diff --git a/fast/stages/2-networking-a-peering/README.md b/fast/stages/2-networking-a-peering/README.md index 69ab7788..75c5fb66 100644 --- a/fast/stages/2-networking-a-peering/README.md +++ b/fast/stages/2-networking-a-peering/README.md @@ -403,7 +403,7 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS | [alert_config](variables.tf#L17) | Configuration for monitoring alerts. | object({…}) | | {…} | | | [custom_roles](variables.tf#L63) | Custom roles defined at the org level, in key => id format. | object({…}) | | null | 0-bootstrap | | [dns](variables.tf#L72) | Onprem DNS resolvers. | map(list(string)) | | {…} | | -| [factories_config](variables.tf#L80) | Configuration for network resource factories. | object({…}) | | {…} | | +| [factories_config](variables.tf#L80) | Configuration for network resource factories. | object({…}) | | {…} | | | [outputs_location](variables.tf#L121) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | string | | null | | | [peering_configs](variables-peerings.tf#L19) | Peering configurations. | object({…}) | | {} | | | [psa_ranges](variables.tf#L138) | IP ranges used for Private Service Access (CloudSQL, etc.). | object({…}) | | null | | diff --git a/fast/stages/2-networking-a-peering/main.tf b/fast/stages/2-networking-a-peering/main.tf index 8a47a0d5..29fcea32 100644 --- a/fast/stages/2-networking-a-peering/main.tf +++ b/fast/stages/2-networking-a-peering/main.tf @@ -52,7 +52,7 @@ module "folder" { module "firewall-policy-default" { source = "../../../modules/net-firewall-policy" - name = "net-default" + name = var.factories_config.firewall_policy_name parent_id = module.folder.id rules_factory_config = { cidr_file_path = "${var.factories_config.data_dir}/cidrs.yaml" diff --git a/fast/stages/2-networking-a-peering/variables.tf b/fast/stages/2-networking-a-peering/variables.tf index 89024258..a0ff0a79 100644 --- a/fast/stages/2-networking-a-peering/variables.tf +++ b/fast/stages/2-networking-a-peering/variables.tf @@ -82,7 +82,7 @@ variable "factories_config" { type = object({ data_dir = optional(string, "data") dns_policy_rules_file = optional(string, "data/dns-policy-rules.yaml") - firewall_policy_name = optional(string, "factory") + firewall_policy_name = optional(string, "net-default") }) default = { data_dir = "data" @@ -223,4 +223,4 @@ variable "vpn_onprem_primary_config" { })) }) default = null -} \ No newline at end of file +} diff --git a/fast/stages/2-networking-b-vpn/README.md b/fast/stages/2-networking-b-vpn/README.md index 1f43b180..e87cee14 100644 --- a/fast/stages/2-networking-b-vpn/README.md +++ b/fast/stages/2-networking-b-vpn/README.md @@ -428,7 +428,7 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS | [alert_config](variables.tf#L17) | Configuration for monitoring alerts. | object({…}) | | {…} | | | [custom_roles](variables.tf#L63) | Custom roles defined at the org level, in key => id format. | object({…}) | | null | 0-bootstrap | | [dns](variables.tf#L72) | Onprem DNS resolvers. | map(list(string)) | | {…} | | -| [factories_config](variables.tf#L80) | Configuration for network resource factories. | object({…}) | | {…} | | +| [factories_config](variables.tf#L80) | Configuration for network resource factories. | object({…}) | | {…} | | | [outputs_location](variables.tf#L121) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | string | | null | | | [psa_ranges](variables.tf#L138) | IP ranges used for Private Service Access (CloudSQL, etc.). | object({…}) | | null | | | [regions](variables.tf#L159) | Region definitions. | object({…}) | | {…} | | diff --git a/fast/stages/2-networking-b-vpn/main.tf b/fast/stages/2-networking-b-vpn/main.tf index 8a47a0d5..29fcea32 100644 --- a/fast/stages/2-networking-b-vpn/main.tf +++ b/fast/stages/2-networking-b-vpn/main.tf @@ -52,7 +52,7 @@ module "folder" { module "firewall-policy-default" { source = "../../../modules/net-firewall-policy" - name = "net-default" + name = var.factories_config.firewall_policy_name parent_id = module.folder.id rules_factory_config = { cidr_file_path = "${var.factories_config.data_dir}/cidrs.yaml" diff --git a/fast/stages/2-networking-b-vpn/variables.tf b/fast/stages/2-networking-b-vpn/variables.tf index 89024258..a0ff0a79 100644 --- a/fast/stages/2-networking-b-vpn/variables.tf +++ b/fast/stages/2-networking-b-vpn/variables.tf @@ -82,7 +82,7 @@ variable "factories_config" { type = object({ data_dir = optional(string, "data") dns_policy_rules_file = optional(string, "data/dns-policy-rules.yaml") - firewall_policy_name = optional(string, "factory") + firewall_policy_name = optional(string, "net-default") }) default = { data_dir = "data" @@ -223,4 +223,4 @@ variable "vpn_onprem_primary_config" { })) }) default = null -} \ No newline at end of file +} diff --git a/fast/stages/2-networking-c-nva/README.md b/fast/stages/2-networking-c-nva/README.md index 778de036..dfc41a0c 100644 --- a/fast/stages/2-networking-c-nva/README.md +++ b/fast/stages/2-networking-c-nva/README.md @@ -484,7 +484,7 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS | [alert_config](variables.tf#L17) | Configuration for monitoring alerts. | object({…}) | | {…} | | | [custom_roles](variables.tf#L63) | Custom roles defined at the org level, in key => id format. | object({…}) | | null | 0-bootstrap | | [dns](variables.tf#L72) | Onprem DNS resolvers. | map(list(string)) | | {…} | | -| [factories_config](variables.tf#L80) | Configuration for network resource factories. | object({…}) | | {…} | | +| [factories_config](variables.tf#L80) | Configuration for network resource factories. | object({…}) | | {…} | | | [gcp_ranges](variables.tf#L111) | GCP address ranges in name => range format. | map(string) | | {…} | | | [onprem_cidr](variables.tf#L126) | Onprem addresses in name => range format. | map(string) | | {…} | | | [outputs_location](variables.tf#L144) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | string | | null | | diff --git a/fast/stages/2-networking-c-nva/main.tf b/fast/stages/2-networking-c-nva/main.tf index aff2eaf5..d67abf1c 100644 --- a/fast/stages/2-networking-c-nva/main.tf +++ b/fast/stages/2-networking-c-nva/main.tf @@ -53,7 +53,7 @@ module "folder" { module "firewall-policy-default" { source = "../../../modules/net-firewall-policy" - name = "net-default" + name = var.factories_config.firewall_policy_name parent_id = module.folder.id rules_factory_config = { cidr_file_path = "${var.factories_config.data_dir}/cidrs.yaml" diff --git a/fast/stages/2-networking-c-nva/variables.tf b/fast/stages/2-networking-c-nva/variables.tf index c5becd21..1b4ad4ec 100644 --- a/fast/stages/2-networking-c-nva/variables.tf +++ b/fast/stages/2-networking-c-nva/variables.tf @@ -82,7 +82,7 @@ variable "factories_config" { type = object({ data_dir = optional(string, "data") dns_policy_rules_file = optional(string, "data/dns-policy-rules.yaml") - firewall_policy_name = optional(string, "factory") + firewall_policy_name = optional(string, "net-default") }) default = { data_dir = "data" @@ -289,4 +289,4 @@ variable "vpn_onprem_secondary_config" { })) }) default = null -} \ No newline at end of file +} diff --git a/fast/stages/2-networking-d-separate-envs/README.md b/fast/stages/2-networking-d-separate-envs/README.md index eae0eaf4..7514454f 100644 --- a/fast/stages/2-networking-d-separate-envs/README.md +++ b/fast/stages/2-networking-d-separate-envs/README.md @@ -346,7 +346,7 @@ Regions are defined via the `regions` variable which sets up a mapping between t | [alert_config](variables.tf#L17) | Configuration for monitoring alerts. | object({…}) | | {…} | | | [custom_roles](variables.tf#L63) | Custom roles defined at the org level, in key => id format. | object({…}) | | null | 0-bootstrap | | [dns](variables.tf#L72) | Onprem DNS resolvers. | map(list(string)) | | {…} | | -| [factories_config](variables.tf#L81) | Configuration for network resource factories. | object({…}) | | {…} | | +| [factories_config](variables.tf#L81) | Configuration for network resource factories. | object({…}) | | {…} | | | [outputs_location](variables.tf#L122) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | string | | null | | | [psa_ranges](variables.tf#L139) | IP ranges used for Private Service Access (e.g. CloudSQL). | object({…}) | | null | | | [regions](variables.tf#L160) | Region definitions. | object({…}) | | {…} | | diff --git a/fast/stages/2-networking-d-separate-envs/main.tf b/fast/stages/2-networking-d-separate-envs/main.tf index 5145e186..2c5639bc 100644 --- a/fast/stages/2-networking-d-separate-envs/main.tf +++ b/fast/stages/2-networking-d-separate-envs/main.tf @@ -48,7 +48,7 @@ module "folder" { module "firewall-policy-default" { source = "../../../modules/net-firewall-policy" - name = "net-default" + name = var.factories_config.firewall_policy_name parent_id = module.folder.id rules_factory_config = { cidr_file_path = "${var.factories_config.data_dir}/cidrs.yaml" diff --git a/fast/stages/2-networking-d-separate-envs/variables.tf b/fast/stages/2-networking-d-separate-envs/variables.tf index 52112396..29d4788a 100644 --- a/fast/stages/2-networking-d-separate-envs/variables.tf +++ b/fast/stages/2-networking-d-separate-envs/variables.tf @@ -83,7 +83,7 @@ variable "factories_config" { type = object({ data_dir = optional(string, "data") dns_policy_rules_file = optional(string, "data/dns-policy-rules.yaml") - firewall_policy_name = optional(string, "factory") + firewall_policy_name = optional(string, "net-default") }) default = { data_dir = "data" @@ -265,4 +265,4 @@ variable "vpn_onprem_prod_primary_config" { })) }) default = null -} \ No newline at end of file +} diff --git a/fast/stages/2-networking-e-nva-bgp/README.md b/fast/stages/2-networking-e-nva-bgp/README.md index 32be44b1..405ac719 100644 --- a/fast/stages/2-networking-e-nva-bgp/README.md +++ b/fast/stages/2-networking-e-nva-bgp/README.md @@ -510,7 +510,7 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS | [alert_config](variables.tf#L17) | Configuration for monitoring alerts. | object({…}) | | {…} | | | [custom_roles](variables.tf#L63) | Custom roles defined at the org level, in key => id format. | object({…}) | | null | 0-bootstrap | | [dns](variables.tf#L72) | Onprem DNS resolvers. | map(list(string)) | | {…} | | -| [factories_config](variables.tf#L80) | Configuration for network resource factories. | object({…}) | | {…} | | +| [factories_config](variables.tf#L80) | Configuration for network resource factories. | object({…}) | | {…} | | | [gcp_ranges](variables.tf#L111) | GCP address ranges in name => range format. | map(string) | | {…} | | | [ncc_asn](variables.tf#L126) | The NCC Cloud Routers ASN configuration. | map(number) | | {…} | | | [onprem_cidr](variables.tf#L137) | Onprem addresses in name => range format. | map(string) | | {…} | | diff --git a/fast/stages/2-networking-e-nva-bgp/main.tf b/fast/stages/2-networking-e-nva-bgp/main.tf index aff2eaf5..d67abf1c 100644 --- a/fast/stages/2-networking-e-nva-bgp/main.tf +++ b/fast/stages/2-networking-e-nva-bgp/main.tf @@ -53,7 +53,7 @@ module "folder" { module "firewall-policy-default" { source = "../../../modules/net-firewall-policy" - name = "net-default" + name = var.factories_config.firewall_policy_name parent_id = module.folder.id rules_factory_config = { cidr_file_path = "${var.factories_config.data_dir}/cidrs.yaml" diff --git a/fast/stages/2-networking-e-nva-bgp/variables.tf b/fast/stages/2-networking-e-nva-bgp/variables.tf index 4d4a451c..b8773041 100644 --- a/fast/stages/2-networking-e-nva-bgp/variables.tf +++ b/fast/stages/2-networking-e-nva-bgp/variables.tf @@ -82,7 +82,7 @@ variable "factories_config" { type = object({ data_dir = optional(string, "data") dns_policy_rules_file = optional(string, "data/dns-policy-rules.yaml") - firewall_policy_name = optional(string, "factory") + firewall_policy_name = optional(string, "net-default") }) default = { data_dir = "data" @@ -306,4 +306,4 @@ variable "zones" { description = "Zones in which NVAs are deployed." type = list(string) default = ["b", "c"] -} \ No newline at end of file +} diff --git a/modules/cloud-function-v2/README.md b/modules/cloud-function-v2/README.md index ca08b884..fa56fa10 100644 --- a/modules/cloud-function-v2/README.md +++ b/modules/cloud-function-v2/README.md @@ -4,6 +4,21 @@ Cloud Function management, with support for IAM roles and optional bucket creati The GCS object used for deployment uses a hash of the bundle zip contents in its name, which ensures change tracking and avoids recreating the function if the GCS object is deleted and needs recreating. + +- [TODO](#todo) +- [Examples](#examples) + - [HTTP trigger](#http-trigger) + - [PubSub and non-HTTP triggers](#pubsub-and-non-http-triggers) + - [Controlling HTTP access](#controlling-http-access) + - [GCS bucket creation](#gcs-bucket-creation) + - [Service account management](#service-account-management) + - [Custom bundle config](#custom-bundle-config) + - [Private Cloud Build Pool](#private-cloud-build-pool) + - [Multiple Cloud Functions within project](#multiple-cloud-functions-within-project) +- [Variables](#variables) +- [Outputs](#outputs) + + ## TODO - [ ] add support for `source_repository` @@ -67,7 +82,7 @@ as documented [here](https://cloud.google.com/eventarc/docs/roles-permissions#pu ### Controlling HTTP access -To allow anonymous access to the function, grant the `roles/cloudfunctions.invoker` role to the special `allUsers` identifier. Use specific identities (service accounts, groups, etc.) instead of `allUsers` to only allow selective access. +To allow anonymous access to the function, grant the `roles/run.invoker` role to the special `allUsers` identifier. Use specific identities (service accounts, groups, etc.) instead of `allUsers` to only allow selective access. The Cloud Run role needs to be used as explained in the [gcloud documentation](https://cloud.google.com/sdk/gcloud/reference/functions/add-invoker-policy-binding#DESCRIPTION). ```hcl module "cf-http" { @@ -80,7 +95,7 @@ module "cf-http" { output_path = "bundle.zip" } iam = { - "roles/cloudfunctions.invoker" = ["allUsers"] + "roles/run.invoker" = ["allUsers"] } } # tftest modules=1 resources=3 inventory=iam.yaml diff --git a/modules/cloud-function-v2/main.tf b/modules/cloud-function-v2/main.tf index 71979ee3..5b506f29 100644 --- a/modules/cloud-function-v2/main.tf +++ b/modules/cloud-function-v2/main.tf @@ -24,28 +24,17 @@ locals { : null ) ) - _iam_run_invoker_members = concat( - lookup(var.iam, "roles/run.invoker", []), - var.trigger_config == null ? [] : - var.trigger_config.service_account_create ? ["serviceAccount:${local.trigger_service_account_email}"] : [] - ) - iam = merge( - var.iam, - length(local._iam_run_invoker_members) == 0 ? {} : - { - "roles/run.invoker" : local._iam_run_invoker_members - }, - ) prefix = var.prefix == null ? "" : "${var.prefix}-" service_account_email = ( var.service_account_create ? google_service_account.service_account[0].email : var.service_account ) - trigger_service_account_email = ( - try(var.trigger_config.service_account_create, false) - ? google_service_account.trigger_service_account[0].email - : try(var.trigger_config.service_account_email, null) + trigger_sa_create = ( + try(var.trigger_config.service_account_create, false) == true + ) + trigger_sa_email = try( + google_service_account.trigger_service_account[0].email, null ) vpc_connector = ( var.vpc_connector == null @@ -104,7 +93,7 @@ resource "google_cloudfunctions2_function" "function" { operator = event_filter.value.operator } } - service_account_email = local.trigger_service_account_email + service_account_email = local.trigger_sa_email retry_policy = var.trigger_config.retry_policy } } @@ -154,8 +143,10 @@ resource "google_cloudfunctions2_function" "function" { labels = var.labels } -resource "google_cloudfunctions2_function_iam_binding" "default" { - for_each = local.iam +resource "google_cloudfunctions2_function_iam_binding" "binding" { + for_each = { + for k, v in var.iam : k => v if k != "roles/run.invoker" + } project = var.project_id location = google_cloudfunctions2_function.function.location cloud_function = google_cloudfunctions2_function.function.name @@ -163,6 +154,39 @@ resource "google_cloudfunctions2_function_iam_binding" "default" { members = each.value } +resource "google_cloud_run_service_iam_binding" "invoker" { + # cloud run resources are needed for invoker role to the underlying service + count = ( + lookup(var.iam, "roles/run.invoker", null) != null + ) ? 1 : 0 + project = var.project_id + location = google_cloudfunctions2_function.function.location + service = google_cloudfunctions2_function.function.name + role = "roles/run.invoker" + members = distinct(compact(concat( + lookup(var.iam, "roles/run.invoker", []), + ( + !local.trigger_sa_create + ? [] + : ["serviceAccount:${local.trigger_sa_email}"] + ) + ))) +} + +resource "google_cloud_run_service_iam_member" "invoker" { + # if authoritative invoker role is not present and we create trigger sa + # use additive binding to grant it the role + count = ( + lookup(var.iam, "roles/run.invoker", null) == null && + local.trigger_sa_create + ) ? 1 : 0 + project = var.project_id + location = google_cloudfunctions2_function.function.location + service = google_cloudfunctions2_function.function.name + role = "roles/run.invoker" + member = "serviceAccount:${local.trigger_sa_email}" +} + resource "google_storage_bucket" "bucket" { count = var.bucket_config == null ? 0 : 1 project = var.project_id @@ -216,9 +240,7 @@ resource "google_service_account" "service_account" { } resource "google_service_account" "trigger_service_account" { - count = ( - try(var.trigger_config.service_account_create, false) == true ? 1 : 0 - ) + count = local.trigger_sa_create ? 1 : 0 project = var.project_id account_id = "tf-cf-trigger-${var.name}" display_name = "Terraform trigger for Cloud Function ${var.name}." diff --git a/modules/cloud-function-v2/outputs.tf b/modules/cloud-function-v2/outputs.tf index 780f5c1e..4e42a002 100644 --- a/modules/cloud-function-v2/outputs.tf +++ b/modules/cloud-function-v2/outputs.tf @@ -66,14 +66,14 @@ output "trigger_service_account" { output "trigger_service_account_email" { description = "Service account email." - value = local.trigger_service_account_email + value = local.trigger_sa_email } output "trigger_service_account_iam_email" { description = "Service account email." value = join("", [ "serviceAccount:", - local.trigger_service_account_email == null ? "" : local.trigger_service_account_email + local.trigger_sa_email == null ? "" : local.trigger_sa_email ]) } diff --git a/modules/cloud-run/main.tf b/modules/cloud-run/main.tf index 527e1fd1..46f6e3a8 100644 --- a/modules/cloud-run/main.tf +++ b/modules/cloud-run/main.tf @@ -35,17 +35,6 @@ locals { "run.googleapis.com/ingress" = var.ingress_settings }, ) - _iam_run_invoker_members = concat( - lookup(var.iam, "roles/run.invoker", []), - var.eventarc_triggers.service_account_create ? ["serviceAccount:${local.trigger_service_account_email}"] : [] - ) - iam = merge( - var.iam, - length(local._iam_run_invoker_members) == 0 ? {} : - { - "roles/run.invoker" : local._iam_run_invoker_members - }, - ) prefix = var.prefix == null ? "" : "${var.prefix}-" revision_annotations = merge( try(var.revision_annotations.autoscaling, null) == null ? {} : { @@ -90,17 +79,12 @@ locals { ) : var.service_account ) - trigger_service_account_email = ( - var.eventarc_triggers.service_account_create - ? ( - length(google_service_account.trigger_service_account) > 0 - ? google_service_account.trigger_service_account[0].email - # : google_service_account.trigger_service_account[0].email # : null - : null - ) - : var.eventarc_triggers.service_account_email + trigger_sa_create = try( + var.eventarc_triggers.service_account_create, false + ) + trigger_sa_email = try( + google_service_account.trigger_service_account[0].email, null ) - vpc_connector_create = var.vpc_connector_create != null } @@ -317,12 +301,33 @@ resource "google_cloud_run_service" "service" { } resource "google_cloud_run_service_iam_binding" "binding" { - for_each = local.iam + for_each = var.iam project = google_cloud_run_service.service.project location = google_cloud_run_service.service.location service = google_cloud_run_service.service.name role = each.key - members = each.value + members = ( + each.key != "roles/run.invoker" || !local.trigger_sa_create + ? each.value + # if invoker role is present and we create trigger sa, add it as member + : concat( + each.value, ["serviceAccount:${local.trigger_sa_email}"] + ) + ) +} + +resource "google_cloud_run_service_iam_member" "default" { + # if authoritative invoker role is not present and we create trigger sa + # use additive binding to grant it the role + count = ( + lookup(var.iam, "roles/run.invoker", null) == null && + local.trigger_sa_create + ) ? 1 : 0 + project = google_cloud_run_service.service.project + location = google_cloud_run_service.service.location + service = google_cloud_run_service.service.name + role = "roles/run.invoker" + member = "serviceAccount:${local.trigger_sa_email}" } resource "google_service_account" "service_account" { @@ -355,7 +360,7 @@ resource "google_eventarc_trigger" "audit_log_triggers" { region = google_cloud_run_service.service.location } } - service_account = local.trigger_service_account_email + service_account = local.trigger_sa_email } resource "google_eventarc_trigger" "pubsub_triggers" { @@ -378,11 +383,11 @@ resource "google_eventarc_trigger" "pubsub_triggers" { region = google_cloud_run_service.service.location } } - service_account = local.trigger_service_account_email + service_account = local.trigger_sa_email } resource "google_service_account" "trigger_service_account" { - count = var.eventarc_triggers.service_account_create ? 1 : 0 # coalesce(try(var.eventarc_triggers.service_account_create, false), false) ? 1 : 0 + count = local.trigger_sa_create ? 1 : 0 project = var.project_id account_id = "tf-cr-trigger-${var.name}" display_name = "Terraform trigger for Cloud Run ${var.name}." diff --git a/tests/modules/cloud_function_v2/examples/iam.yaml b/tests/modules/cloud_function_v2/examples/iam.yaml index 6353b626..4bbd6653 100644 --- a/tests/modules/cloud_function_v2/examples/iam.yaml +++ b/tests/modules/cloud_function_v2/examples/iam.yaml @@ -13,17 +13,37 @@ # limitations under the License. values: - module.cf-http.google_cloudfunctions2_function_iam_binding.default["roles/cloudfunctions.invoker"]: - cloud_function: test-cf-http + module.cf-http.google_cloud_run_service_iam_binding.invoker[0]: condition: [] location: europe-west1 members: - allUsers project: my-project - role: roles/cloudfunctions.invoker + role: roles/run.invoker + service: test-cf-http + module.cf-http.google_cloudfunctions2_function.function: {} + module.cf-http.google_storage_bucket_object.bundle: + bucket: test-cf-bundles + cache_control: null + content: null + content_disposition: null + content_encoding: null + content_language: null + customer_encryption: [] + detect_md5hash: different hash + event_based_hold: null + metadata: null + name: bundle-6f1ece136848fee658e335b05fe2d79d.zip + source: bundle.zip + temporary_hold: null + timeouts: null counts: + google_cloud_run_service_iam_binding: 1 google_cloudfunctions2_function: 1 google_storage_bucket_object: 1 modules: 1 resources: 3 + +outputs: {} + diff --git a/tests/modules/cloud_run/examples/trigger-service-account-external.yaml b/tests/modules/cloud_run/examples/trigger-service-account-external.yaml index def9c89a..45d15ea4 100644 --- a/tests/modules/cloud_run/examples/trigger-service-account-external.yaml +++ b/tests/modules/cloud_run/examples/trigger-service-account-external.yaml @@ -13,10 +13,61 @@ # limitations under the License. values: - module.cloud_run.google_cloud_run_service.service: {} + module.cloud_run.google_cloud_run_service.service: + autogenerate_revision_name: false + location: europe-west1 + metadata: + - {} + name: hello + project: my-project + template: + - metadata: + - {} + spec: + - containers: + - args: null + command: null + env: [] + env_from: [] + image: us-docker.pkg.dev/cloudrun/container/hello + liveness_probe: [] + volume_mounts: [] + working_dir: null + volumes: [] + timeouts: null module.cloud_run.google_eventarc_trigger.audit_log_triggers["setiampolicy"]: - service_account: cloud-run-trigger@my-project.iam.gserviceaccount.com + channel: null + destination: + - cloud_function: null + cloud_run_service: + - path: null + region: europe-west1 + service: hello + gke: [] + workflow: null + event_data_content_type: null + labels: null + location: europe-west1 + matching_criteria: + - attribute: methodName + operator: '' + value: SetIamPolicy + - attribute: serviceName + operator: '' + value: cloudresourcemanager.googleapis.com + - attribute: type + operator: '' + value: google.cloud.audit.log.v1.written + name: audit-log-setiampolicy + project: my-project + service_account: null + timeouts: null counts: google_cloud_run_service: 1 google_eventarc_trigger: 1 + modules: 1 + resources: 2 + +outputs: {} + diff --git a/tests/modules/cloud_run/examples/trigger-service-account.yaml b/tests/modules/cloud_run/examples/trigger-service-account.yaml index 86b1e1af..92b8fce8 100644 --- a/tests/modules/cloud_run/examples/trigger-service-account.yaml +++ b/tests/modules/cloud_run/examples/trigger-service-account.yaml @@ -13,23 +13,95 @@ # limitations under the License. values: - module.cloud_run.google_cloud_run_service.service: {} - module.cloud_run.google_cloud_run_service_iam_binding.binding["roles/run.invoker"]: + module.cloud_run.google_cloud_run_service.service: + autogenerate_revision_name: false + location: europe-west1 + metadata: + - {} + name: hello + project: my-project + template: + - metadata: + - {} + spec: + - containers: + - args: null + command: null + env: [] + env_from: [] + image: us-docker.pkg.dev/cloudrun/container/hello + liveness_probe: [] + volume_mounts: [] + working_dir: null + volumes: [] + timeouts: null + module.cloud_run.google_cloud_run_service_iam_member.default[0]: + condition: [] + location: europe-west1 project: my-project role: roles/run.invoker service: hello - # members: ["known after apply"] - module.cloud_run.google_eventarc_trigger.pubsub_triggers["topic-1"]: {} - # service_account: known after apply - module.cloud_run.google_eventarc_trigger.pubsub_triggers["topic-2"]: {} - # service_account: known after apply + module.cloud_run.google_eventarc_trigger.pubsub_triggers["topic-1"]: + channel: null + destination: + - cloud_function: null + cloud_run_service: + - path: null + region: europe-west1 + service: hello + gke: [] + workflow: null + event_data_content_type: null + labels: null + location: europe-west1 + matching_criteria: + - attribute: type + operator: '' + value: google.cloud.pubsub.topic.v1.messagePublished + name: pubsub-topic-1 + project: my-project + timeouts: null + transport: + - pubsub: + - topic: topic1 + module.cloud_run.google_eventarc_trigger.pubsub_triggers["topic-2"]: + channel: null + destination: + - cloud_function: null + cloud_run_service: + - path: null + region: europe-west1 + service: hello + gke: [] + workflow: null + event_data_content_type: null + labels: null + location: europe-west1 + matching_criteria: + - attribute: type + operator: '' + value: google.cloud.pubsub.topic.v1.messagePublished + name: pubsub-topic-2 + project: my-project + timeouts: null + transport: + - pubsub: + - topic: topic2 module.cloud_run.google_service_account.trigger_service_account[0]: account_id: tf-cr-trigger-hello + description: null + disabled: false display_name: Terraform trigger for Cloud Run hello. project: my-project + timeouts: null counts: google_cloud_run_service: 1 - google_cloud_run_service_iam_binding: 1 + google_cloud_run_service_iam_member: 1 google_eventarc_trigger: 2 google_service_account: 1 + modules: 1 + resources: 5 + +outputs: {} +