) logging = optional(bool) outbound = optional(object({ private_ns = list(string) public_ns = list(string) })) })">object({…})</code> | | <code>null</code> |
|
||||
| [factories_config](variables.tf#L59) | Paths to data files and folders that enable factory functionality. | <code title="object({ subnets_folder = string })">object({…})</code> | | <code>null</code> |
|
||||
| [firewall_policy_enforcement_order](variables.tf#L67) | Order that Firewall Rules and Firewall Policies are evaluated. Can be either 'BEFORE_CLASSIC_FIREWALL' or 'AFTER_CLASSIC_FIREWALL'. | <code>string</code> | | <code>"AFTER_CLASSIC_FIREWALL"</code> |
|
||||
| [ipv6_config](variables.tf#L79) | Optional IPv6 configuration for this network. | <code title="object({ enable_ula_internal = optional(bool) internal_range = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [mtu](variables.tf#L89) | Maximum Transmission Unit in bytes. The minimum value for this field is 1460 (the default) and the maximum value is 1500 bytes. | <code>number</code> | | <code>null</code> |
|
||||
| [peering_config](variables.tf#L100) | VPC peering configuration. | <code title="object({ peer_vpc_self_link = string create_remote_peer = optional(bool, true) export_routes = optional(bool) import_routes = optional(bool) })">object({…})</code> | | <code>null</code> |
|
||||
| [psa_config](variables.tf#L116) | The Private Service Access configuration for Service Networking. | <code title="object({ ranges = map(string) export_routes = optional(bool, false) import_routes = optional(bool, false) })">object({…})</code> | | <code>null</code> |
|
||||
| [routes](variables.tf#L126) | Network routes, keyed by name. | <code title="map(object({ description = optional(string, "Terraform-managed.") dest_range = string next_hop_type = string # gateway, instance, ip, vpn_tunnel, ilb next_hop = string priority = optional(number) tags = optional(list(string)) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [routing_mode](variables.tf#L147) | The network routing mode (default 'GLOBAL'). | <code>string</code> | | <code>"GLOBAL"</code> |
|
||||
| [shared_vpc_host](variables.tf#L157) | Enable shared VPC for this project. | <code>bool</code> | | <code>false</code> |
|
||||
| [shared_vpc_service_projects](variables.tf#L163) | Shared VPC service projects to register with this host. | <code>list(string)</code> | | <code>[]</code> |
|
||||
| [subnets](variables.tf#L169) | Subnet configuration. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) enable_private_access = optional(bool, true) flow_logs_config = optional(object({ aggregation_interval = optional(string) filter_expression = optional(string) flow_sampling = optional(number) metadata = optional(string) metadata_fields = optional(list(string)) })) ipv6 = optional(object({ access_type = optional(string, "INTERNAL") })) secondary_ip_ranges = optional(map(string)) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [subnets_proxy_only](variables.tf#L215) | List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) active = optional(bool, true) global = optional(bool, false) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [subnets_psc](variables.tf#L248) | List of subnets for Private Service Connect service producers. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [vpc_create](variables.tf#L279) | Create VPC. When set to false, uses a data source to reference existing VPC. | <code>bool</code> | | <code>true</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
/**
|
||||
* Copyright 2022 Google LLC
|
||||
* Copyright 2023 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
|
|
@ -18,68 +18,112 @@
|
|||
|
||||
locals {
|
||||
_factory_data = {
|
||||
for f in try(fileset(var.data_folder, "**/*.yaml"), []) :
|
||||
trimsuffix(basename(f), ".yaml") => yamldecode(file("${var.data_folder}/${f}"))
|
||||
for f in try(fileset(var.factories_config.subnets_folder, "**/*.yaml"), []) :
|
||||
trimsuffix(basename(f), ".yaml") => yamldecode(file("${var.factories_config.subnets_folder}/${f}"))
|
||||
}
|
||||
_factory_subnets = {
|
||||
for k, v in local._factory_data : "${v.region}/${try(v.name, k)}" => {
|
||||
name = try(v.name, k)
|
||||
ip_cidr_range = v.ip_cidr_range
|
||||
region = v.region
|
||||
for k, v in local._factory_data :
|
||||
"${v.region}/${try(v.name, k)}" => {
|
||||
active = try(v.active, true)
|
||||
description = try(v.description, null)
|
||||
enable_private_access = try(v.enable_private_access, true)
|
||||
flow_logs_config = try(v.flow_logs, null)
|
||||
ipv6 = try(v.ipv6, null)
|
||||
secondary_ip_ranges = try(v.secondary_ip_ranges, null)
|
||||
iam = try(v.iam, [])
|
||||
iam_members = try(v.iam_members, [])
|
||||
purpose = try(v.purpose, null)
|
||||
active = try(v.active, null)
|
||||
global = null
|
||||
flow_logs_config = can(v.flow_logs_config) ? {
|
||||
aggregation_interval = try(v.flow_logs_config.aggregation_interval, null)
|
||||
filter_expression = try(v.flow_logs_config.filter_expression, null)
|
||||
flow_sampling = try(v.flow_logs_config.flow_sampling, null)
|
||||
metadata = try(v.flow_logs_config.metadata, null)
|
||||
metadata_fields = try(v.flow_logs_config.metadata_fields, null)
|
||||
} : null
|
||||
global = try(v.global, false)
|
||||
ip_cidr_range = v.ip_cidr_range
|
||||
ipv6 = can(v.ipv6) ? {
|
||||
access_type = try(v.ipv6.access_type, "INTERNAL")
|
||||
} : null
|
||||
name = try(v.name, k)
|
||||
region = v.region
|
||||
secondary_ip_ranges = try(v.secondary_ip_ranges, null)
|
||||
iam = try(v.iam, {})
|
||||
iam_bindings = can(v.iam_bindings) ? {
|
||||
for k2, v2 in v.iam_bindings :
|
||||
k2 => {
|
||||
members = v2.members
|
||||
condition = can(v2.condition) ? {
|
||||
expression = v2.condition.expression
|
||||
title = v2.condition.title
|
||||
description = try(v2.condition.description, null)
|
||||
} : null
|
||||
}
|
||||
} : {}
|
||||
iam_bindings_additive = can(v.iam_bindings_additive) ? {
|
||||
for k2, v2 in v.iam_bindings_additive :
|
||||
k2 => {
|
||||
member = v2.member
|
||||
role = v2.role
|
||||
condition = can(v2.condition) ? {
|
||||
expression = v2.condition.expression
|
||||
title = v2.condition.title
|
||||
description = try(v2.condition.description, null)
|
||||
} : null
|
||||
}
|
||||
} : {}
|
||||
_is_regular = !try(v.psc == true, false) && !try(v.proxy_only == true, false)
|
||||
_is_psc = try(v.psc == true, false)
|
||||
_is_proxy_only = try(v.proxy_only == true, false)
|
||||
}
|
||||
}
|
||||
_factory_subnets_iam = [
|
||||
for k, v in local._factory_subnets : {
|
||||
subnet = k
|
||||
role = "roles/compute.networkUser"
|
||||
members = v.iam
|
||||
} if v.purpose == null && v.iam != null
|
||||
]
|
||||
_subnet_iam = flatten([
|
||||
for subnet, roles in(var.subnet_iam == null ? {} : var.subnet_iam) : [
|
||||
for role, members in roles : {
|
||||
members = members
|
||||
role = role
|
||||
subnet = subnet
|
||||
}
|
||||
]
|
||||
])
|
||||
subnet_iam = concat(
|
||||
[for k in local._factory_subnets_iam : k if length(k.members) > 0],
|
||||
local._subnet_iam
|
||||
|
||||
all_subnets = merge(
|
||||
{ for k, v in google_compute_subnetwork.subnetwork : k => v },
|
||||
{ for k, v in google_compute_subnetwork.proxy_only : k => v },
|
||||
{ for k, v in google_compute_subnetwork.psc : k => v }
|
||||
)
|
||||
subnet_iam = flatten(concat(
|
||||
[
|
||||
for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : [
|
||||
for role, members in s.iam :
|
||||
{
|
||||
role = role
|
||||
members = members
|
||||
subnet = "${s.region}/${s.name}"
|
||||
}
|
||||
]
|
||||
],
|
||||
))
|
||||
subnet_iam_bindings = flatten([
|
||||
for subnet, roles in(var.subnet_iam_bindings == null ? {} : var.subnet_iam_bindings) : [
|
||||
for role, data in roles : {
|
||||
for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : [
|
||||
for role, data in s.iam_bindings : {
|
||||
role = role
|
||||
subnet = subnet
|
||||
subnet = "${s.region}/${s.name}"
|
||||
members = data.members
|
||||
condition = data.condition
|
||||
}
|
||||
]
|
||||
])
|
||||
# note: all additive bindings share a single namespace for the key.
|
||||
# In other words, if you have multiple additive bindings with the
|
||||
# same name, only one will be used
|
||||
subnet_iam_bindings_additive = merge([
|
||||
for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : {
|
||||
for key, data in s.iam_bindings_additive :
|
||||
key => {
|
||||
role = data.role
|
||||
subnet = "${s.region}/${s.name}"
|
||||
member = data.member
|
||||
condition = data.condition
|
||||
}
|
||||
}
|
||||
]...)
|
||||
subnets = merge(
|
||||
{ for s in var.subnets : "${s.region}/${s.name}" => s },
|
||||
{ for k, v in local._factory_subnets : k => v if v.purpose == null }
|
||||
{ for k, v in local._factory_subnets : k => v if v._is_regular }
|
||||
)
|
||||
subnets_proxy_only = merge(
|
||||
{ for s in var.subnets_proxy_only : "${s.region}/${s.name}" => s },
|
||||
{ for k, v in local._factory_subnets : k => v if v.purpose == "REGIONAL_MANAGED_PROXY" },
|
||||
{ for k, v in local._factory_subnets : k => v if v.purpose == "GLOBAL_MANAGED_PROXY" }
|
||||
{ for k, v in local._factory_subnets : k => v if v._is_proxy_only },
|
||||
)
|
||||
subnets_psc = merge(
|
||||
{ for s in var.subnets_psc : "${s.region}/${s.name}" => s },
|
||||
{ for k, v in local._factory_subnets : k => v if v.purpose == "PRIVATE_SERVICE_CONNECT" }
|
||||
{ for k, v in local._factory_subnets : k => v if v._is_psc }
|
||||
)
|
||||
}
|
||||
|
||||
|
|
@ -130,19 +174,12 @@ resource "google_compute_subnetwork" "proxy_only" {
|
|||
name = each.value.name
|
||||
region = each.value.region
|
||||
ip_cidr_range = each.value.ip_cidr_range
|
||||
description = (
|
||||
each.value.description == null
|
||||
? "Terraform-managed proxy-only subnet for Regional HTTPS, Internal HTTPS or Cross-Regional HTTPS Internal LB."
|
||||
: each.value.description
|
||||
description = coalesce(
|
||||
each.value.description,
|
||||
"Terraform-managed proxy-only subnet for Regional HTTPS, Internal HTTPS or Cross-Regional HTTPS Internal LB."
|
||||
)
|
||||
purpose = try(
|
||||
each.value.purpose,
|
||||
each.value.global == true
|
||||
? "GLOBAL_MANAGED_PROXY"
|
||||
: "REGIONAL_MANAGED_PROXY"
|
||||
)
|
||||
|
||||
role = each.value.active != false ? "ACTIVE" : "BACKUP"
|
||||
purpose = each.value.global ? "GLOBAL_MANAGED_PROXY" : "REGIONAL_MANAGED_PROXY"
|
||||
role = each.value.active ? "ACTIVE" : "BACKUP"
|
||||
}
|
||||
|
||||
resource "google_compute_subnetwork" "psc" {
|
||||
|
|
@ -152,22 +189,22 @@ resource "google_compute_subnetwork" "psc" {
|
|||
name = each.value.name
|
||||
region = each.value.region
|
||||
ip_cidr_range = each.value.ip_cidr_range
|
||||
description = (
|
||||
each.value.description == null
|
||||
? "Terraform-managed subnet for Private Service Connect (PSC NAT)."
|
||||
: each.value.description
|
||||
description = coalesce(
|
||||
each.value.description,
|
||||
"Terraform-managed subnet for Private Service Connect (PSC NAT)."
|
||||
)
|
||||
purpose = "PRIVATE_SERVICE_CONNECT"
|
||||
}
|
||||
|
||||
|
||||
resource "google_compute_subnetwork_iam_binding" "authoritative" {
|
||||
for_each = {
|
||||
for binding in local.subnet_iam :
|
||||
"${binding.subnet}.${binding.role}" => binding
|
||||
}
|
||||
project = var.project_id
|
||||
subnetwork = google_compute_subnetwork.subnetwork[each.value.subnet].name
|
||||
region = google_compute_subnetwork.subnetwork[each.value.subnet].region
|
||||
subnetwork = local.all_subnets[each.value.subnet].name
|
||||
region = local.all_subnets[each.value.subnet].region
|
||||
role = each.value.role
|
||||
members = each.value.members
|
||||
}
|
||||
|
|
@ -178,8 +215,8 @@ resource "google_compute_subnetwork_iam_binding" "bindings" {
|
|||
"${binding.subnet}.${binding.role}.${try(binding.condition.title, "")}" => binding
|
||||
}
|
||||
project = var.project_id
|
||||
subnetwork = google_compute_subnetwork.subnetwork[each.value.subnet].name
|
||||
region = google_compute_subnetwork.subnetwork[each.value.subnet].region
|
||||
subnetwork = local.all_subnets[each.value.subnet].name
|
||||
region = local.all_subnets[each.value.subnet].region
|
||||
role = each.value.role
|
||||
members = each.value.members
|
||||
dynamic "condition" {
|
||||
|
|
@ -192,13 +229,11 @@ resource "google_compute_subnetwork_iam_binding" "bindings" {
|
|||
}
|
||||
}
|
||||
|
||||
# TODO: merge factory subnet IAM members
|
||||
|
||||
resource "google_compute_subnetwork_iam_member" "bindings" {
|
||||
for_each = var.subnet_iam_bindings_additive
|
||||
for_each = local.subnet_iam_bindings_additive
|
||||
project = var.project_id
|
||||
subnetwork = google_compute_subnetwork.subnetwork[each.value.subnet].name
|
||||
region = google_compute_subnetwork.subnetwork[each.value.subnet].region
|
||||
subnetwork = local.all_subnets[each.value.subnet].name
|
||||
region = local.all_subnets[each.value.subnet].region
|
||||
role = each.value.role
|
||||
member = each.value.member
|
||||
dynamic "condition" {
|
||||
|
|
|
|||
|
|
@ -31,12 +31,6 @@ variable "create_googleapis_routes" {
|
|||
default = {}
|
||||
}
|
||||
|
||||
variable "data_folder" {
|
||||
description = "An optional folder containing the subnet configurations in YaML format."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "delete_default_routes_on_create" {
|
||||
description = "Set to true to delete the default routes at creation time."
|
||||
type = bool
|
||||
|
|
@ -62,6 +56,14 @@ variable "dns_policy" {
|
|||
default = null
|
||||
}
|
||||
|
||||
variable "factories_config" {
|
||||
description = "Paths to data files and folders that enable factory functionality."
|
||||
type = object({
|
||||
subnets_folder = string
|
||||
})
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "firewall_policy_enforcement_order" {
|
||||
description = "Order that Firewall Rules and Firewall Policies are evaluated. Can be either 'BEFORE_CLASSIC_FIREWALL' or 'AFTER_CLASSIC_FIREWALL'."
|
||||
type = string
|
||||
|
|
@ -164,42 +166,6 @@ variable "shared_vpc_service_projects" {
|
|||
default = []
|
||||
}
|
||||
|
||||
variable "subnet_iam" {
|
||||
description = "Subnet IAM bindings in {REGION/NAME => {ROLE => [MEMBERS]} format."
|
||||
type = map(map(list(string)))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "subnet_iam_bindings" {
|
||||
description = "Authoritative IAM bindings in {REGION/NAME => {ROLE => {members = [], condition = {}}}}."
|
||||
type = map(map(object({
|
||||
members = list(string)
|
||||
condition = optional(object({
|
||||
expression = string
|
||||
title = string
|
||||
description = optional(string)
|
||||
}))
|
||||
})))
|
||||
nullable = false
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "subnet_iam_bindings_additive" {
|
||||
description = "Individual additive IAM bindings. Keys are arbitrary."
|
||||
type = map(object({
|
||||
member = string
|
||||
role = string
|
||||
subnet = string
|
||||
condition = optional(object({
|
||||
expression = string
|
||||
title = string
|
||||
description = optional(string)
|
||||
}))
|
||||
}))
|
||||
nullable = false
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "subnets" {
|
||||
description = "Subnet configuration."
|
||||
type = list(object({
|
||||
|
|
@ -222,6 +188,25 @@ variable "subnets" {
|
|||
# enable_private_access = optional(string)
|
||||
}))
|
||||
secondary_ip_ranges = optional(map(string))
|
||||
|
||||
iam = optional(map(list(string)), {})
|
||||
iam_bindings = optional(map(object({
|
||||
members = list(string)
|
||||
condition = optional(object({
|
||||
expression = string
|
||||
title = string
|
||||
description = optional(string)
|
||||
}))
|
||||
})), {})
|
||||
iam_bindings_additive = optional(map(object({
|
||||
member = string
|
||||
role = string
|
||||
condition = optional(object({
|
||||
expression = string
|
||||
title = string
|
||||
description = optional(string)
|
||||
}))
|
||||
})), {})
|
||||
}))
|
||||
default = []
|
||||
nullable = false
|
||||
|
|
@ -234,8 +219,27 @@ variable "subnets_proxy_only" {
|
|||
ip_cidr_range = string
|
||||
region = string
|
||||
description = optional(string)
|
||||
active = bool
|
||||
active = optional(bool, true)
|
||||
global = optional(bool, false)
|
||||
|
||||
iam = optional(map(list(string)), {})
|
||||
iam_bindings = optional(map(object({
|
||||
members = list(string)
|
||||
condition = optional(object({
|
||||
expression = string
|
||||
title = string
|
||||
description = optional(string)
|
||||
}))
|
||||
})), {})
|
||||
iam_bindings_additive = optional(map(object({
|
||||
member = string
|
||||
role = string
|
||||
condition = optional(object({
|
||||
expression = string
|
||||
title = string
|
||||
description = optional(string)
|
||||
}))
|
||||
})), {})
|
||||
}))
|
||||
default = []
|
||||
nullable = false
|
||||
|
|
@ -248,6 +252,25 @@ variable "subnets_psc" {
|
|||
ip_cidr_range = string
|
||||
region = string
|
||||
description = optional(string)
|
||||
|
||||
iam = optional(map(list(string)), {})
|
||||
iam_bindings = optional(map(object({
|
||||
members = list(string)
|
||||
condition = optional(object({
|
||||
expression = string
|
||||
title = string
|
||||
description = optional(string)
|
||||
}))
|
||||
})), {})
|
||||
iam_bindings_additive = optional(map(object({
|
||||
member = string
|
||||
role = string
|
||||
condition = optional(object({
|
||||
expression = string
|
||||
title = string
|
||||
description = optional(string)
|
||||
}))
|
||||
})), {})
|
||||
}))
|
||||
default = []
|
||||
nullable = false
|
||||
|
|
|
|||
Loading…
Reference in New Issue