From 2b80f477b7e354ea365a0e49a32d7482cd1315e6 Mon Sep 17 00:00:00 2001 From: cmalpe Date: Thu, 26 Oct 2023 14:05:39 +0000 Subject: [PATCH] added tfdoc changes --- modules/kms/README.md | 41 +++++++++++++++++++++------------------- modules/kms/main.tf | 1 + modules/kms/variables.tf | 7 +++++++ 3 files changed, 30 insertions(+), 19 deletions(-) diff --git a/modules/kms/README.md b/modules/kms/README.md index 6e221206..110ab1a4 100644 --- a/modules/kms/README.md +++ b/modules/kms/README.md @@ -5,15 +5,14 @@ This module allows creating and managing KMS crypto keys and IAM bindings at bot When using an existing keyring be mindful about applying IAM bindings, as all bindings used by this module are authoritative, and you might inadvertently override bindings managed by the keyring creator. -- [Google KMS Module](#google-kms-module) - - [Protecting against destroy](#protecting-against-destroy) - - [Examples](#examples) - - [Using an existing keyring](#using-an-existing-keyring) - - [Keyring creation and crypto key rotation and IAM roles](#keyring-creation-and-crypto-key-rotation-and-iam-roles) - - [Crypto key purpose](#crypto-key-purpose) - - [Import job](#import-job) - - [Variables](#variables) - - [Outputs](#outputs) +- [Protecting against destroy](#protecting-against-destroy) +- [Examples](#examples) + - [Using an existing keyring](#using-an-existing-keyring) + - [Keyring creation and crypto key rotation and IAM roles](#keyring-creation-and-crypto-key-rotation-and-iam-roles) + - [Crypto key purpose](#crypto-key-purpose) + - [Import job](#import-job) +- [Variables](#variables) +- [Outputs](#outputs) ## Protecting against destroy @@ -110,6 +109,7 @@ module "kms" { location = "europe-west1" name = "test" } + import_job_create = true import_job = { id = "my-import-job" import_method = "RSA_OAEP_3072_SHA1_AES_256" @@ -122,23 +122,26 @@ module "kms" { | name | description | type | required | default | |---|---|:---:|:---:|:---:| -| [keyring](variables.tf#L54) | Keyring attributes. | object({…}) | ✓ | | -| [project_id](variables.tf#L103) | Project id where the keyring will be created. | string | ✓ | | +| [keyring](variables.tf#L70) | Keyring attributes. | object({…}) | ✓ | | +| [project_id](variables.tf#L119) | Project id where the keyring will be created. | string | ✓ | | | [iam](variables.tf#L17) | Keyring IAM bindings in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | | [iam_bindings](variables.tf#L24) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | map(object({…})) | | {} | | [iam_bindings_additive](variables.tf#L39) | Keyring individual additive IAM bindings. Keys are arbitrary. | map(object({…})) | | {} | -| [keyring_create](variables.tf#L62) | Set to false to manage keys and IAM bindings in an existing keyring. | bool | | true | -| [keys](variables.tf#L68) | Key names and base attributes. Set attributes to null if not needed. | map(object({…})) | | {} | -| [tag_bindings](variables.tf#L108) | Tag bindings for this keyring, in key => tag value id format. | map(string) | | {} | +| [import_job](variables.tf#L54) | Keyring import job attributes. | object({…}) | | null | +| [import_job_create](variables.tf#L64) | Set to true to create an import job for a keyring. | bool | | false | +| [keyring_create](variables.tf#L78) | Set to false to manage keys and IAM bindings in an existing keyring. | bool | | true | +| [keys](variables.tf#L84) | Key names and base attributes. Set attributes to null if not needed. | map(object({…})) | | {} | +| [tag_bindings](variables.tf#L124) | Tag bindings for this keyring, in key => tag value id format. | map(string) | | {} | ## Outputs | name | description | sensitive | |---|---|:---:| | [id](outputs.tf#L17) | Fully qualified keyring id. | | -| [key_ids](outputs.tf#L26) | Fully qualified key ids. | | -| [keyring](outputs.tf#L38) | Keyring resource. | | -| [keys](outputs.tf#L47) | Key resources. | | -| [location](outputs.tf#L56) | Keyring location. | | -| [name](outputs.tf#L65) | Keyring name. | | +| [import_job](outputs.tf#L26) | Keyring import job resources. | | +| [key_ids](outputs.tf#L35) | Fully qualified key ids. | | +| [keyring](outputs.tf#L47) | Keyring resource. | | +| [keys](outputs.tf#L56) | Key resources. | | +| [location](outputs.tf#L65) | Keyring location. | | +| [name](outputs.tf#L74) | Keyring name. | | diff --git a/modules/kms/main.tf b/modules/kms/main.tf index a1f74902..bb9f05a8 100644 --- a/modules/kms/main.tf +++ b/modules/kms/main.tf @@ -55,6 +55,7 @@ resource "google_kms_crypto_key" "default" { } resource "google_kms_key_ring_import_job" "default" { + count = var.import_job_create ? 1 : 0 key_ring = local.keyring.id import_job_id = var.import_job.id import_method = var.import_job.import_method diff --git a/modules/kms/variables.tf b/modules/kms/variables.tf index 161c55e0..669d2e8a 100644 --- a/modules/kms/variables.tf +++ b/modules/kms/variables.tf @@ -58,6 +58,13 @@ variable "import_job" { import_method = string protection_level = string }) + default = null +} + +variable "import_job_create" { + description = "Set to true to create an import job for a keyring." + type = bool + default = false } variable "keyring" {