Allow projects as destinations for log sinks (#2102)
* Add project log sink destination to project module * Add project log sink destination to folder module * Add project log sink destination to organization module * Fix typos * Add project log sink destination to billing-account module * Make filter field optional * Update READMEs --------- Co-authored-by: Ludovico Magnocavallo <ludomagno@google.com>
This commit is contained in:
Julio Castillo
GitHub
parent
b72f7d34b5
commit
5197d5ca8d
|
|
@ -17,8 +17,16 @@
|
|||
# tfdoc:file:description Log sinks and supporting resources.
|
||||
|
||||
locals {
|
||||
logging_sinks = {
|
||||
for k, v in var.logging_sinks :
|
||||
# rewrite destination and type when type="project"
|
||||
k => merge(v, v.type != "project" ? {} : {
|
||||
destination = "projects/${v.destination}"
|
||||
type = "logging"
|
||||
})
|
||||
}
|
||||
sink_bindings = {
|
||||
for type in ["bigquery", "pubsub", "logging", "storage"] :
|
||||
for type in ["bigquery", "logging", "project", "pubsub", "storage"] :
|
||||
type => {
|
||||
for name, sink in var.logging_sinks :
|
||||
name => sink
|
||||
|
|
@ -28,7 +36,7 @@ locals {
|
|||
}
|
||||
|
||||
resource "google_logging_billing_account_sink" "sink" {
|
||||
for_each = var.logging_sinks
|
||||
for_each = local.logging_sinks
|
||||
name = each.key
|
||||
description = coalesce(each.value.description, "${each.key} (Terraform-managed).")
|
||||
billing_account = var.id
|
||||
|
|
@ -90,3 +98,10 @@ resource "google_project_iam_member" "bucket-sinks-binding" {
|
|||
expression = "resource.name.endsWith('${each.value.destination}')"
|
||||
}
|
||||
}
|
||||
|
||||
resource "google_project_iam_member" "project-sinks-binding" {
|
||||
for_each = local.sink_bindings["project"]
|
||||
project = each.value.destination
|
||||
role = "roles/logging.logWriter"
|
||||
member = google_logging_billing_account_sink.sink[each.key].writer_identity
|
||||
}
|
||||
|
|
|
|||
|
|
@ -153,9 +153,9 @@ variable "logging_sinks" {
|
|||
validation {
|
||||
condition = alltrue([
|
||||
for k, v in var.logging_sinks :
|
||||
contains(["bigquery", "logging", "pubsub", "storage"], v.type)
|
||||
contains(["bigquery", "logging", "project", "pubsub", "storage"], v.type)
|
||||
])
|
||||
error_message = "Type must be one of 'bigquery', 'logging', 'pubsub', 'storage'."
|
||||
error_message = "Type must be one of 'bigquery', 'logging', 'project', 'pubsub', 'storage'."
|
||||
}
|
||||
validation {
|
||||
condition = alltrue([
|
||||
|
|
|
|||
|
|
@ -231,6 +231,17 @@ module "bucket" {
|
|||
id = "${var.prefix}-bucket"
|
||||
}
|
||||
|
||||
module "destination-project" {
|
||||
source = "./fabric/modules/project"
|
||||
name = "destination-project"
|
||||
billing_account = var.billing_account_id
|
||||
parent = var.folder_id
|
||||
prefix = var.prefix
|
||||
services = [
|
||||
"logging.googleapis.com"
|
||||
]
|
||||
}
|
||||
|
||||
module "folder-sink" {
|
||||
source = "./fabric/modules/folder"
|
||||
name = "Folder name"
|
||||
|
|
@ -259,12 +270,17 @@ module "folder-sink" {
|
|||
}
|
||||
type = "logging"
|
||||
}
|
||||
alert = {
|
||||
destination = module.destination-project.id
|
||||
filter = "severity=ALERT"
|
||||
type = "project"
|
||||
}
|
||||
}
|
||||
logging_exclusions = {
|
||||
no-gce-instances = "resource.type=gce_instance"
|
||||
}
|
||||
}
|
||||
# tftest modules=5 resources=14 inventory=logging.yaml e2e
|
||||
# tftest modules=6 resources=18 inventory=logging.yaml e2e
|
||||
```
|
||||
|
||||
## Data Access Logs
|
||||
|
|
@ -353,7 +369,7 @@ module "folder" {
|
|||
| [id](variables.tf#L48) | Folder ID in case you use folder_create=false. | <code>string</code> | | <code>null</code> |
|
||||
| [logging_data_access](variables.tf#L54) | Control activation of data access logs. Format is service => { log type => [exempted members]}. The special 'allServices' key denotes configuration for all services. | <code>map(map(list(string)))</code> | | <code>{}</code> |
|
||||
| [logging_exclusions](variables.tf#L69) | Logging exclusions for this folder in the form {NAME -> FILTER}. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [logging_sinks](variables.tf#L76) | Logging sinks to create for the folder. | <code title="map(object({ bq_partitioned_table = optional(bool, false) description = optional(string) destination = string disabled = optional(bool, false) exclusions = optional(map(string), {}) filter = string iam = optional(bool, true) include_children = optional(bool, true) type = string }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [logging_sinks](variables.tf#L76) | Logging sinks to create for the folder. | <code title="map(object({ bq_partitioned_table = optional(bool, false) description = optional(string) destination = string disabled = optional(bool, false) exclusions = optional(map(string), {}) filter = optional(string) iam = optional(bool, true) include_children = optional(bool, true) type = string }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [name](variables.tf#L107) | Folder name. | <code>string</code> | | <code>null</code> |
|
||||
| [org_policies](variables.tf#L113) | Organization policies applied to this folder keyed by policy name. | <code title="map(object({ inherit_from_parent = optional(bool) # for list policies only. reset = optional(bool) rules = optional(list(object({ allow = optional(object({ all = optional(bool) values = optional(list(string)) })) deny = optional(object({ all = optional(bool) values = optional(list(string)) })) enforce = optional(bool) # for boolean policies only. condition = optional(object({ description = optional(string) expression = optional(string) location = optional(string) title = optional(string) }), {}) })), []) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [parent](variables.tf#L140) | Parent in folders/folder_id or organizations/org_id format. | <code>string</code> | | <code>null</code> |
|
||||
|
|
|
|||
|
|
@ -17,8 +17,16 @@
|
|||
# tfdoc:file:description Log sinks and supporting resources.
|
||||
|
||||
locals {
|
||||
logging_sinks = {
|
||||
for k, v in var.logging_sinks :
|
||||
# rewrite destination and type when type="project"
|
||||
k => merge(v, v.type != "project" ? {} : {
|
||||
destination = "projects/${v.destination}"
|
||||
type = "logging"
|
||||
})
|
||||
}
|
||||
sink_bindings = {
|
||||
for type in ["bigquery", "pubsub", "logging", "storage"] :
|
||||
for type in ["bigquery", "logging", "project", "pubsub", "storage"] :
|
||||
type => {
|
||||
for name, sink in var.logging_sinks :
|
||||
name => sink
|
||||
|
|
@ -42,7 +50,7 @@ resource "google_folder_iam_audit_config" "default" {
|
|||
}
|
||||
|
||||
resource "google_logging_folder_sink" "sink" {
|
||||
for_each = var.logging_sinks
|
||||
for_each = local.logging_sinks
|
||||
name = each.key
|
||||
description = coalesce(each.value.description, "${each.key} (Terraform-managed).")
|
||||
folder = local.folder.name
|
||||
|
|
@ -108,6 +116,13 @@ resource "google_project_iam_member" "bucket-sinks-binding" {
|
|||
}
|
||||
}
|
||||
|
||||
resource "google_project_iam_member" "project-sinks-binding" {
|
||||
for_each = local.sink_bindings["project"]
|
||||
project = each.value.destination
|
||||
role = "roles/logging.logWriter"
|
||||
member = google_logging_folder_sink.sink[each.key].writer_identity
|
||||
}
|
||||
|
||||
resource "google_logging_folder_exclusion" "logging-exclusion" {
|
||||
for_each = var.logging_exclusions
|
||||
name = each.key
|
||||
|
|
|
|||
|
|
@ -81,7 +81,7 @@ variable "logging_sinks" {
|
|||
destination = string
|
||||
disabled = optional(bool, false)
|
||||
exclusions = optional(map(string), {})
|
||||
filter = string
|
||||
filter = optional(string)
|
||||
iam = optional(bool, true)
|
||||
include_children = optional(bool, true)
|
||||
type = string
|
||||
|
|
@ -91,9 +91,9 @@ variable "logging_sinks" {
|
|||
validation {
|
||||
condition = alltrue([
|
||||
for k, v in var.logging_sinks :
|
||||
contains(["bigquery", "logging", "pubsub", "storage"], v.type)
|
||||
contains(["bigquery", "logging", "project", "pubsub", "storage"], v.type)
|
||||
])
|
||||
error_message = "Type must be one of 'bigquery', 'logging', 'pubsub', 'storage'."
|
||||
error_message = "Type must be one of 'bigquery', 'logging', 'project', 'pubsub', 'storage'."
|
||||
}
|
||||
validation {
|
||||
condition = alltrue([
|
||||
|
|
|
|||
|
|
@ -293,6 +293,17 @@ module "bucket" {
|
|||
id = "${var.prefix}-bucket"
|
||||
}
|
||||
|
||||
module "destination-project" {
|
||||
source = "./fabric/modules/project"
|
||||
name = "destination-project"
|
||||
billing_account = var.billing_account_id
|
||||
parent = var.folder_id
|
||||
prefix = var.prefix
|
||||
services = [
|
||||
"logging.googleapis.com"
|
||||
]
|
||||
}
|
||||
|
||||
module "org" {
|
||||
source = "./fabric/modules/organization"
|
||||
organization_id = var.organization_id
|
||||
|
|
@ -322,12 +333,17 @@ module "org" {
|
|||
}
|
||||
type = "logging"
|
||||
}
|
||||
alert = {
|
||||
destination = module.destination-project.id
|
||||
filter = "severity=ALERT"
|
||||
type = "project"
|
||||
}
|
||||
}
|
||||
logging_exclusions = {
|
||||
no-gce-instances = "resource.type=gce_instance"
|
||||
}
|
||||
}
|
||||
# tftest modules=5 resources=13 inventory=logging.yaml e2e serial
|
||||
# tftest modules=6 resources=17 inventory=logging.yaml e2e serial
|
||||
```
|
||||
|
||||
## Data Access Logs
|
||||
|
|
@ -500,7 +516,7 @@ module "org" {
|
|||
| [iam_by_principals](variables-iam.tf#L54) | Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid cycle errors. Merged internally with the `iam` variable. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [logging_data_access](variables.tf#L51) | Control activation of data access logs. Format is service => { log type => [exempted members]}. The special 'allServices' key denotes configuration for all services. | <code>map(map(list(string)))</code> | | <code>{}</code> |
|
||||
| [logging_exclusions](variables.tf#L66) | Logging exclusions for this organization in the form {NAME -> FILTER}. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [logging_sinks](variables.tf#L73) | Logging sinks to create for the organization. | <code title="map(object({ bq_partitioned_table = optional(bool, false) description = optional(string) destination = string disabled = optional(bool, false) exclusions = optional(map(string), {}) filter = string iam = optional(bool, true) include_children = optional(bool, true) type = string }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [logging_sinks](variables.tf#L73) | Logging sinks to create for the organization. | <code title="map(object({ bq_partitioned_table = optional(bool, false) description = optional(string) destination = string disabled = optional(bool, false) exclusions = optional(map(string), {}) filter = optional(string) iam = optional(bool, true) include_children = optional(bool, true) type = string }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [network_tags](variables-tags.tf#L17) | Network tags by key name. If `id` is provided, key creation is skipped. The `iam` attribute behaves like the similarly named one at module level. | <code title="map(object({ description = optional(string, "Managed by the Terraform organization module.") iam = optional(map(list(string)), {}) id = optional(string) network = string # project_id/vpc_name values = optional(map(object({ description = optional(string, "Managed by the Terraform organization module.") iam = optional(map(list(string)), {}) })), {}) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [org_policies](variables.tf#L104) | Organization policies applied to this organization keyed by policy name. | <code title="map(object({ inherit_from_parent = optional(bool) # for list policies only. reset = optional(bool) rules = optional(list(object({ allow = optional(object({ all = optional(bool) values = optional(list(string)) })) deny = optional(object({ all = optional(bool) values = optional(list(string)) })) enforce = optional(bool) # for boolean policies only. condition = optional(object({ description = optional(string) expression = optional(string) location = optional(string) title = optional(string) }), {}) })), []) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [org_policy_custom_constraints](variables.tf#L131) | Organization policy custom constraints keyed by constraint name. | <code title="map(object({ display_name = optional(string) description = optional(string) action_type = string condition = string method_types = list(string) resource_types = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
|
|
|
|||
|
|
@ -17,8 +17,16 @@
|
|||
# tfdoc:file:description Log sinks and data access logs.
|
||||
|
||||
locals {
|
||||
logging_sinks = {
|
||||
for k, v in var.logging_sinks :
|
||||
# rewrite destination and type when type="project"
|
||||
k => merge(v, v.type != "project" ? {} : {
|
||||
destination = "projects/${v.destination}"
|
||||
type = "logging"
|
||||
})
|
||||
}
|
||||
sink_bindings = {
|
||||
for type in ["bigquery", "logging", "pubsub", "storage"] :
|
||||
for type in ["bigquery", "logging", "project", "pubsub", "storage"] :
|
||||
type => {
|
||||
for name, sink in var.logging_sinks :
|
||||
name => sink if sink.iam && sink.type == type
|
||||
|
|
@ -41,7 +49,7 @@ resource "google_organization_iam_audit_config" "default" {
|
|||
}
|
||||
|
||||
resource "google_logging_organization_sink" "sink" {
|
||||
for_each = var.logging_sinks
|
||||
for_each = local.logging_sinks
|
||||
name = each.key
|
||||
description = coalesce(each.value.description, "${each.key} (Terraform-managed).")
|
||||
org_id = local.organization_id_numeric
|
||||
|
|
@ -108,6 +116,13 @@ resource "google_project_iam_member" "bucket-sinks-binding" {
|
|||
}
|
||||
}
|
||||
|
||||
resource "google_project_iam_member" "project-sinks-binding" {
|
||||
for_each = local.sink_bindings["project"]
|
||||
project = each.value.destination
|
||||
role = "roles/logging.logWriter"
|
||||
member = google_logging_organization_sink.sink[each.key].writer_identity
|
||||
}
|
||||
|
||||
resource "google_logging_organization_exclusion" "logging-exclusion" {
|
||||
for_each = var.logging_exclusions
|
||||
name = each.key
|
||||
|
|
|
|||
|
|
@ -78,7 +78,7 @@ variable "logging_sinks" {
|
|||
destination = string
|
||||
disabled = optional(bool, false)
|
||||
exclusions = optional(map(string), {})
|
||||
filter = string
|
||||
filter = optional(string)
|
||||
iam = optional(bool, true)
|
||||
include_children = optional(bool, true)
|
||||
type = string
|
||||
|
|
@ -88,9 +88,9 @@ variable "logging_sinks" {
|
|||
validation {
|
||||
condition = alltrue([
|
||||
for k, v in var.logging_sinks :
|
||||
contains(["bigquery", "logging", "pubsub", "storage"], v.type)
|
||||
contains(["bigquery", "logging", "project", "pubsub", "storage"], v.type)
|
||||
])
|
||||
error_message = "Type must be one of 'bigquery', 'logging', 'pubsub', 'storage'."
|
||||
error_message = "Type must be one of 'bigquery', 'logging', 'project', 'pubsub', 'storage'."
|
||||
}
|
||||
validation {
|
||||
condition = alltrue([
|
||||
|
|
|
|||
|
|
@ -561,6 +561,17 @@ module "bucket" {
|
|||
id = "${var.prefix}-bucket"
|
||||
}
|
||||
|
||||
module "destination-project" {
|
||||
source = "./fabric/modules/project"
|
||||
name = "destination-project"
|
||||
billing_account = var.billing_account_id
|
||||
parent = var.folder_id
|
||||
prefix = var.prefix
|
||||
services = [
|
||||
"logging.googleapis.com"
|
||||
]
|
||||
}
|
||||
|
||||
module "project-host" {
|
||||
source = "./fabric/modules/project"
|
||||
name = "project"
|
||||
|
|
@ -594,12 +605,17 @@ module "project-host" {
|
|||
}
|
||||
type = "logging"
|
||||
}
|
||||
alert = {
|
||||
destination = module.destination-project.id
|
||||
filter = "severity=ALERT"
|
||||
type = "project"
|
||||
}
|
||||
}
|
||||
logging_exclusions = {
|
||||
no-gce-instances = "resource.type=gce_instance"
|
||||
}
|
||||
}
|
||||
# tftest modules=5 resources=15 inventory=logging.yaml e2e
|
||||
# tftest modules=6 resources=19 inventory=logging.yaml e2e
|
||||
```
|
||||
|
||||
## Data Access Logs
|
||||
|
|
@ -998,7 +1014,7 @@ module "bucket" {
|
|||
| [lien_reason](variables.tf#L86) | If non-empty, creates a project lien with this description. | <code>string</code> | | <code>null</code> |
|
||||
| [logging_data_access](variables.tf#L92) | Control activation of data access logs. Format is service => { log type => [exempted members]}. The special 'allServices' key denotes configuration for all services. | <code>map(map(list(string)))</code> | | <code>{}</code> |
|
||||
| [logging_exclusions](variables.tf#L107) | Logging exclusions for this project in the form {NAME -> FILTER}. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [logging_sinks](variables.tf#L114) | Logging sinks to create for this project. | <code title="map(object({ bq_partitioned_table = optional(bool, false) description = optional(string) destination = string disabled = optional(bool, false) exclusions = optional(map(string), {}) filter = string iam = optional(bool, true) type = string unique_writer = optional(bool, true) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [logging_sinks](variables.tf#L114) | Logging sinks to create for this project. | <code title="map(object({ bq_partitioned_table = optional(bool, false) description = optional(string) destination = string disabled = optional(bool, false) exclusions = optional(map(string), {}) filter = optional(string) iam = optional(bool, true) type = string unique_writer = optional(bool, true) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [metric_scopes](variables.tf#L145) | List of projects that will act as metric scopes for this project. | <code>list(string)</code> | | <code>[]</code> |
|
||||
| [network_tags](variables-tags.tf#L17) | Network tags by key name. If `id` is provided, key creation is skipped. The `iam` attribute behaves like the similarly named one at module level. | <code title="map(object({ description = optional(string, "Managed by the Terraform project module.") iam = optional(map(list(string)), {}) id = optional(string) network = string # project_id/vpc_name values = optional(map(object({ description = optional(string, "Managed by the Terraform project module.") iam = optional(map(list(string)), {}) })), {}) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [org_policies](variables.tf#L157) | Organization policies applied to this project keyed by policy name. | <code title="map(object({ inherit_from_parent = optional(bool) # for list policies only. reset = optional(bool) rules = optional(list(object({ allow = optional(object({ all = optional(bool) values = optional(list(string)) })) deny = optional(object({ all = optional(bool) values = optional(list(string)) })) enforce = optional(bool) # for boolean policies only. condition = optional(object({ description = optional(string) expression = optional(string) location = optional(string) title = optional(string) }), {}) })), []) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
|
|
|
|||
|
|
@ -17,8 +17,16 @@
|
|||
# tfdoc:file:description Log sinks and supporting resources.
|
||||
|
||||
locals {
|
||||
logging_sinks = {
|
||||
for k, v in var.logging_sinks :
|
||||
# rewrite destination and type when type="project"
|
||||
k => merge(v, v.type != "project" ? {} : {
|
||||
destination = "projects/${v.destination}"
|
||||
type = "logging"
|
||||
})
|
||||
}
|
||||
sink_bindings = {
|
||||
for type in ["bigquery", "pubsub", "logging", "storage"] :
|
||||
for type in ["bigquery", "logging", "project", "pubsub", "storage"] :
|
||||
type => {
|
||||
for name, sink in var.logging_sinks :
|
||||
name => sink if sink.iam && sink.type == type
|
||||
|
|
@ -41,7 +49,7 @@ resource "google_project_iam_audit_config" "default" {
|
|||
}
|
||||
|
||||
resource "google_logging_project_sink" "sink" {
|
||||
for_each = var.logging_sinks
|
||||
for_each = local.logging_sinks
|
||||
name = each.key
|
||||
description = coalesce(each.value.description, "${each.key} (Terraform-managed).")
|
||||
project = local.project.project_id
|
||||
|
|
@ -110,6 +118,13 @@ resource "google_project_iam_member" "bucket-sinks-binding" {
|
|||
}
|
||||
}
|
||||
|
||||
resource "google_project_iam_member" "project-sinks-binding" {
|
||||
for_each = local.sink_bindings["project"]
|
||||
project = each.value.destination
|
||||
role = "roles/logging.logWriter"
|
||||
member = google_logging_project_sink.sink[each.key].writer_identity
|
||||
}
|
||||
|
||||
resource "google_logging_project_exclusion" "logging-exclusion" {
|
||||
for_each = var.logging_exclusions
|
||||
name = each.key
|
||||
|
|
|
|||
|
|
@ -119,7 +119,7 @@ variable "logging_sinks" {
|
|||
destination = string
|
||||
disabled = optional(bool, false)
|
||||
exclusions = optional(map(string), {})
|
||||
filter = string
|
||||
filter = optional(string)
|
||||
iam = optional(bool, true)
|
||||
type = string
|
||||
unique_writer = optional(bool, true)
|
||||
|
|
@ -129,9 +129,9 @@ variable "logging_sinks" {
|
|||
validation {
|
||||
condition = alltrue([
|
||||
for k, v in var.logging_sinks :
|
||||
contains(["bigquery", "logging", "pubsub", "storage"], v.type)
|
||||
contains(["bigquery", "logging", "project", "pubsub", "storage"], v.type)
|
||||
])
|
||||
error_message = "Type must be one of 'bigquery', 'logging', 'pubsub', 'storage'."
|
||||
error_message = "Type must be one of 'bigquery', 'logging', 'project', 'pubsub', 'storage'."
|
||||
}
|
||||
validation {
|
||||
condition = alltrue([
|
||||
|
|
|
|||
|
|
@ -13,16 +13,62 @@
|
|||
# limitations under the License.
|
||||
|
||||
values:
|
||||
module.bucket.google_logging_project_bucket_config.bucket[0]:
|
||||
bucket_id: test-bucket
|
||||
cmek_settings: []
|
||||
enable_analytics: false
|
||||
index_configs: []
|
||||
location: global
|
||||
locked: null
|
||||
project: project-id
|
||||
retention_days: 30
|
||||
module.dataset.google_bigquery_dataset.default:
|
||||
dataset_id: bq_sink
|
||||
default_encryption_configuration: []
|
||||
default_partition_expiration_ms: null
|
||||
default_table_expiration_ms: null
|
||||
delete_contents_on_destroy: false
|
||||
description: Terraform managed.
|
||||
friendly_name: null
|
||||
labels: null
|
||||
location: EU
|
||||
max_time_travel_hours: '168'
|
||||
project: project-id
|
||||
module.destination-project.google_project.project[0]:
|
||||
auto_create_network: false
|
||||
billing_account: 123456-123456-123456
|
||||
folder_id: '1122334455'
|
||||
labels: null
|
||||
name: test-destination-project
|
||||
org_id: null
|
||||
project_id: test-destination-project
|
||||
skip_delete: false
|
||||
module.destination-project.google_project_service.project_services["logging.googleapis.com"]:
|
||||
disable_dependent_services: false
|
||||
disable_on_destroy: false
|
||||
project: test-destination-project
|
||||
service: logging.googleapis.com
|
||||
module.folder-sink.google_bigquery_dataset_iam_member.bq-sinks-binding["info"]:
|
||||
condition: []
|
||||
role: roles/bigquery.dataEditor
|
||||
module.folder-sink.google_folder.folder[0]:
|
||||
display_name: Folder name
|
||||
parent: folders/1122334455
|
||||
module.folder-sink.google_logging_folder_exclusion.logging-exclusion["no-gce-instances"]:
|
||||
description: no-gce-instances (Terraform-managed).
|
||||
disabled: null
|
||||
filter: resource.type=gce_instance
|
||||
name: no-gce-instances
|
||||
module.folder-sink.google_logging_folder_sink.sink["alert"]:
|
||||
description: alert (Terraform-managed).
|
||||
destination: logging.googleapis.com/projects/test-destination-project
|
||||
disabled: false
|
||||
exclusions: []
|
||||
filter: severity=ALERT
|
||||
include_children: true
|
||||
name: alert
|
||||
module.folder-sink.google_logging_folder_sink.sink["debug"]:
|
||||
description: debug (Terraform-managed).
|
||||
disabled: false
|
||||
exclusions:
|
||||
- description: null
|
||||
|
|
@ -34,13 +80,16 @@ values:
|
|||
name: debug
|
||||
module.folder-sink.google_logging_folder_sink.sink["info"]:
|
||||
bigquery_options:
|
||||
- use_partitioned_tables: false
|
||||
- use_partitioned_tables: false
|
||||
description: info (Terraform-managed).
|
||||
disabled: false
|
||||
exclusions: []
|
||||
filter: severity=INFO
|
||||
include_children: true
|
||||
name: info
|
||||
module.folder-sink.google_logging_folder_sink.sink["notice"]:
|
||||
description: notice (Terraform-managed).
|
||||
destination: pubsub.googleapis.com/projects/project-id/topics/pubsub_sink
|
||||
disabled: false
|
||||
exclusions: []
|
||||
filter: severity=NOTICE
|
||||
|
|
@ -58,20 +107,62 @@ values:
|
|||
condition:
|
||||
- title: debug bucket writer
|
||||
role: roles/logging.bucketWriter
|
||||
module.folder-sink.google_project_iam_member.project-sinks-binding["alert"]:
|
||||
condition: []
|
||||
project: test-destination-project
|
||||
role: roles/logging.logWriter
|
||||
module.folder-sink.google_pubsub_topic_iam_member.pubsub-sinks-binding["notice"]:
|
||||
condition: []
|
||||
project: project-id
|
||||
role: roles/pubsub.publisher
|
||||
topic: pubsub_sink
|
||||
module.folder-sink.google_storage_bucket_iam_member.gcs-sinks-binding["warnings"]:
|
||||
bucket: test-gcs_sink
|
||||
condition: []
|
||||
role: roles/storage.objectCreator
|
||||
module.gcs.google_storage_bucket.bucket:
|
||||
autoclass:
|
||||
- enabled: false
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
enable_object_retention: null
|
||||
encryption: []
|
||||
force_destroy: true
|
||||
labels: null
|
||||
lifecycle_rule: []
|
||||
location: EU
|
||||
logging: []
|
||||
name: test-gcs_sink
|
||||
project: project-id
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
- enabled: false
|
||||
module.pubsub.google_pubsub_topic.default:
|
||||
kms_key_name: null
|
||||
labels: null
|
||||
message_retention_duration: null
|
||||
name: pubsub_sink
|
||||
project: project-id
|
||||
|
||||
counts:
|
||||
google_bigquery_dataset: 1
|
||||
google_bigquery_dataset_iam_member: 1
|
||||
google_folder: 1
|
||||
google_logging_folder_exclusion: 1
|
||||
google_logging_folder_sink: 4
|
||||
google_logging_folder_sink: 5
|
||||
google_logging_project_bucket_config: 1
|
||||
google_project_iam_member: 1
|
||||
google_project: 1
|
||||
google_project_iam_member: 2
|
||||
google_project_service: 1
|
||||
google_pubsub_topic: 1
|
||||
google_pubsub_topic_iam_member: 1
|
||||
google_storage_bucket: 1
|
||||
google_storage_bucket_iam_member: 1
|
||||
modules: 6
|
||||
resources: 18
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -13,15 +13,82 @@
|
|||
# limitations under the License.
|
||||
|
||||
values:
|
||||
module.bucket.google_logging_project_bucket_config.bucket[0]:
|
||||
bucket_id: test-bucket
|
||||
cmek_settings: []
|
||||
enable_analytics: false
|
||||
index_configs: []
|
||||
location: global
|
||||
locked: null
|
||||
project: project-id
|
||||
retention_days: 30
|
||||
module.dataset.google_bigquery_dataset.default:
|
||||
dataset_id: bq_sink
|
||||
default_encryption_configuration: []
|
||||
default_partition_expiration_ms: null
|
||||
default_table_expiration_ms: null
|
||||
delete_contents_on_destroy: false
|
||||
description: Terraform managed.
|
||||
friendly_name: null
|
||||
labels: null
|
||||
location: EU
|
||||
max_time_travel_hours: '168'
|
||||
project: project-id
|
||||
module.destination-project.google_project.project[0]:
|
||||
auto_create_network: false
|
||||
billing_account: 123456-123456-123456
|
||||
folder_id: '1122334455'
|
||||
labels: null
|
||||
name: test-destination-project
|
||||
org_id: null
|
||||
project_id: test-destination-project
|
||||
skip_delete: false
|
||||
module.destination-project.google_project_service.project_services["logging.googleapis.com"]:
|
||||
disable_dependent_services: false
|
||||
disable_on_destroy: false
|
||||
project: test-destination-project
|
||||
service: logging.googleapis.com
|
||||
module.gcs.google_storage_bucket.bucket:
|
||||
autoclass:
|
||||
- enabled: false
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
enable_object_retention: null
|
||||
encryption: []
|
||||
force_destroy: true
|
||||
labels: null
|
||||
lifecycle_rule: []
|
||||
location: EU
|
||||
logging: []
|
||||
name: test-gcs_sink
|
||||
project: project-id
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
- enabled: false
|
||||
module.org.google_bigquery_dataset_iam_member.bq-sinks-binding["info"]:
|
||||
condition: []
|
||||
role: roles/bigquery.dataEditor
|
||||
module.org.google_logging_organization_exclusion.logging-exclusion["no-gce-instances"]:
|
||||
description: no-gce-instances (Terraform-managed).
|
||||
disabled: null
|
||||
filter: resource.type=gce_instance
|
||||
name: no-gce-instances
|
||||
org_id: '1122334455'
|
||||
module.org.google_logging_organization_sink.sink["alert"]:
|
||||
description: alert (Terraform-managed).
|
||||
destination: logging.googleapis.com/projects/test-destination-project
|
||||
disabled: false
|
||||
exclusions: []
|
||||
filter: severity=ALERT
|
||||
include_children: true
|
||||
name: alert
|
||||
org_id: '1122334455'
|
||||
module.org.google_logging_organization_sink.sink["debug"]:
|
||||
description: debug (Terraform-managed).
|
||||
disabled: false
|
||||
exclusions:
|
||||
- description: null
|
||||
|
|
@ -34,7 +101,8 @@ values:
|
|||
org_id: '1122334455'
|
||||
module.org.google_logging_organization_sink.sink["info"]:
|
||||
bigquery_options:
|
||||
- use_partitioned_tables: true
|
||||
- use_partitioned_tables: true
|
||||
description: info (Terraform-managed).
|
||||
disabled: false
|
||||
exclusions: []
|
||||
filter: severity=INFO
|
||||
|
|
@ -42,6 +110,8 @@ values:
|
|||
name: info
|
||||
org_id: '1122334455'
|
||||
module.org.google_logging_organization_sink.sink["notice"]:
|
||||
description: notice (Terraform-managed).
|
||||
destination: pubsub.googleapis.com/projects/project-id/topics/pubsub_sink
|
||||
disabled: false
|
||||
exclusions: []
|
||||
filter: severity=NOTICE
|
||||
|
|
@ -49,6 +119,7 @@ values:
|
|||
name: notice
|
||||
org_id: '1122334455'
|
||||
module.org.google_logging_organization_sink.sink["warnings"]:
|
||||
description: warnings (Terraform-managed).
|
||||
destination: storage.googleapis.com/test-gcs_sink
|
||||
disabled: false
|
||||
exclusions: []
|
||||
|
|
@ -56,6 +127,23 @@ values:
|
|||
include_children: true
|
||||
name: warnings
|
||||
org_id: '1122334455'
|
||||
module.org.google_project_iam_member.bucket-sinks-binding["debug"]:
|
||||
condition:
|
||||
- title: debug bucket writer
|
||||
role: roles/logging.bucketWriter
|
||||
module.org.google_project_iam_member.project-sinks-binding["alert"]:
|
||||
condition: []
|
||||
project: test-destination-project
|
||||
role: roles/logging.logWriter
|
||||
module.org.google_pubsub_topic_iam_member.pubsub-sinks-binding["notice"]:
|
||||
condition: []
|
||||
project: project-id
|
||||
role: roles/pubsub.publisher
|
||||
topic: pubsub_sink
|
||||
module.org.google_storage_bucket_iam_member.storage-sinks-binding["warnings"]:
|
||||
bucket: test-gcs_sink
|
||||
condition: []
|
||||
role: roles/storage.objectCreator
|
||||
module.pubsub.google_pubsub_topic.default:
|
||||
kms_key_name: null
|
||||
labels: null
|
||||
|
|
@ -64,9 +152,18 @@ values:
|
|||
project: project-id
|
||||
|
||||
counts:
|
||||
google_bigquery_dataset: 1
|
||||
google_bigquery_dataset_iam_member: 1
|
||||
google_logging_organization_exclusion: 1
|
||||
google_logging_organization_sink: 4
|
||||
google_project_iam_member: 1
|
||||
google_logging_organization_sink: 5
|
||||
google_logging_project_bucket_config: 1
|
||||
google_project: 1
|
||||
google_project_iam_member: 2
|
||||
google_project_service: 1
|
||||
google_pubsub_topic: 1
|
||||
google_pubsub_topic_iam_member: 1
|
||||
google_storage_bucket: 1
|
||||
google_storage_bucket_iam_member: 1
|
||||
modules: 6
|
||||
resources: 17
|
||||
|
||||
|
|
|
|||
|
|
@ -13,6 +13,62 @@
|
|||
# limitations under the License.
|
||||
|
||||
values:
|
||||
module.bucket.google_logging_project_bucket_config.bucket[0]:
|
||||
bucket_id: test-bucket
|
||||
cmek_settings: []
|
||||
enable_analytics: false
|
||||
index_configs: []
|
||||
location: global
|
||||
locked: null
|
||||
project: project-id
|
||||
retention_days: 30
|
||||
module.dataset.google_bigquery_dataset.default:
|
||||
dataset_id: bq_sink
|
||||
default_encryption_configuration: []
|
||||
default_partition_expiration_ms: null
|
||||
default_table_expiration_ms: null
|
||||
delete_contents_on_destroy: true
|
||||
description: Terraform managed.
|
||||
friendly_name: null
|
||||
labels: null
|
||||
location: EU
|
||||
max_time_travel_hours: '168'
|
||||
project: project-id
|
||||
module.destination-project.google_project.project[0]:
|
||||
auto_create_network: false
|
||||
billing_account: 123456-123456-123456
|
||||
folder_id: '1122334455'
|
||||
labels: null
|
||||
name: test-destination-project
|
||||
org_id: null
|
||||
project_id: test-destination-project
|
||||
skip_delete: false
|
||||
module.destination-project.google_project_service.project_services["logging.googleapis.com"]:
|
||||
disable_dependent_services: false
|
||||
disable_on_destroy: false
|
||||
project: test-destination-project
|
||||
service: logging.googleapis.com
|
||||
module.gcs.google_storage_bucket.bucket:
|
||||
autoclass:
|
||||
- enabled: false
|
||||
cors: []
|
||||
custom_placement_config: []
|
||||
default_event_based_hold: null
|
||||
enable_object_retention: null
|
||||
encryption: []
|
||||
force_destroy: true
|
||||
labels: null
|
||||
lifecycle_rule: []
|
||||
location: EU
|
||||
logging: []
|
||||
name: test-gcs_sink
|
||||
project: project-id
|
||||
requester_pays: null
|
||||
retention_policy: []
|
||||
storage_class: MULTI_REGIONAL
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
- enabled: false
|
||||
module.project-host.google_bigquery_dataset_iam_member.bq-sinks-binding["info"]:
|
||||
condition: []
|
||||
role: roles/bigquery.dataEditor
|
||||
|
|
@ -22,7 +78,18 @@ values:
|
|||
filter: resource.type=gce_instance
|
||||
name: no-gce-instances
|
||||
project: test-project
|
||||
module.project-host.google_logging_project_sink.sink["alert"]:
|
||||
custom_writer_identity: null
|
||||
description: alert (Terraform-managed).
|
||||
destination: logging.googleapis.com/projects/test-destination-project
|
||||
disabled: false
|
||||
exclusions: []
|
||||
filter: severity=ALERT
|
||||
name: alert
|
||||
project: test-project
|
||||
unique_writer_identity: true
|
||||
module.project-host.google_logging_project_sink.sink["debug"]:
|
||||
custom_writer_identity: null
|
||||
description: debug (Terraform-managed).
|
||||
disabled: false
|
||||
exclusions:
|
||||
|
|
@ -36,7 +103,8 @@ values:
|
|||
unique_writer_identity: true
|
||||
module.project-host.google_logging_project_sink.sink["info"]:
|
||||
bigquery_options:
|
||||
- use_partitioned_tables: false
|
||||
- use_partitioned_tables: false
|
||||
custom_writer_identity: null
|
||||
description: info (Terraform-managed).
|
||||
disabled: false
|
||||
exclusions: []
|
||||
|
|
@ -45,7 +113,9 @@ values:
|
|||
project: test-project
|
||||
unique_writer_identity: true
|
||||
module.project-host.google_logging_project_sink.sink["notice"]:
|
||||
custom_writer_identity: null
|
||||
description: notice (Terraform-managed).
|
||||
destination: pubsub.googleapis.com/projects/project-id/topics/pubsub_sink
|
||||
disabled: false
|
||||
exclusions: []
|
||||
filter: severity=NOTICE
|
||||
|
|
@ -53,6 +123,7 @@ values:
|
|||
project: test-project
|
||||
unique_writer_identity: true
|
||||
module.project-host.google_logging_project_sink.sink["warnings"]:
|
||||
custom_writer_identity: null
|
||||
description: warnings (Terraform-managed).
|
||||
destination: storage.googleapis.com/test-gcs_sink
|
||||
disabled: false
|
||||
|
|
@ -74,23 +145,45 @@ values:
|
|||
condition:
|
||||
- title: debug bucket writer
|
||||
role: roles/logging.bucketWriter
|
||||
module.project-host.google_project_iam_member.project-sinks-binding["alert"]:
|
||||
condition: []
|
||||
project: test-destination-project
|
||||
role: roles/logging.logWriter
|
||||
module.project-host.google_project_service.project_services["logging.googleapis.com"]:
|
||||
disable_dependent_services: false
|
||||
disable_on_destroy: false
|
||||
project: test-project
|
||||
service: logging.googleapis.com
|
||||
module.project-host.google_pubsub_topic_iam_member.pubsub-sinks-binding["notice"]:
|
||||
condition: []
|
||||
project: project-id
|
||||
role: roles/pubsub.publisher
|
||||
topic: pubsub_sink
|
||||
module.project-host.google_storage_bucket_iam_member.gcs-sinks-binding["warnings"]:
|
||||
bucket: test-gcs_sink
|
||||
condition: []
|
||||
role: roles/storage.objectCreator
|
||||
module.pubsub.google_pubsub_topic.default:
|
||||
kms_key_name: null
|
||||
labels: null
|
||||
message_retention_duration: null
|
||||
name: pubsub_sink
|
||||
project: project-id
|
||||
|
||||
counts:
|
||||
google_bigquery_dataset: 1
|
||||
google_bigquery_dataset_iam_member: 1
|
||||
google_logging_project_bucket_config: 1
|
||||
google_logging_project_exclusion: 1
|
||||
google_logging_project_sink: 4
|
||||
google_project: 1
|
||||
google_project_iam_member: 1
|
||||
google_logging_project_sink: 5
|
||||
google_project: 2
|
||||
google_project_iam_member: 2
|
||||
google_project_service: 2
|
||||
google_pubsub_topic: 1
|
||||
google_pubsub_topic_iam_member: 1
|
||||
google_storage_bucket: 1
|
||||
google_storage_bucket_iam_member: 1
|
||||
modules: 6
|
||||
resources: 19
|
||||
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue