zecfoundation
/
cloud-foundation-fabric
mirror of https://github.com/ZcashFoundation/cloud-foundation-fabric.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove foundations blueprints in favor of FAST

This commit is contained in:
Julio Castillo 2022-09-12 10:11:35 +02:00
parent 014c2c7d10
commit 20d5ebac40
18 changed files with 0 additions and 1037 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
blueprints/README.md
View File

@ -7,7 +7,6 @@ Currently available blueprints:
- **cloud operations** - [Resource tracking and remediation via Cloud Asset feeds](./cloud-operations/asset-inventory-feed-remediation), [Granular Cloud DNS IAM via Service Directory](./cloud-operations/dns-fine-grained-iam), [Granular Cloud DNS IAM for Shared VPC](./cloud-operations/dns-shared-vpc), [Compute Engine quota monitoring](./cloud-operations/quota-monitoring), [Scheduled Cloud Asset Inventory Export to Bigquery](./cloud-operations/scheduled-asset-inventory-export-bq), [Packer image builder](./cloud-operations/packer-image-builder), [On-prem SA key management](./cloud-operations/onprem-sa-key-management), [TCP healthcheck for unmanaged GCE instances](./cloud-operations/unmanaged-instances-healthcheck), [HTTP Load Balancer with Cloud Armor](./cloud-operations/glb_and_armor)
- **data solutions** - [GCE/GCS CMEK via centralized Cloud KMS](./data-solutions/gcs-to-bq-with-least-privileges/), [Cloud Storage to Bigquery with Cloud Dataflow with least privileges](./data-solutions/gcs-to-bq-with-least-privileges/), [Data Platform Foundations](./data-solutions/data-platform-foundations/), [SQL Server AlwaysOn availability groups blueprint](./data-solutions/sqlserver-alwayson), [Cloud SQL instance with multi-region read replicas](./data-solutions/cloudsql-multiregion/)
- **factories** - [The why and the how of resource factories](./factories/README.md)
- **foundations** - [single level hierarchy](./foundations/environments/) (environments), [multiple level hierarchy](./foundations/business-units/) (business units + environments)
- **networking** - [hub and spoke via peering](./networking/hub-and-spoke-peering/), [hub and spoke via VPN](./networking/hub-and-spoke-vpn/), [DNS and Google Private Access for on-premises](./networking/onprem-google-access-dns/), [Shared VPC with GKE support](./networking/shared-vpc-gke/), [ILB as next hop](./networking/ilb-next-hop), [PSC for on-premises Cloud Function invocation](./networking/private-cloud-function-from-onprem/), [decentralized firewall](./networking/decentralized-firewall)
- **third party solutions** - [OpenShift cluster on Shared VPC](./third-party-solutions/openshift)

48
blueprints/foundations/README.md
View File

@ -1,48 +0,0 @@
# Cloud foundation blueprints
The blueprints in this folder deal with cloud foundations: the set of resources used to **create the organizational hierarchy** (folders and specific IAM roles), **implement top-level initial best practices** (audit log exports, policies) and **bootstrap infrastructure automation** (GCS buckets, service accounts and IAM roles).
The blueprints are derived from actual production use cases, and are meant to be used as-is, or extended to create more complex hierarchies. The guiding principles they implement are:
- divide the hierarchy in separate partitions along environment/organization boundaries, to enforce separation of duties and decouple organization admin permissions from the day-to-day running of infrastructure
- keep top-level Terraform code minimal and encapsulate complexity in modules, to ensure readability and allow using code as high level documentation
## Blueprints
### Environment Hierarchy
<a href="./environments/" title="Environments blueprint"><img src="./environments/diagram.png" align="left" width="280px"></a> This [blueprint](./environments/) implements a simple one-level organizational layout, which is commonly used to bootstrap small infrastructures, or in situations where lower level folders are managed with separate, more granular Terraform setups.
One authoritative service account, one bucket and one folder are created for each environment, together with top-level shared resources. This blueprint's simplicity makes it a good starting point to understand and prototype foundational design.
<br clear="left">
### Business Unit / Environment Hierarchy
<a href="./business-units/" title="Business Units blueprint"><img src="./business-units/diagram.png" align="left" width="280px"></a> This [blueprint](./business-units/) implements a two-level organizational layout, with a first level usually mapped to business units, and a second level implementing identical environments (prod, test, etc.) under each first-level folder.
This approach maps well to medium sized infrastructures, and can be used as a starting point for more complex scenarios. Separate Terraform stages are then usually implemented for each business unit, implementing fine-grained project and service account creation for individual application teams.
<br clear="left">
## Operational considerations
These blueprints are always used manually, as they require very high-level permissions and are updated infrequently.
The IAM roles needed are:
- Project Creator, Folder Administrator, Logging Administrator on the root node (org or folder)
- Billing Account Administrator on the billing account or org
- Organization Administrator if Shared VPC roles have to be granted to the automation service accounts created for each scope
State is local on the first run, then it should be moved to the GCS bucket created by the blueprints for this specific purpose:
```bash
# first apply
terraform apply
# create backend file
cp backend.tf.sample backend.tf
# edit backend.tf and use bootstrap_tf_gcs_bucket output for GCS bucket name
vi backend.tf
# once done, move local state to GCS bucket
terraform init
```

59
blueprints/foundations/business-units/README.md
View File

@ -1,59 +0,0 @@
# Business-units based organizational sample
This sample creates an organizational layout with two folder levels, where the first level is usually mapped to one business unit or team (infra, data, analytics) and the second level represents environments (prod, test). It also sets up all prerequisites for automation (GCS state buckets, service accounts, etc.), and the correct roles on those to enforce separation of duties at the environment level.
This layout is well suited for medium-sized infrastructures managed by different sets of teams, and in cases where the core infrastructure is managed centrally, as the top-level automation service accounts for each environment allow cross-team management of the base resources (projects, IAM, etc.).
![High-level diagram](diagram.png "High-level diagram")
Refer to the [section-level README](../README.md) for general considerations about this type of samples, and usage instructions.
## Managed resources and services
This sample creates several distinct groups of resources:
- one top-level folder per business unit/team
- one top-level folder for shared services
- one second-level folder for each environment in all the business unit top-level folders
- one project in the shared folder to hold Terraform-related resources
- one project in the shared folder to set up and host centralized audit log exports
- one project in the shared folder to hold services used across environments like GCS, GCR, KMS, Cloud Build, etc.
The number of resources in this sample is kept to a minimum so as to make it generally applicable, more resources can be easily added by leveraging other [modules from our bundle](../../../modules/), or from other sources like the [CFT suite](https://github.com/terraform-google-modules).
## Shared services
This sample uses a top-level folder to encapsulate projects that host resources that are not specific to a single environment. If no shared services are needed,the Terraform and audit modules can be easily attached to the root node, and the shared services folder and project removed from `main.tf`.
<!-- BEGIN TFDOC -->
## Variables
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
| [billing_account_id](variables.tf#L27) | Billing account id used as default for new projects. | <code>string</code> | ✓ | |
| [organization_id](variables.tf#L69) | Organization id in organizations/nnnnnnn format. | <code>string</code> | ✓ | |
| [prefix](variables.tf#L74) | Prefix used for resources that need unique names. | <code>string</code> | ✓ | |
| [root_node](variables.tf#L88) | Root node for the new hierarchy, either 'organizations/org_id' or 'folders/folder_id'. | <code>string</code> | ✓ | |
| [audit_filter](variables.tf#L17) | Audit log filter used for the log sink. | <code>string</code> | | <code title="&#34;&#10;logName: &#34;&#47;logs&#47;cloudaudit.googleapis.com&#37;2Factivity&#34;&#10;OR&#10;logName: &#34;&#47;logs&#47;cloudaudit.googleapis.com&#37;2Fsystem_event&#34;&#34;">&#8230;</code> |
| [environments](variables.tf#L32) | Environment short names. | <code>map&#40;string&#41;</code> | | <code title="&#123;&#10; dev &#61; &#34;Development&#34;,&#10; test &#61; &#34;Testing&#34;,&#10; prod &#61; &#34;Production&#34;&#10;&#125;">&#123;&#8230;&#125;</code> |
| [gcs_defaults](variables.tf#L42) | Defaults use for the state GCS buckets. | <code>map&#40;string&#41;</code> | | <code title="&#123;&#10; location &#61; &#34;EU&#34;&#10; storage_class &#61; &#34;MULTI_REGIONAL&#34;&#10;&#125;">&#123;&#8230;&#125;</code> |
| [iam_audit_viewers](variables.tf#L51) | Audit project viewers, in IAM format. | <code>list&#40;string&#41;</code> | | <code>&#91;&#93;</code> |
| [iam_shared_owners](variables.tf#L57) | Shared services project owners, in IAM format. | <code>list&#40;string&#41;</code> | | <code>&#91;&#93;</code> |
| [iam_terraform_owners](variables.tf#L63) | Terraform project owners, in IAM format. | <code>list&#40;string&#41;</code> | | <code>&#91;&#93;</code> |
| [project_services](variables.tf#L79) | Service APIs enabled by default in new projects. | <code>list&#40;string&#41;</code> | | <code title="&#91;&#10; &#34;container.googleapis.com&#34;,&#10; &#34;stackdriver.googleapis.com&#34;,&#10;&#93;">&#91;&#8230;&#93;</code> |
## Outputs
| name | description | sensitive |
|---|---|:---:|
| [audit_logs_project](outputs.tf#L17) | Project that holds the audit logs export resources. | |
| [bootstrap_tf_gcs_bucket](outputs.tf#L22) | GCS bucket used for the bootstrap Terraform state. | |
| [bu_business_intelligence](outputs.tf#L27) | Business Intelligence attributes. | |
| [bu_business_intelligence_keys](outputs.tf#L37) | Business Intelligence service account keys. | ✓ |
| [bu_machine_learning](outputs.tf#L43) | Machine Learning attributes. | |
| [bu_machine_learning_keys](outputs.tf#L53) | Machine Learning service account keys. | ✓ |
| [shared_folder_id](outputs.tf#L59) | Shared folder id. | |
| [shared_resources_project](outputs.tf#L64) | Project that holdes resources shared across business units. | |
| [terraform_project](outputs.tf#L69) | Project that holds the base Terraform resources. | |
<!-- END TFDOC -->

22
blueprints/foundations/business-units/backend.tf.sample
View File

@ -1,22 +0,0 @@
# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
terraform {
backend "gcs" {
# once initial apply has completed, copy this file to `backend.tf` then
# set the `bucket` value to the `bootstrap_tf_gcs_bucket` output, then
# run apply again to transfer state
bucket = ""
}
}

BIN
blueprints/foundations/business-units/diagram.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 63 KiB

175
blueprints/foundations/business-units/main.tf
View File

@ -1,175 +0,0 @@
/**
* Copyright 2022 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
locals {
logging_sinks = {
audit-logs = {
type = "bigquery"
destination = module.audit-dataset.id
filter = var.audit_filter
iam = true
include_children = true
}
}
root_node_type = split("/", var.root_node)[0]
}
###############################################################################
# Terraform top-level resources #
###############################################################################
# Shared folder
module "shared-folder" {
source = "../../../modules/folder"
parent = var.root_node
name = "shared"
}
# Terraform project
module "tf-project" {
source = "../../../modules/project"
name = "terraform"
parent = module.shared-folder.id
prefix = var.prefix
billing_account = var.billing_account_id
iam_additive = {
for name in var.iam_terraform_owners : (name) => ["roles/owner"]
}
services = var.project_services
}
# Bootstrap Terraform state GCS bucket
module "tf-gcs-bootstrap" {
source = "../../../modules/gcs"
project_id = module.tf-project.project_id
name = "tf-bootstrap"
prefix = "${var.prefix}-tf"
location = var.gcs_defaults.location
}
###############################################################################
# Business units #
###############################################################################
module "bu-business-intelligence" {
source = "../../../modules/folders-unit"
name = "Business Intelligence"
short_name = "bi"
automation_project_id = module.tf-project.project_id
billing_account_id = var.billing_account_id
environments = var.environments
gcs_defaults = var.gcs_defaults
organization_id = var.organization_id
root_node = var.root_node
prefix = var.prefix
# extra variables from the folders-unit module can be used here to grant
# IAM roles to the bu users, configure the automation service accounts, etc.
# iam_roles = ["viewer"]
# iam_members = { viewer = ["user:user@example.com"] }
}
module "bu-machine-learning" {
source = "../../../modules/folders-unit"
name = "Machine Learning"
short_name = "ml"
automation_project_id = module.tf-project.project_id
billing_account_id = var.billing_account_id
environments = var.environments
gcs_defaults = var.gcs_defaults
organization_id = var.organization_id
root_node = var.root_node
prefix = var.prefix
# extra variables from the folders-unit module can be used here to grant
# IAM roles to the bu users, configure the automation service accounts, etc.
}
###############################################################################
# Audit log exports #
###############################################################################
# Audit logs project
module "audit-project" {
source = "../../../modules/project"
name = "audit"
parent = module.shared-folder.id
prefix = var.prefix
billing_account = var.billing_account_id
iam = {
"roles/viewer" = var.iam_audit_viewers
}
services = concat(var.project_services, [
"bigquery.googleapis.com",
])
}
# audit logs dataset and sink
module "audit-dataset" {
source = "../../../modules/bigquery-dataset"
project_id = module.audit-project.project_id
id = "audit_export"
friendly_name = "Audit logs export."
# disable delete on destroy for actual use
options = {
default_table_expiration_ms = null
default_partition_expiration_ms = null
delete_contents_on_destroy = true
}
}
# uncomment the next two modules to create the logging sinks
# module "root_org" {
# count = local.root_node_type == "organizations" ? 1 : 0
# source = "../../../modules/organization"
# organization_id = var.root_node
# logging_sinks = local.logging_sinks
# exclusions = {}
# }
# module "root_folder" {
# count = local.root_node_type == "folders" ? 1 : 0
# source = "../../../modules/folder"
# id = var.root_node
# folder_create = false
# logging_sinks = local.logging_sinks
# exclusions = {}
# }
###############################################################################
# Shared resources (GCR, GCS, KMS, etc.) #
###############################################################################
# Shared resources project
module "shared-project" {
source = "../../../modules/project"
name = "shared"
parent = module.shared-folder.id
prefix = var.prefix
billing_account = var.billing_account_id
iam_additive = {
for name in var.iam_shared_owners : (name) => ["roles/owner"]
}
services = var.project_services
}
# Add further modules here for resources that are common to all business units
# like GCS buckets (used to hold shared assets), Container Registry, KMS, etc.

75
blueprints/foundations/business-units/outputs.tf
View File

@ -1,75 +0,0 @@
/**
* Copyright 2022 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
output "audit_logs_project" {
description = "Project that holds the audit logs export resources."
value = module.audit-project.project_id
}
output "bootstrap_tf_gcs_bucket" {
description = "GCS bucket used for the bootstrap Terraform state."
value = module.tf-gcs-bootstrap.name
}
output "bu_business_intelligence" {
description = "Business Intelligence attributes."
value = {
unit_folder = module.bu-business-intelligence.unit_folder,
env_gcs_buckets = module.bu-business-intelligence.env_gcs_buckets
env_folders = module.bu-business-intelligence.env_folders
env_service_accounts = module.bu-business-intelligence.env_service_accounts
}
}
output "bu_business_intelligence_keys" {
description = "Business Intelligence service account keys."
sensitive = true
value = module.bu-business-intelligence.env_sa_keys
}
output "bu_machine_learning" {
description = "Machine Learning attributes."
value = {
unit_folder = module.bu-machine-learning.unit_folder,
env_gcs_buckets = module.bu-machine-learning.env_gcs_buckets
env_folders = module.bu-machine-learning.env_folders
env_service_accounts = module.bu-machine-learning.env_service_accounts
}
}
output "bu_machine_learning_keys" {
description = "Machine Learning service account keys."
sensitive = true
value = module.bu-machine-learning.env_sa_keys
}
output "shared_folder_id" {
description = "Shared folder id."
value = module.shared-folder.id
}
output "shared_resources_project" {
description = "Project that holdes resources shared across business units."
value = module.shared-project.project_id
}
output "terraform_project" {
description = "Project that holds the base Terraform resources."
value = module.tf-project.project_id
}
# Add further outputs here for the additional modules that manage shared
# resources, like GCR, GCS buckets, KMS, etc.

19
blueprints/foundations/business-units/terraform.tfvars.sample
View File

@ -1,19 +0,0 @@
# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
billing_account_id = "014617-19UCBC-AF02D9"
organization_id= "500001140800"
prefix = "xyz"
root_node = "folders/9572793983696"
generate_keys = true

91
blueprints/foundations/business-units/variables.tf
View File

@ -1,91 +0,0 @@
/**
* Copyright 2022 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
variable "audit_filter" {
description = "Audit log filter used for the log sink."
type = string
default = <<END
logName: "/logs/cloudaudit.googleapis.com%2Factivity"
OR
logName: "/logs/cloudaudit.googleapis.com%2Fsystem_event"
END
}
variable "billing_account_id" {
description = "Billing account id used as default for new projects."
type = string
}
variable "environments" {
description = "Environment short names."
type = map(string)
default = {
dev = "Development",
test = "Testing",
prod = "Production"
}
}
variable "gcs_defaults" {
description = "Defaults use for the state GCS buckets."
type = map(string)
default = {
location = "EU"
storage_class = "MULTI_REGIONAL"
}
}
variable "iam_audit_viewers" {
description = "Audit project viewers, in IAM format."
type = list(string)
default = []
}
variable "iam_shared_owners" {
description = "Shared services project owners, in IAM format."
type = list(string)
default = []
}
variable "iam_terraform_owners" {
description = "Terraform project owners, in IAM format."
type = list(string)
default = []
}
variable "organization_id" {
description = "Organization id in organizations/nnnnnnn format."
type = string
}
variable "prefix" {
description = "Prefix used for resources that need unique names."
type = string
}
variable "project_services" {
description = "Service APIs enabled by default in new projects."
type = list(string)
default = [
"container.googleapis.com",
"stackdriver.googleapis.com",
]
}
variable "root_node" {
description = "Root node for the new hierarchy, either 'organizations/org_id' or 'folders/folder_id'."
type = string
}

29
blueprints/foundations/business-units/versions.tf
View File

@ -1,29 +0,0 @@
# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
terraform {
required_version = ">= 1.1.0"
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.32.0" # tftest
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.32.0" # tftest
}
}
}

65
blueprints/foundations/environments/README.md
View File

@ -1,65 +0,0 @@
# Environment-based organizational sample
This sample creates an organizational layout with a single level, where each folder is usually mapped to one infrastructure environment (test, dev, etc.). It also sets up all prerequisites for automation (GCS state buckets, service accounts, etc.), and the correct roles on those to enforce separation of duties at the environment level.
This layout is well suited for medium-sized infrastructures managed by a small set of teams, where the complexity in application resource ownership and access roles is mostly dealt with at the project level, and/or in the individual services (GKE, Cloud SQL, etc.). Its simplicity also makes it a good starting point for more complex or specialized layouts.
![High-level diagram](diagram.png "High-level diagram")
Refer to the [section-level README](../README.md) for general considerations about this type of samples, and usage instructions.
## Managed resources and services
This sample creates several distinct groups of resources:
- one folder per environment
- one top-level project to hold Terraform-related resources
- one top-level project to set up and host centralized audit log exports (optional)
- one top-level shared services project
The number of resources in this sample is kept to a minimum so as to make it generally applicable, more resources can be easily added by leveraging other [modules from our bundle](../../../modules/), or from other sources like the [CFT suite](https://github.com/terraform-google-modules).
## Shared services project
This sample contains a single, top-level project used to host services shared across environments (eg GCS, GCR, KMS, Cloud Build, etc.). In our experience, that is enough for many customers, especially those using this organizational layout.
For more complex setups where multiple shared services projects are needed to encapsulate a larger number of resources, shared services should be treated as an extra environment so that they can be managed by a dedicated set of Terraform files, using a separate service account and GCS bucket, with a folder to contain shared projects.
If no shared services are needed, the shared service project module can of course be removed from `main.tf`.
<!-- BEGIN TFDOC -->
## Variables
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
| [billing_account_id](variables.tf#L25) | Billing account id used as to create projects. | <code>string</code> | ✓ | |
| [environments](variables.tf#L30) | Environment short names. | <code>set&#40;string&#41;</code> | ✓ | |
| [organization_id](variables.tf#L94) | Organization id in organizations/nnnnnnnn format. | <code>string</code> | ✓ | |
| [prefix](variables.tf#L99) | Prefix used for resources that need unique names. | <code>string</code> | ✓ | |
| [root_node](variables.tf#L113) | Root node for the new hierarchy, either 'organizations/org_id' or 'folders/folder_id'. | <code>string</code> | ✓ | |
| [audit_filter](variables.tf#L15) | Audit log filter used for the log sink. | <code>string</code> | | <code title="&#34;&#10;logName: &#34;&#47;logs&#47;cloudaudit.googleapis.com&#37;2Factivity&#34;&#10;OR&#10;logName: &#34;&#47;logs&#47;cloudaudit.googleapis.com&#37;2Fsystem_event&#34;&#34;">&#8230;</code> |
| [gcs_location](variables.tf#L35) | GCS bucket location. | <code>string</code> | | <code>&#34;EU&#34;</code> |
| [iam_audit_viewers](variables.tf#L41) | Audit project viewers, in IAM format. | <code>list&#40;string&#41;</code> | | <code>&#91;&#93;</code> |
| [iam_billing_config](variables.tf#L47) | Control granting billing user role to service accounts. Target the billing account by default. | <code title="object&#40;&#123;&#10; grant &#61; bool&#10; target_org &#61; bool&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code title="&#123;&#10; grant &#61; true&#10; target_org &#61; false&#10;&#125;">&#123;&#8230;&#125;</code> |
| [iam_folder_roles](variables.tf#L59) | List of roles granted to each service account on its respective folder (excluding XPN roles). | <code>list&#40;string&#41;</code> | | <code title="&#91;&#10; &#34;roles&#47;compute.networkAdmin&#34;,&#10; &#34;roles&#47;owner&#34;,&#10; &#34;roles&#47;resourcemanager.folderViewer&#34;,&#10; &#34;roles&#47;resourcemanager.projectCreator&#34;,&#10;&#93;">&#91;&#8230;&#93;</code> |
| [iam_shared_owners](variables.tf#L70) | Shared services project owners, in IAM format. | <code>list&#40;string&#41;</code> | | <code>&#91;&#93;</code> |
| [iam_terraform_owners](variables.tf#L76) | Terraform project owners, in IAM format. | <code>list&#40;string&#41;</code> | | <code>&#91;&#93;</code> |
| [iam_xpn_config](variables.tf#L82) | Control granting Shared VPC creation roles to service accounts. Target the root node by default. | <code title="object&#40;&#123;&#10; grant &#61; bool&#10; target_org &#61; bool&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code title="&#123;&#10; grant &#61; true&#10; target_org &#61; true&#10;&#125;">&#123;&#8230;&#125;</code> |
| [project_services](variables.tf#L104) | Service APIs enabled by default in new projects. | <code>list&#40;string&#41;</code> | | <code title="&#91;&#10; &#34;container.googleapis.com&#34;,&#10; &#34;stackdriver.googleapis.com&#34;,&#10;&#93;">&#91;&#8230;&#93;</code> |
| [service_account_keys](variables.tf#L118) | Generate and store service account keys in the state file. | <code>bool</code> | | <code>true</code> |
## Outputs
| name | description | sensitive |
|---|---|:---:|
| [audit_logs_bq_dataset](outputs.tf#L15) | Bigquery dataset for the audit logs export. | |
| [audit_logs_project](outputs.tf#L20) | Project that holds the audit logs export resources. | |
| [bootstrap_tf_gcs_bucket](outputs.tf#L25) | GCS bucket used for the bootstrap Terraform state. | |
| [environment_folders](outputs.tf#L30) | Top-level environment folders. | |
| [environment_service_account_keys](outputs.tf#L35) | Service account keys used to run each environment Terraform modules. | ✓ |
| [environment_service_accounts](outputs.tf#L40) | Service accounts used to run each environment Terraform modules. | |
| [environment_tf_gcs_buckets](outputs.tf#L45) | GCS buckets used for each environment Terraform state. | |
| [shared_services_project](outputs.tf#L50) | Project that holdes resources shared across environments. | |
| [terraform_project](outputs.tf#L55) | Project that holds the base Terraform resources. | |
<!-- END TFDOC -->

23
blueprints/foundations/environments/backend.tf.sample
View File

@ -1,23 +0,0 @@
# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
terraform {
backend "gcs" {
# once initial apply has completed, copy this file to `backend.tf` then
# set the `bucket` value to the `bootstrap_tf_gcs_bucket` output, then
# run apply again to transfer state
bucket = ""
}
}

BIN
blueprints/foundations/environments/diagram.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 56 KiB

50
blueprints/foundations/environments/locals.tf
View File

@ -1,50 +0,0 @@
/**
* Copyright 2022 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
locals {
folder_roles = concat(var.iam_folder_roles, local.sa_xpn_folder_role)
organization_id = element(split("/", var.organization_id), 1)
sa_billing_account_role = (
var.iam_billing_config.target_org ? [] : ["roles/billing.user"]
)
sa_billing_org_role = (
!var.iam_billing_config.target_org ? [] : ["roles/billing.user"]
)
sa_xpn_folder_role = (
local.sa_xpn_target_org ? [] : ["roles/compute.xpnAdmin"]
)
sa_xpn_org_roles = (
local.sa_xpn_target_org
? ["roles/compute.xpnAdmin", "roles/resourcemanager.organizationViewer"]
: ["roles/resourcemanager.organizationViewer"]
)
sa_xpn_target_org = (
var.iam_xpn_config.target_org
||
substr(var.root_node, 0, 13) == "organizations"
)
logging_sinks = {
audit-logs = {
type = "bigquery"
destination = module.audit-dataset.id
filter = var.audit_filter
iam = true
include_children = true
exclusions = {}
}
}
root_node_type = split("/", var.root_node)[0]
}

168
blueprints/foundations/environments/main.tf
View File

@ -1,168 +0,0 @@
# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
###############################################################################
# Terraform top-level resources #
###############################################################################
# Terraform project
module "tf-project" {
source = "../../../modules/project"
name = "terraform"
parent = var.root_node
prefix = var.prefix
billing_account = var.billing_account_id
iam_additive = {
"roles/owner" = var.iam_terraform_owners
}
services = var.project_services
}
# per-environment service accounts
module "tf-service-accounts" {
source = "../../../modules/iam-service-account"
for_each = var.environments
project_id = module.tf-project.project_id
name = each.value
prefix = var.prefix
iam_billing_roles = {
(var.billing_account_id) = (
var.iam_billing_config.grant ? local.sa_billing_account_role : []
)
}
# folder roles are set in the folders module using authoritative bindings
iam_organization_roles = {
(local.organization_id) = concat(
var.iam_billing_config.grant ? local.sa_billing_org_role : [],
var.iam_xpn_config.grant ? local.sa_xpn_org_roles : []
)
}
generate_key = var.service_account_keys
}
# bootstrap Terraform state GCS bucket
module "tf-gcs-bootstrap" {
source = "../../../modules/gcs"
project_id = module.tf-project.project_id
name = "tf-bootstrap"
prefix = "${var.prefix}-tf"
location = var.gcs_location
}
# per-environment Terraform state GCS buckets
module "tf-gcs-environments" {
source = "../../../modules/gcs"
for_each = var.environments
project_id = module.tf-project.project_id
name = each.value
prefix = "${var.prefix}-tf"
location = var.gcs_location
iam = {
"roles/storage.objectAdmin" = [module.tf-service-accounts[each.value].iam_email]
}
}
###############################################################################
# Top-level folders #
###############################################################################
module "environment-folders" {
source = "../../../modules/folder"
for_each = var.environments
parent = var.root_node
name = each.value
iam = {
for role in local.folder_roles :
(role) => [module.tf-service-accounts[each.value].iam_email]
}
}
###############################################################################
# Audit log exports #
###############################################################################
# audit logs project
module "audit-project" {
source = "../../../modules/project"
name = "audit"
parent = var.root_node
prefix = var.prefix
billing_account = var.billing_account_id
iam = {
"roles/viewer" = var.iam_audit_viewers
}
services = concat(var.project_services, [
"bigquery.googleapis.com",
])
}
# audit logs dataset and sink
module "audit-dataset" {
source = "../../../modules/bigquery-dataset"
project_id = module.audit-project.project_id
id = "audit_export"
friendly_name = "Audit logs export."
# disable delete on destroy for actual use
options = {
default_table_expiration_ms = null
default_partition_expiration_ms = null
delete_contents_on_destroy = true
}
}
# uncomment the next two modules to create the logging sinks
# module "root_org" {
# count = local.root_node_type == "organizations" ? 1 : 0
# source = "../../../modules/organization"
# organization_id = var.root_node
# logging_sinks = local.logging_sinks
# }
# module "root_folder" {
# count = local.root_node_type == "folders" ? 1 : 0
# source = "../../../modules/folder"
# id = var.root_node
# folder_create = false
# logging_sinks = local.logging_sinks
# }
###############################################################################
# Shared resources (GCR, GCS, KMS, etc.) #
###############################################################################
# shared resources project
# see the README file for additional options on managing shared services
module "sharedsvc-project" {
source = "../../../modules/project"
name = "sharedsvc"
parent = var.root_node
prefix = var.prefix
billing_account = var.billing_account_id
iam_additive = {
"roles/owner" = var.iam_shared_owners
}
services = var.project_services
}
# Add further modules here for resources that are common to all environments
# like GCS buckets (used to hold shared assets), Container Registry, KMS, etc.

61
blueprints/foundations/environments/outputs.tf
View File

@ -1,61 +0,0 @@
# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
output "audit_logs_bq_dataset" {
description = "Bigquery dataset for the audit logs export."
value = module.audit-dataset.id
}
output "audit_logs_project" {
description = "Project that holds the audit logs export resources."
value = module.audit-project.project_id
}
output "bootstrap_tf_gcs_bucket" {
description = "GCS bucket used for the bootstrap Terraform state."
value = module.tf-gcs-bootstrap.name
}
output "environment_folders" {
description = "Top-level environment folders."
value = { for folder in module.environment-folders : folder.name => folder.id }
}
output "environment_service_account_keys" {
description = "Service account keys used to run each environment Terraform modules."
sensitive = true
value = { for env, sa in module.tf-service-accounts : env => sa.key }
}
output "environment_service_accounts" {
description = "Service accounts used to run each environment Terraform modules."
value = { for env, sa in module.tf-service-accounts : env => sa.email }
}
output "environment_tf_gcs_buckets" {
description = "GCS buckets used for each environment Terraform state."
value = { for env, bucket in module.tf-gcs-environments : env => bucket.name }
}
output "shared_services_project" {
description = "Project that holdes resources shared across environments."
value = module.sharedsvc-project.project_id
}
output "terraform_project" {
description = "Project that holds the base Terraform resources."
value = module.tf-project.project_id
}
# Add further outputs here for the additional modules that manage shared
# resources, like GCR, GCS buckets, KMS, etc.

122
blueprints/foundations/environments/variables.tf
View File

@ -1,122 +0,0 @@
# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
variable "audit_filter" {
description = "Audit log filter used for the log sink."
type = string
default = <<END
logName: "/logs/cloudaudit.googleapis.com%2Factivity"
OR
logName: "/logs/cloudaudit.googleapis.com%2Fsystem_event"
END
}
variable "billing_account_id" {
description = "Billing account id used as to create projects."
type = string
}
variable "environments" {
description = "Environment short names."
type = set(string)
}
variable "gcs_location" {
description = "GCS bucket location."
type = string
default = "EU"
}
variable "iam_audit_viewers" {
description = "Audit project viewers, in IAM format."
type = list(string)
default = []
}
variable "iam_billing_config" {
description = "Control granting billing user role to service accounts. Target the billing account by default."
type = object({
grant = bool
target_org = bool
})
default = {
grant = true
target_org = false
}
}
variable "iam_folder_roles" {
description = "List of roles granted to each service account on its respective folder (excluding XPN roles)."
type = list(string)
default = [
"roles/compute.networkAdmin",
"roles/owner",
"roles/resourcemanager.folderViewer",
"roles/resourcemanager.projectCreator",
]
}
variable "iam_shared_owners" {
description = "Shared services project owners, in IAM format."
type = list(string)
default = []
}
variable "iam_terraform_owners" {
description = "Terraform project owners, in IAM format."
type = list(string)
default = []
}
variable "iam_xpn_config" {
description = "Control granting Shared VPC creation roles to service accounts. Target the root node by default."
type = object({
grant = bool
target_org = bool
})
default = {
grant = true
target_org = true
}
}
variable "organization_id" {
description = "Organization id in organizations/nnnnnnnn format."
type = string
}
variable "prefix" {
description = "Prefix used for resources that need unique names."
type = string
}
variable "project_services" {
description = "Service APIs enabled by default in new projects."
type = list(string)
default = [
"container.googleapis.com",
"stackdriver.googleapis.com",
]
}
variable "root_node" {
description = "Root node for the new hierarchy, either 'organizations/org_id' or 'folders/folder_id'."
type = string
}
variable "service_account_keys" {
description = "Generate and store service account keys in the state file."
type = bool
default = true
}

29
blueprints/foundations/environments/versions.tf
View File

@ -1,29 +0,0 @@
# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
terraform {
required_version = ">= 1.1.0"
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.32.0" # tftest
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.32.0" # tftest
}
}
}