Merge pull request #953 from muresan/feature/iam-service-account-static-id-and-iam-additive
Added IAM Additive and converted some outputs to static
This commit is contained in:
commit
2e086404b7
|
@ -43,21 +43,22 @@ module "myproject-default-service-accounts" {
|
||||||
|
|
||||||
| name | description | type | required | default |
|
| name | description | type | required | default |
|
||||||
|---|---|:---:|:---:|:---:|
|
|---|---|:---:|:---:|:---:|
|
||||||
| [name](variables.tf#L84) | Name of the service account to create. | <code>string</code> | ✓ | |
|
| [name](variables.tf#L91) | Name of the service account to create. | <code>string</code> | ✓ | |
|
||||||
| [project_id](variables.tf#L95) | Project id where service account will be created. | <code>string</code> | ✓ | |
|
| [project_id](variables.tf#L102) | Project id where service account will be created. | <code>string</code> | ✓ | |
|
||||||
| [description](variables.tf#L17) | Optional description. | <code>string</code> | | <code>null</code> |
|
| [description](variables.tf#L17) | Optional description. | <code>string</code> | | <code>null</code> |
|
||||||
| [display_name](variables.tf#L23) | Display name of the service account to create. | <code>string</code> | | <code>"Terraform-managed."</code> |
|
| [display_name](variables.tf#L23) | Display name of the service account to create. | <code>string</code> | | <code>"Terraform-managed."</code> |
|
||||||
| [generate_key](variables.tf#L29) | Generate a key for service account. | <code>bool</code> | | <code>false</code> |
|
| [generate_key](variables.tf#L29) | Generate a key for service account. | <code>bool</code> | | <code>false</code> |
|
||||||
| [iam](variables.tf#L35) | IAM bindings on the service account in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
| [iam](variables.tf#L35) | IAM bindings on the service account in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
| [iam_billing_roles](variables.tf#L42) | Billing account roles granted to this service account, by billing account id. Non-authoritative. | <code>map(list(string))</code> | | <code>{}</code> |
|
| [iam_additive](variables.tf#L42) | IAM additive bindings on the service account in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
| [iam_folder_roles](variables.tf#L49) | Folder roles granted to this service account, by folder id. Non-authoritative. | <code>map(list(string))</code> | | <code>{}</code> |
|
| [iam_billing_roles](variables.tf#L49) | Billing account roles granted to this service account, by billing account id. Non-authoritative. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
| [iam_organization_roles](variables.tf#L56) | Organization roles granted to this service account, by organization id. Non-authoritative. | <code>map(list(string))</code> | | <code>{}</code> |
|
| [iam_folder_roles](variables.tf#L56) | Folder roles granted to this service account, by folder id. Non-authoritative. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
| [iam_project_roles](variables.tf#L63) | Project roles granted to this service account, by project id. | <code>map(list(string))</code> | | <code>{}</code> |
|
| [iam_organization_roles](variables.tf#L63) | Organization roles granted to this service account, by organization id. Non-authoritative. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
| [iam_sa_roles](variables.tf#L70) | Service account roles granted to this service account, by service account name. | <code>map(list(string))</code> | | <code>{}</code> |
|
| [iam_project_roles](variables.tf#L70) | Project roles granted to this service account, by project id. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
| [iam_storage_roles](variables.tf#L77) | Storage roles granted to this service account, by bucket name. | <code>map(list(string))</code> | | <code>{}</code> |
|
| [iam_sa_roles](variables.tf#L77) | Service account roles granted to this service account, by service account name. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
| [prefix](variables.tf#L89) | Prefix applied to service account names. | <code>string</code> | | <code>null</code> |
|
| [iam_storage_roles](variables.tf#L84) | Storage roles granted to this service account, by bucket name. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
| [public_keys_directory](variables.tf#L100) | Path to public keys data files to upload to the service account (should have `.pem` extension). | <code>string</code> | | <code>""</code> |
|
| [prefix](variables.tf#L96) | Prefix applied to service account names. | <code>string</code> | | <code>null</code> |
|
||||||
| [service_account_create](variables.tf#L106) | Create service account. When set to false, uses a data source to reference an existing service account. | <code>bool</code> | | <code>true</code> |
|
| [public_keys_directory](variables.tf#L107) | Path to public keys data files to upload to the service account (should have `.pem` extension). | <code>string</code> | | <code>""</code> |
|
||||||
|
| [service_account_create](variables.tf#L113) | Create service account. When set to false, uses a data source to reference an existing service account. | <code>bool</code> | | <code>true</code> |
|
||||||
|
|
||||||
## Outputs
|
## Outputs
|
||||||
|
|
||||||
|
@ -66,9 +67,9 @@ module "myproject-default-service-accounts" {
|
||||||
| [email](outputs.tf#L17) | Service account email. | |
|
| [email](outputs.tf#L17) | Service account email. | |
|
||||||
| [iam_email](outputs.tf#L25) | IAM-format service account email. | |
|
| [iam_email](outputs.tf#L25) | IAM-format service account email. | |
|
||||||
| [id](outputs.tf#L33) | Service account id. | |
|
| [id](outputs.tf#L33) | Service account id. | |
|
||||||
| [key](outputs.tf#L41) | Service account key. | ✓ |
|
| [key](outputs.tf#L42) | Service account key. | ✓ |
|
||||||
| [name](outputs.tf#L47) | Service account name. | |
|
| [name](outputs.tf#L48) | Service account name. | |
|
||||||
| [service_account](outputs.tf#L52) | Service account resource. | |
|
| [service_account](outputs.tf#L57) | Service account resource. | |
|
||||||
| [service_account_credentials](outputs.tf#L57) | Service account json credential templates for uploaded public keys data. | |
|
| [service_account_credentials](outputs.tf#L62) | Service account json credential templates for uploaded public keys data. | |
|
||||||
|
|
||||||
<!-- END TFDOC -->
|
<!-- END TFDOC -->
|
||||||
|
|
|
@ -17,6 +17,15 @@
|
||||||
# tfdoc:file:description IAM bindings.
|
# tfdoc:file:description IAM bindings.
|
||||||
|
|
||||||
locals {
|
locals {
|
||||||
|
_iam_additive_pairs = flatten([
|
||||||
|
for role, members in var.iam_additive : [
|
||||||
|
for member in members : { role = role, member = member }
|
||||||
|
]
|
||||||
|
])
|
||||||
|
iam_additive = {
|
||||||
|
for pair in local._iam_additive_pairs :
|
||||||
|
"${pair.role}-${pair.member}" => pair
|
||||||
|
}
|
||||||
iam_billing_pairs = flatten([
|
iam_billing_pairs = flatten([
|
||||||
for entity, roles in var.iam_billing_roles : [
|
for entity, roles in var.iam_billing_roles : [
|
||||||
for role in roles : [
|
for role in roles : [
|
||||||
|
@ -61,6 +70,13 @@ locals {
|
||||||
])
|
])
|
||||||
}
|
}
|
||||||
|
|
||||||
|
resource "google_service_account_iam_member" "roles" {
|
||||||
|
for_each = local.iam_additive
|
||||||
|
service_account_id = local.service_account.name
|
||||||
|
role = each.value.role
|
||||||
|
member = each.value.member
|
||||||
|
}
|
||||||
|
|
||||||
resource "google_service_account_iam_binding" "roles" {
|
resource "google_service_account_iam_binding" "roles" {
|
||||||
for_each = var.iam
|
for_each = var.iam
|
||||||
service_account_id = local.service_account.name
|
service_account_id = local.service_account.name
|
||||||
|
|
|
@ -21,7 +21,7 @@ locals {
|
||||||
? google_service_account_key.key["1"]
|
? google_service_account_key.key["1"]
|
||||||
: map("", null)
|
: map("", null)
|
||||||
, {})
|
, {})
|
||||||
prefix = var.prefix != null ? "${var.prefix}-" : ""
|
prefix = var.prefix == null || var.prefix == "" ? "" : "${var.prefix}-"
|
||||||
resource_email_static = "${local.prefix}${var.name}@${var.project_id}.iam.gserviceaccount.com"
|
resource_email_static = "${local.prefix}${var.name}@${var.project_id}.iam.gserviceaccount.com"
|
||||||
resource_iam_email = (
|
resource_iam_email = (
|
||||||
local.service_account != null
|
local.service_account != null
|
||||||
|
@ -29,6 +29,7 @@ locals {
|
||||||
: local.resource_iam_email_static
|
: local.resource_iam_email_static
|
||||||
)
|
)
|
||||||
resource_iam_email_static = "serviceAccount:${local.resource_email_static}"
|
resource_iam_email_static = "serviceAccount:${local.resource_email_static}"
|
||||||
|
service_account_id_static = "projects/${var.project_id}/serviceAccounts/${local.resource_email_static}"
|
||||||
service_account = (
|
service_account = (
|
||||||
var.service_account_create
|
var.service_account_create
|
||||||
? try(google_service_account.service_account.0, null)
|
? try(google_service_account.service_account.0, null)
|
||||||
|
|
|
@ -32,9 +32,10 @@ output "iam_email" {
|
||||||
|
|
||||||
output "id" {
|
output "id" {
|
||||||
description = "Service account id."
|
description = "Service account id."
|
||||||
value = local.service_account.id
|
value = local.service_account_id_static
|
||||||
depends_on = [
|
depends_on = [
|
||||||
local.service_account
|
data.google_service_account.service_account,
|
||||||
|
google_service_account.service_account
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -46,7 +47,11 @@ output "key" {
|
||||||
|
|
||||||
output "name" {
|
output "name" {
|
||||||
description = "Service account name."
|
description = "Service account name."
|
||||||
value = local.service_account.name
|
value = local.service_account_id_static
|
||||||
|
depends_on = [
|
||||||
|
data.google_service_account.service_account,
|
||||||
|
google_service_account.service_account
|
||||||
|
]
|
||||||
}
|
}
|
||||||
|
|
||||||
output "service_account" {
|
output "service_account" {
|
||||||
|
|
|
@ -39,6 +39,13 @@ variable "iam" {
|
||||||
nullable = false
|
nullable = false
|
||||||
}
|
}
|
||||||
|
|
||||||
|
variable "iam_additive" {
|
||||||
|
description = "IAM additive bindings on the service account in {ROLE => [MEMBERS]} format."
|
||||||
|
type = map(list(string))
|
||||||
|
default = {}
|
||||||
|
nullable = false
|
||||||
|
}
|
||||||
|
|
||||||
variable "iam_billing_roles" {
|
variable "iam_billing_roles" {
|
||||||
description = "Billing account roles granted to this service account, by billing account id. Non-authoritative."
|
description = "Billing account roles granted to this service account, by billing account id. Non-authoritative."
|
||||||
type = map(list(string))
|
type = map(list(string))
|
||||||
|
|
Loading…
Reference in New Issue