Update project/folder/module to use new org policies API and tf1.3 optionals.
This commit is contained in:
parent
9622635d15
commit
b23d07b0c6
|
@ -259,7 +259,7 @@ module "folder" {
|
||||||
| [iam.tf](./iam.tf) | IAM bindings, roles and audit logging resources. | <code>google_folder_iam_binding</code> · <code>google_folder_iam_member</code> |
|
| [iam.tf](./iam.tf) | IAM bindings, roles and audit logging resources. | <code>google_folder_iam_binding</code> · <code>google_folder_iam_member</code> |
|
||||||
| [logging.tf](./logging.tf) | Log sinks and supporting resources. | <code>google_bigquery_dataset_iam_member</code> · <code>google_logging_folder_exclusion</code> · <code>google_logging_folder_sink</code> · <code>google_project_iam_member</code> · <code>google_pubsub_topic_iam_member</code> · <code>google_storage_bucket_iam_member</code> |
|
| [logging.tf](./logging.tf) | Log sinks and supporting resources. | <code>google_bigquery_dataset_iam_member</code> · <code>google_logging_folder_exclusion</code> · <code>google_logging_folder_sink</code> · <code>google_project_iam_member</code> · <code>google_pubsub_topic_iam_member</code> · <code>google_storage_bucket_iam_member</code> |
|
||||||
| [main.tf](./main.tf) | Module-level locals and resources. | <code>google_essential_contacts_contact</code> · <code>google_folder</code> |
|
| [main.tf](./main.tf) | Module-level locals and resources. | <code>google_essential_contacts_contact</code> · <code>google_folder</code> |
|
||||||
| [organization-policies.tf](./organization-policies.tf) | Folder-level organization policies. | <code>google_folder_organization_policy</code> |
|
| [organization-policies.tf](./organization-policies.tf) | Project-level organization policies. | <code>google_org_policy_policy</code> |
|
||||||
| [outputs.tf](./outputs.tf) | Module outputs. | |
|
| [outputs.tf](./outputs.tf) | Module outputs. | |
|
||||||
| [tags.tf](./tags.tf) | None | <code>google_tags_tag_binding</code> |
|
| [tags.tf](./tags.tf) | None | <code>google_tags_tag_binding</code> |
|
||||||
| [variables.tf](./variables.tf) | Module variables. | |
|
| [variables.tf](./variables.tf) | Module variables. | |
|
||||||
|
@ -282,10 +282,9 @@ module "folder" {
|
||||||
| [logging_exclusions](variables.tf#L98) | Logging exclusions for this folder in the form {NAME -> FILTER}. | <code>map(string)</code> | | <code>{}</code> |
|
| [logging_exclusions](variables.tf#L98) | Logging exclusions for this folder in the form {NAME -> FILTER}. | <code>map(string)</code> | | <code>{}</code> |
|
||||||
| [logging_sinks](variables.tf#L105) | Logging sinks to create for this folder. | <code title="map(object({ destination = string type = string filter = string include_children = bool exclusions = map(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
| [logging_sinks](variables.tf#L105) | Logging sinks to create for this folder. | <code title="map(object({ destination = string type = string filter = string include_children = bool exclusions = map(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||||
| [name](variables.tf#L126) | Folder name. | <code>string</code> | | <code>null</code> |
|
| [name](variables.tf#L126) | Folder name. | <code>string</code> | | <code>null</code> |
|
||||||
| [parent](variables.tf#L132) | Parent in folders/folder_id or organizations/org_id format. | <code>string</code> | | <code>null</code> |
|
| [org_policies](variables.tf#L132) | Organization policies applied to this folder keyed by policy name. | <code title="map(object({ inherit_from_parent = optional(bool) # for list policies only. reset = optional(bool) allow = optional(object({ all = optional(bool) values = optional(list(string)) })) deny = optional(object({ all = optional(bool) values = optional(list(string)) })) enforce = optional(bool, true) # for boolean policies only. rules = optional(list(object({ allow = optional(object({ all = optional(bool) values = optional(list(string)) })) deny = optional(object({ all = optional(bool) values = optional(list(string)) })) enforce = optional(bool, true) # for boolean policies only. condition = object({ description = optional(string) expression = optional(string) location = optional(string) title = optional(string) }) })), []) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||||
| [policy_boolean](variables.tf#L142) | Map of boolean org policies and enforcement value, set value to null for policy restore. | <code>map(bool)</code> | | <code>{}</code> |
|
| [parent](variables.tf#L172) | Parent in folders/folder_id or organizations/org_id format. | <code>string</code> | | <code>null</code> |
|
||||||
| [policy_list](variables.tf#L149) | Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny. | <code title="map(object({ inherit_from_parent = bool suggested_value = string status = bool values = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
| [tag_bindings](variables.tf#L182) | Tag bindings for this folder, in key => tag value id format. | <code>map(string)</code> | | <code>null</code> |
|
||||||
| [tag_bindings](variables.tf#L161) | Tag bindings for this folder, in key => tag value id format. | <code>map(string)</code> | | <code>null</code> |
|
|
||||||
|
|
||||||
## Outputs
|
## Outputs
|
||||||
|
|
||||||
|
@ -295,7 +294,7 @@ module "folder" {
|
||||||
| [firewall_policy_id](outputs.tf#L21) | Map of firewall policy ids created in this folder. | |
|
| [firewall_policy_id](outputs.tf#L21) | Map of firewall policy ids created in this folder. | |
|
||||||
| [folder](outputs.tf#L26) | Folder resource. | |
|
| [folder](outputs.tf#L26) | Folder resource. | |
|
||||||
| [id](outputs.tf#L31) | Folder id. | |
|
| [id](outputs.tf#L31) | Folder id. | |
|
||||||
| [name](outputs.tf#L41) | Folder name. | |
|
| [name](outputs.tf#L40) | Folder name. | |
|
||||||
| [sink_writer_identities](outputs.tf#L46) | Writer identities created for each sink. | |
|
| [sink_writer_identities](outputs.tf#L45) | Writer identities created for each sink. | |
|
||||||
|
|
||||||
<!-- END TFDOC -->
|
<!-- END TFDOC -->
|
||||||
|
|
|
@ -16,75 +16,97 @@
|
||||||
|
|
||||||
# tfdoc:file:description Folder-level organization policies.
|
# tfdoc:file:description Folder-level organization policies.
|
||||||
|
|
||||||
resource "google_folder_organization_policy" "boolean" {
|
/**
|
||||||
for_each = var.policy_boolean
|
* Copyright 2022 Google LLC
|
||||||
folder = local.folder.name
|
*
|
||||||
constraint = each.key
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
dynamic "boolean_policy" {
|
# tfdoc:file:description Project-level organization policies.
|
||||||
for_each = each.value == null ? [] : [each.value]
|
|
||||||
iterator = policy
|
|
||||||
content {
|
|
||||||
enforced = policy.value
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
dynamic "restore_policy" {
|
locals {
|
||||||
for_each = each.value == null ? [""] : []
|
org_policies = {
|
||||||
content {
|
for k, v in var.org_policies :
|
||||||
default = true
|
k => merge(v, {
|
||||||
}
|
is_boolean_policy = v.allow == null && v.deny == null
|
||||||
|
has_values = (
|
||||||
|
length(coalesce(try(v.allow.values, []), [])) > 0 ||
|
||||||
|
length(coalesce(try(v.deny.values, []), [])) > 0
|
||||||
|
)
|
||||||
|
rules = [
|
||||||
|
for r in v.rules :
|
||||||
|
merge(r, {
|
||||||
|
has_values = (
|
||||||
|
length(coalesce(try(r.allow.values, []), [])) > 0 ||
|
||||||
|
length(coalesce(try(r.deny.values, []), [])) > 0
|
||||||
|
)
|
||||||
|
})
|
||||||
|
]
|
||||||
|
})
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "google_folder_organization_policy" "list" {
|
resource "google_org_policy_policy" "default" {
|
||||||
for_each = var.policy_list
|
for_each = local.org_policies
|
||||||
folder = local.folder.name
|
name = "${local.folder.name}/policies/${each.key}"
|
||||||
constraint = each.key
|
parent = local.folder.name
|
||||||
|
|
||||||
dynamic "list_policy" {
|
spec {
|
||||||
for_each = each.value.status == null ? [] : [each.value]
|
inherit_from_parent = each.value.inherit_from_parent
|
||||||
iterator = policy
|
reset = each.value.reset
|
||||||
content {
|
|
||||||
inherit_from_parent = policy.value.inherit_from_parent
|
rules {
|
||||||
suggested_value = policy.value.suggested_value
|
allow_all = try(each.value.allow.all, null) == true ? "TRUE" : null
|
||||||
dynamic "allow" {
|
deny_all = try(each.value.deny.all, null) == true ? "TRUE" : null
|
||||||
for_each = policy.value.status ? [""] : []
|
enforce = (
|
||||||
content {
|
each.value.is_boolean_policy && each.value.enforce != null
|
||||||
values = (
|
? upper(tostring(each.value.enforce))
|
||||||
try(length(policy.value.values) > 0, false)
|
|
||||||
? policy.value.values
|
|
||||||
: null
|
: null
|
||||||
)
|
)
|
||||||
all = (
|
dynamic "values" {
|
||||||
try(length(policy.value.values) > 0, false)
|
for_each = each.value.has_values ? [1] : []
|
||||||
? null
|
|
||||||
: true
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
dynamic "deny" {
|
|
||||||
for_each = policy.value.status ? [] : [""]
|
|
||||||
content {
|
content {
|
||||||
values = (
|
allowed_values = try(each.value.allow.values, null)
|
||||||
try(length(policy.value.values) > 0, false)
|
denied_values = try(each.value.deny.values, null)
|
||||||
? policy.value.values
|
|
||||||
: null
|
|
||||||
)
|
|
||||||
all = (
|
|
||||||
try(length(policy.value.values) > 0, false)
|
|
||||||
? null
|
|
||||||
: true
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
dynamic "restore_policy" {
|
dynamic "rules" {
|
||||||
for_each = each.value.status == null ? [true] : []
|
for_each = each.value.rules
|
||||||
|
iterator = rule
|
||||||
content {
|
content {
|
||||||
default = true
|
allow_all = try(rule.value.allow.all, false) == true ? "TRUE" : null
|
||||||
|
deny_all = try(rule.value.deny.all, false) == true ? "TRUE" : null
|
||||||
|
enforce = (
|
||||||
|
each.value.is_boolean_policy && rule.value.enforce != null
|
||||||
|
? upper(tostring(rule.value.enforce))
|
||||||
|
: null
|
||||||
|
)
|
||||||
|
condition {
|
||||||
|
description = rule.value.condition.description
|
||||||
|
expression = rule.value.condition.expression
|
||||||
|
location = rule.value.condition.location
|
||||||
|
title = rule.value.condition.title
|
||||||
|
}
|
||||||
|
dynamic "values" {
|
||||||
|
for_each = rule.value.has_values ? [1] : [0]
|
||||||
|
content {
|
||||||
|
allowed_values = try(rule.value.allow.values, null)
|
||||||
|
denied_values = try(rule.value.deny.values, null)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -33,8 +33,7 @@ output "id" {
|
||||||
value = local.folder.name
|
value = local.folder.name
|
||||||
depends_on = [
|
depends_on = [
|
||||||
google_folder_iam_binding.authoritative,
|
google_folder_iam_binding.authoritative,
|
||||||
google_folder_organization_policy.boolean,
|
google_org_policy_policy.default,
|
||||||
google_folder_organization_policy.list
|
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -129,6 +129,46 @@ variable "name" {
|
||||||
default = null
|
default = null
|
||||||
}
|
}
|
||||||
|
|
||||||
|
variable "org_policies" {
|
||||||
|
description = "Organization policies applied to this folder keyed by policy name."
|
||||||
|
type = map(object({
|
||||||
|
inherit_from_parent = optional(bool) # for list policies only.
|
||||||
|
reset = optional(bool)
|
||||||
|
|
||||||
|
# default (unconditional) values
|
||||||
|
allow = optional(object({
|
||||||
|
all = optional(bool)
|
||||||
|
values = optional(list(string))
|
||||||
|
}))
|
||||||
|
deny = optional(object({
|
||||||
|
all = optional(bool)
|
||||||
|
values = optional(list(string))
|
||||||
|
}))
|
||||||
|
enforce = optional(bool, true) # for boolean policies only.
|
||||||
|
|
||||||
|
# conditional values
|
||||||
|
rules = optional(list(object({
|
||||||
|
allow = optional(object({
|
||||||
|
all = optional(bool)
|
||||||
|
values = optional(list(string))
|
||||||
|
}))
|
||||||
|
deny = optional(object({
|
||||||
|
all = optional(bool)
|
||||||
|
values = optional(list(string))
|
||||||
|
}))
|
||||||
|
enforce = optional(bool, true) # for boolean policies only.
|
||||||
|
condition = object({
|
||||||
|
description = optional(string)
|
||||||
|
expression = optional(string)
|
||||||
|
location = optional(string)
|
||||||
|
title = optional(string)
|
||||||
|
})
|
||||||
|
})), [])
|
||||||
|
}))
|
||||||
|
default = {}
|
||||||
|
nullable = false
|
||||||
|
}
|
||||||
|
|
||||||
variable "parent" {
|
variable "parent" {
|
||||||
description = "Parent in folders/folder_id or organizations/org_id format."
|
description = "Parent in folders/folder_id or organizations/org_id format."
|
||||||
type = string
|
type = string
|
||||||
|
@ -139,25 +179,6 @@ variable "parent" {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "policy_boolean" {
|
|
||||||
description = "Map of boolean org policies and enforcement value, set value to null for policy restore."
|
|
||||||
type = map(bool)
|
|
||||||
default = {}
|
|
||||||
nullable = false
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "policy_list" {
|
|
||||||
description = "Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny."
|
|
||||||
type = map(object({
|
|
||||||
inherit_from_parent = bool
|
|
||||||
suggested_value = string
|
|
||||||
status = bool
|
|
||||||
values = list(string)
|
|
||||||
}))
|
|
||||||
default = {}
|
|
||||||
nullable = false
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "tag_bindings" {
|
variable "tag_bindings" {
|
||||||
description = "Tag bindings for this folder, in key => tag value id format."
|
description = "Tag bindings for this folder, in key => tag value id format."
|
||||||
type = map(string)
|
type = map(string)
|
||||||
|
|
|
@ -9,7 +9,7 @@
|
||||||
*
|
*
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
* WITHOUT WARRANTIES OR CONDITIONSOF ANY KIND, either express or implied.
|
||||||
* See the License for the specific language governing permissions and
|
* See the License for the specific language governing permissions and
|
||||||
* limitations under the License.
|
* limitations under the License.
|
||||||
*/
|
*/
|
||||||
|
|
|
@ -281,7 +281,7 @@ module "org" {
|
||||||
| [iam.tf](./iam.tf) | IAM bindings, roles and audit logging resources. | <code>google_organization_iam_audit_config</code> · <code>google_organization_iam_binding</code> · <code>google_organization_iam_custom_role</code> · <code>google_organization_iam_member</code> · <code>google_organization_iam_policy</code> |
|
| [iam.tf](./iam.tf) | IAM bindings, roles and audit logging resources. | <code>google_organization_iam_audit_config</code> · <code>google_organization_iam_binding</code> · <code>google_organization_iam_custom_role</code> · <code>google_organization_iam_member</code> · <code>google_organization_iam_policy</code> |
|
||||||
| [logging.tf](./logging.tf) | Log sinks and supporting resources. | <code>google_bigquery_dataset_iam_member</code> · <code>google_logging_organization_exclusion</code> · <code>google_logging_organization_sink</code> · <code>google_project_iam_member</code> · <code>google_pubsub_topic_iam_member</code> · <code>google_storage_bucket_iam_member</code> |
|
| [logging.tf](./logging.tf) | Log sinks and supporting resources. | <code>google_bigquery_dataset_iam_member</code> · <code>google_logging_organization_exclusion</code> · <code>google_logging_organization_sink</code> · <code>google_project_iam_member</code> · <code>google_pubsub_topic_iam_member</code> · <code>google_storage_bucket_iam_member</code> |
|
||||||
| [main.tf](./main.tf) | Module-level locals and resources. | <code>google_essential_contacts_contact</code> |
|
| [main.tf](./main.tf) | Module-level locals and resources. | <code>google_essential_contacts_contact</code> |
|
||||||
| [organization-policies.tf](./organization-policies.tf) | Organization-level organization policies. | <code>google_organization_policy</code> |
|
| [organization-policies.tf](./organization-policies.tf) | Project-level organization policies. | <code>google_org_policy_policy</code> |
|
||||||
| [outputs.tf](./outputs.tf) | Module outputs. | |
|
| [outputs.tf](./outputs.tf) | Module outputs. | |
|
||||||
| [tags.tf](./tags.tf) | None | <code>google_tags_tag_binding</code> · <code>google_tags_tag_key</code> · <code>google_tags_tag_key_iam_binding</code> · <code>google_tags_tag_value</code> · <code>google_tags_tag_value_iam_binding</code> |
|
| [tags.tf](./tags.tf) | None | <code>google_tags_tag_binding</code> · <code>google_tags_tag_key</code> · <code>google_tags_tag_key_iam_binding</code> · <code>google_tags_tag_value</code> · <code>google_tags_tag_value_iam_binding</code> |
|
||||||
| [variables.tf](./variables.tf) | Module variables. | |
|
| [variables.tf](./variables.tf) | Module variables. | |
|
||||||
|
@ -306,10 +306,9 @@ module "org" {
|
||||||
| [iam_bindings_authoritative](variables.tf#L116) | IAM authoritative bindings, in {ROLE => [MEMBERS]} format. Roles and members not explicitly listed will be cleared. Bindings should also be authoritative when using authoritative audit config. Use with caution. | <code>map(list(string))</code> | | <code>null</code> |
|
| [iam_bindings_authoritative](variables.tf#L116) | IAM authoritative bindings, in {ROLE => [MEMBERS]} format. Roles and members not explicitly listed will be cleared. Bindings should also be authoritative when using authoritative audit config. Use with caution. | <code>map(list(string))</code> | | <code>null</code> |
|
||||||
| [logging_exclusions](variables.tf#L122) | Logging exclusions for this organization in the form {NAME -> FILTER}. | <code>map(string)</code> | | <code>{}</code> |
|
| [logging_exclusions](variables.tf#L122) | Logging exclusions for this organization in the form {NAME -> FILTER}. | <code>map(string)</code> | | <code>{}</code> |
|
||||||
| [logging_sinks](variables.tf#L129) | Logging sinks to create for this organization. | <code title="map(object({ destination = string type = string filter = string include_children = bool bq_partitioned_table = bool exclusions = map(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
| [logging_sinks](variables.tf#L129) | Logging sinks to create for this organization. | <code title="map(object({ destination = string type = string filter = string include_children = bool bq_partitioned_table = bool exclusions = map(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||||
| [policy_boolean](variables.tf#L160) | Map of boolean org policies and enforcement value, set value to null for policy restore. | <code>map(bool)</code> | | <code>{}</code> |
|
| [org_policies](variables.tf#L160) | Organization policies applied to this organization keyed by policy name. | <code title="map(object({ inherit_from_parent = optional(bool) # for list policies only. reset = optional(bool) allow = optional(object({ all = optional(bool) values = optional(list(string)) })) deny = optional(object({ all = optional(bool) values = optional(list(string)) })) enforce = optional(bool, true) # for boolean policies only. rules = optional(list(object({ allow = optional(object({ all = optional(bool) values = optional(list(string)) })) deny = optional(object({ all = optional(bool) values = optional(list(string)) })) enforce = optional(bool, true) # for boolean policies only. condition = object({ description = optional(string) expression = optional(string) location = optional(string) title = optional(string) }) })), []) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||||
| [policy_list](variables.tf#L167) | Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny. | <code title="map(object({ inherit_from_parent = bool suggested_value = string status = bool values = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
| [tag_bindings](variables.tf#L200) | Tag bindings for this organization, in key => tag value id format. | <code>map(string)</code> | | <code>null</code> |
|
||||||
| [tag_bindings](variables.tf#L179) | Tag bindings for this organization, in key => tag value id format. | <code>map(string)</code> | | <code>null</code> |
|
| [tags](variables.tf#L206) | Tags by key name. The `iam` attribute behaves like the similarly named one at module level. | <code title="map(object({ description = string iam = map(list(string)) values = map(object({ description = string iam = map(list(string)) })) }))">map(object({…}))</code> | | <code>null</code> |
|
||||||
| [tags](variables.tf#L185) | Tags by key name. The `iam` attribute behaves like the similarly named one at module level. | <code title="map(object({ description = string iam = map(list(string)) values = map(object({ description = string iam = map(list(string)) })) }))">map(object({…}))</code> | | <code>null</code> |
|
|
||||||
|
|
||||||
## Outputs
|
## Outputs
|
||||||
|
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
/**
|
s/**
|
||||||
* Copyright 2022 Google LLC
|
* Copyright 2022 Google LLC
|
||||||
*
|
*
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
@ -16,83 +16,98 @@
|
||||||
|
|
||||||
# tfdoc:file:description Organization-level organization policies.
|
# tfdoc:file:description Organization-level organization policies.
|
||||||
|
|
||||||
resource "google_organization_policy" "boolean" {
|
|
||||||
for_each = var.policy_boolean
|
|
||||||
org_id = local.organization_id_numeric
|
|
||||||
constraint = each.key
|
|
||||||
|
|
||||||
dynamic "boolean_policy" {
|
/**
|
||||||
for_each = each.value == null ? [] : [each.value]
|
* Copyright 2022 Google LLC
|
||||||
iterator = policy
|
*
|
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
# tfdoc:file:description Project-level organization policies.
|
||||||
|
|
||||||
|
locals {
|
||||||
|
org_policies = {
|
||||||
|
for k, v in var.org_policies :
|
||||||
|
k => merge(v, {
|
||||||
|
is_boolean_policy = v.allow == null && v.deny == null
|
||||||
|
has_values = (
|
||||||
|
length(coalesce(try(v.allow.values, []), [])) > 0 ||
|
||||||
|
length(coalesce(try(v.deny.values, []), [])) > 0
|
||||||
|
)
|
||||||
|
rules = [
|
||||||
|
for r in v.rules :
|
||||||
|
merge(r, {
|
||||||
|
has_values = (
|
||||||
|
length(coalesce(try(r.allow.values, []), [])) > 0 ||
|
||||||
|
length(coalesce(try(r.deny.values, []), [])) > 0
|
||||||
|
)
|
||||||
|
})
|
||||||
|
]
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_org_policy_policy" "default" {
|
||||||
|
for_each = local.org_policies
|
||||||
|
name = "${local.organization_id}/policies/${each.key}"
|
||||||
|
parent = "${local.organiza}"
|
||||||
|
|
||||||
|
spec {
|
||||||
|
inherit_from_parent = each.value.inherit_from_parent
|
||||||
|
reset = each.value.reset
|
||||||
|
|
||||||
|
rules {
|
||||||
|
allow_all = try(each.value.allow.all, null) == true ? "TRUE" : null
|
||||||
|
deny_all = try(each.value.deny.all, null) == true ? "TRUE" : null
|
||||||
|
enforce = (
|
||||||
|
each.value.is_boolean_policy && each.value.enforce != null
|
||||||
|
? upper(tostring(each.value.enforce))
|
||||||
|
: null
|
||||||
|
)
|
||||||
|
dynamic "values" {
|
||||||
|
for_each = each.value.has_values ? [1] : []
|
||||||
content {
|
content {
|
||||||
enforced = policy.value
|
allowed_values = try(each.value.allow.values, null)
|
||||||
|
denied_values = try(each.value.deny.values, null)
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
dynamic "restore_policy" {
|
dynamic "rules" {
|
||||||
for_each = each.value == null ? [""] : []
|
for_each = each.value.rules
|
||||||
|
iterator = rule
|
||||||
content {
|
content {
|
||||||
default = true
|
allow_all = try(rule.value.allow.all, false) == true ? "TRUE" : null
|
||||||
}
|
deny_all = try(rule.value.deny.all, false) == true ? "TRUE" : null
|
||||||
}
|
enforce = (
|
||||||
|
each.value.is_boolean_policy && rule.value.enforce != null
|
||||||
depends_on = [
|
? upper(tostring(rule.value.enforce))
|
||||||
google_organization_iam_audit_config.config,
|
: null
|
||||||
google_organization_iam_binding.authoritative,
|
)
|
||||||
google_organization_iam_custom_role.roles,
|
condition {
|
||||||
google_organization_iam_member.additive,
|
description = rule.value.condition.description
|
||||||
google_organization_iam_policy.authoritative,
|
expression = rule.value.condition.expression
|
||||||
]
|
location = rule.value.condition.location
|
||||||
}
|
title = rule.value.condition.title
|
||||||
|
}
|
||||||
resource "google_organization_policy" "list" {
|
dynamic "values" {
|
||||||
for_each = var.policy_list
|
for_each = rule.value.has_values ? [1] : [0]
|
||||||
org_id = local.organization_id_numeric
|
content {
|
||||||
constraint = each.key
|
allowed_values = try(rule.value.allow.values, null)
|
||||||
|
denied_values = try(rule.value.deny.values, null)
|
||||||
dynamic "list_policy" {
|
}
|
||||||
for_each = each.value.status == null ? [] : [each.value]
|
}
|
||||||
iterator = policy
|
}
|
||||||
content {
|
|
||||||
inherit_from_parent = policy.value.inherit_from_parent
|
|
||||||
suggested_value = policy.value.suggested_value
|
|
||||||
dynamic "allow" {
|
|
||||||
for_each = policy.value.status ? [""] : []
|
|
||||||
content {
|
|
||||||
values = (
|
|
||||||
try(length(policy.value.values) > 0, false)
|
|
||||||
? policy.value.values
|
|
||||||
: null
|
|
||||||
)
|
|
||||||
all = (
|
|
||||||
try(length(policy.value.values) > 0, false)
|
|
||||||
? null
|
|
||||||
: true
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
dynamic "deny" {
|
|
||||||
for_each = policy.value.status ? [] : [""]
|
|
||||||
content {
|
|
||||||
values = (
|
|
||||||
try(length(policy.value.values) > 0, false)
|
|
||||||
? policy.value.values
|
|
||||||
: null
|
|
||||||
)
|
|
||||||
all = (
|
|
||||||
try(length(policy.value.values) > 0, false)
|
|
||||||
? null
|
|
||||||
: true
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
dynamic "restore_policy" {
|
|
||||||
for_each = each.value.status == null ? [true] : []
|
|
||||||
content {
|
|
||||||
default = true
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -103,4 +118,5 @@ resource "google_organization_policy" "list" {
|
||||||
google_organization_iam_member.additive,
|
google_organization_iam_member.additive,
|
||||||
google_organization_iam_policy.authoritative,
|
google_organization_iam_policy.authoritative,
|
||||||
]
|
]
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -157,20 +157,41 @@ variable "organization_id" {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "policy_boolean" {
|
variable "org_policies" {
|
||||||
description = "Map of boolean org policies and enforcement value, set value to null for policy restore."
|
description = "Organization policies applied to this organization keyed by policy name."
|
||||||
type = map(bool)
|
|
||||||
default = {}
|
|
||||||
nullable = false
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "policy_list" {
|
|
||||||
description = "Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny."
|
|
||||||
type = map(object({
|
type = map(object({
|
||||||
inherit_from_parent = bool
|
inherit_from_parent = optional(bool) # for list policies only.
|
||||||
suggested_value = string
|
reset = optional(bool)
|
||||||
status = bool
|
|
||||||
values = list(string)
|
# default (unconditional) values
|
||||||
|
allow = optional(object({
|
||||||
|
all = optional(bool)
|
||||||
|
values = optional(list(string))
|
||||||
|
}))
|
||||||
|
deny = optional(object({
|
||||||
|
all = optional(bool)
|
||||||
|
values = optional(list(string))
|
||||||
|
}))
|
||||||
|
enforce = optional(bool, true) # for boolean policies only.
|
||||||
|
|
||||||
|
# conditional values
|
||||||
|
rules = optional(list(object({
|
||||||
|
allow = optional(object({
|
||||||
|
all = optional(bool)
|
||||||
|
values = optional(list(string))
|
||||||
|
}))
|
||||||
|
deny = optional(object({
|
||||||
|
all = optional(bool)
|
||||||
|
values = optional(list(string))
|
||||||
|
}))
|
||||||
|
enforce = optional(bool, true) # for boolean policies only.
|
||||||
|
condition = object({
|
||||||
|
description = optional(string)
|
||||||
|
expression = optional(string)
|
||||||
|
location = optional(string)
|
||||||
|
title = optional(string)
|
||||||
|
})
|
||||||
|
})), [])
|
||||||
}))
|
}))
|
||||||
default = {}
|
default = {}
|
||||||
nullable = false
|
nullable = false
|
||||||
|
|
|
@ -349,7 +349,7 @@ output "compute_robot" {
|
||||||
| [iam.tf](./iam.tf) | Generic and OSLogin-specific IAM bindings and roles. | <code>google_project_iam_binding</code> · <code>google_project_iam_custom_role</code> · <code>google_project_iam_member</code> |
|
| [iam.tf](./iam.tf) | Generic and OSLogin-specific IAM bindings and roles. | <code>google_project_iam_binding</code> · <code>google_project_iam_custom_role</code> · <code>google_project_iam_member</code> |
|
||||||
| [logging.tf](./logging.tf) | Log sinks and supporting resources. | <code>google_bigquery_dataset_iam_member</code> · <code>google_logging_project_exclusion</code> · <code>google_logging_project_sink</code> · <code>google_project_iam_member</code> · <code>google_pubsub_topic_iam_member</code> · <code>google_storage_bucket_iam_member</code> |
|
| [logging.tf](./logging.tf) | Log sinks and supporting resources. | <code>google_bigquery_dataset_iam_member</code> · <code>google_logging_project_exclusion</code> · <code>google_logging_project_sink</code> · <code>google_project_iam_member</code> · <code>google_pubsub_topic_iam_member</code> · <code>google_storage_bucket_iam_member</code> |
|
||||||
| [main.tf](./main.tf) | Module-level locals and resources. | <code>google_compute_project_metadata_item</code> · <code>google_essential_contacts_contact</code> · <code>google_monitoring_monitored_project</code> · <code>google_project</code> · <code>google_project_service</code> · <code>google_resource_manager_lien</code> |
|
| [main.tf](./main.tf) | Module-level locals and resources. | <code>google_compute_project_metadata_item</code> · <code>google_essential_contacts_contact</code> · <code>google_monitoring_monitored_project</code> · <code>google_project</code> · <code>google_project_service</code> · <code>google_resource_manager_lien</code> |
|
||||||
| [organization-policies.tf](./organization-policies.tf) | Project-level organization policies. | <code>google_project_organization_policy</code> |
|
| [organization-policies.tf](./organization-policies.tf) | Project-level organization policies. | <code>google_org_policy_policy</code> |
|
||||||
| [outputs.tf](./outputs.tf) | Module outputs. | |
|
| [outputs.tf](./outputs.tf) | Module outputs. | |
|
||||||
| [service-accounts.tf](./service-accounts.tf) | Service identities and supporting resources. | <code>google_kms_crypto_key_iam_member</code> · <code>google_project_default_service_accounts</code> · <code>google_project_iam_member</code> · <code>google_project_service_identity</code> |
|
| [service-accounts.tf](./service-accounts.tf) | Service identities and supporting resources. | <code>google_kms_crypto_key_iam_member</code> · <code>google_project_default_service_accounts</code> · <code>google_project_iam_member</code> · <code>google_project_service_identity</code> |
|
||||||
| [shared-vpc.tf](./shared-vpc.tf) | Shared VPC project-level configuration. | <code>google_compute_shared_vpc_host_project</code> · <code>google_compute_shared_vpc_service_project</code> · <code>google_project_iam_member</code> |
|
| [shared-vpc.tf](./shared-vpc.tf) | Shared VPC project-level configuration. | <code>google_compute_shared_vpc_host_project</code> · <code>google_compute_shared_vpc_service_project</code> · <code>google_project_iam_member</code> |
|
||||||
|
@ -367,8 +367,8 @@ output "compute_robot" {
|
||||||
| [billing_account](variables.tf#L23) | Billing account id. | <code>string</code> | | <code>null</code> |
|
| [billing_account](variables.tf#L23) | Billing account id. | <code>string</code> | | <code>null</code> |
|
||||||
| [contacts](variables.tf#L29) | List of essential contacts for this resource. Must be in the form EMAIL -> [NOTIFICATION_TYPES]. Valid notification types are ALL, SUSPENSION, SECURITY, TECHNICAL, BILLING, LEGAL, PRODUCT_UPDATES. | <code>map(list(string))</code> | | <code>{}</code> |
|
| [contacts](variables.tf#L29) | List of essential contacts for this resource. Must be in the form EMAIL -> [NOTIFICATION_TYPES]. Valid notification types are ALL, SUSPENSION, SECURITY, TECHNICAL, BILLING, LEGAL, PRODUCT_UPDATES. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
| [custom_roles](variables.tf#L36) | Map of role name => list of permissions to create in this project. | <code>map(list(string))</code> | | <code>{}</code> |
|
| [custom_roles](variables.tf#L36) | Map of role name => list of permissions to create in this project. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
| [default_service_account](variables.tf#L49) | Project default service account setting: can be one of `delete`, `deprivilege`, `disable`, or `keep`. | <code>string</code> | | <code>"keep"</code> |
|
| [default_service_account](variables.tf#L43) | Project default service account setting: can be one of `delete`, `deprivilege`, `disable`, or `keep`. | <code>string</code> | | <code>"keep"</code> |
|
||||||
| [descriptive_name](variables.tf#L43) | Name of the project name. Used for project name instead of `name` variable. | <code>string</code> | | <code>null</code> |
|
| [descriptive_name](variables.tf#L49) | Name of the project name. Used for project name instead of `name` variable. | <code>string</code> | | <code>null</code> |
|
||||||
| [group_iam](variables.tf#L55) | Authoritative IAM binding for organization groups, in {GROUP_EMAIL => [ROLES]} format. Group emails need to be static. Can be used in combination with the `iam` variable. | <code>map(list(string))</code> | | <code>{}</code> |
|
| [group_iam](variables.tf#L55) | Authoritative IAM binding for organization groups, in {GROUP_EMAIL => [ROLES]} format. Group emails need to be static. Can be used in combination with the `iam` variable. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
| [iam](variables.tf#L62) | IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
| [iam](variables.tf#L62) | IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
| [iam_additive](variables.tf#L69) | IAM additive bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
| [iam_additive](variables.tf#L69) | IAM additive bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
|
@ -378,23 +378,22 @@ output "compute_robot" {
|
||||||
| [logging_exclusions](variables.tf#L95) | Logging exclusions for this project in the form {NAME -> FILTER}. | <code>map(string)</code> | | <code>{}</code> |
|
| [logging_exclusions](variables.tf#L95) | Logging exclusions for this project in the form {NAME -> FILTER}. | <code>map(string)</code> | | <code>{}</code> |
|
||||||
| [logging_sinks](variables.tf#L102) | Logging sinks to create for this project. | <code title="map(object({ destination = string type = string filter = string iam = bool unique_writer = bool exclusions = map(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
| [logging_sinks](variables.tf#L102) | Logging sinks to create for this project. | <code title="map(object({ destination = string type = string filter = string iam = bool unique_writer = bool exclusions = map(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||||
| [metric_scopes](variables.tf#L124) | List of projects that will act as metric scopes for this project. | <code>list(string)</code> | | <code>[]</code> |
|
| [metric_scopes](variables.tf#L124) | List of projects that will act as metric scopes for this project. | <code>list(string)</code> | | <code>[]</code> |
|
||||||
| [oslogin](variables.tf#L136) | Enable OS Login. | <code>bool</code> | | <code>false</code> |
|
| [org_policies](variables.tf#L136) | Organization policies applied to this project keyed by policy name. | <code title="map(object({ inherit_from_parent = optional(bool) # for list policies only. reset = optional(bool) allow = optional(object({ all = optional(bool) values = optional(list(string)) })) deny = optional(object({ all = optional(bool) values = optional(list(string)) })) enforce = optional(bool, true) # for boolean policies only. rules = optional(list(object({ allow = optional(object({ all = optional(bool) values = optional(list(string)) })) deny = optional(object({ all = optional(bool) values = optional(list(string)) })) enforce = optional(bool, true) # for boolean policies only. condition = object({ description = optional(string) expression = optional(string) location = optional(string) title = optional(string) }) })), []) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||||
| [oslogin_admins](variables.tf#L142) | List of IAM-style identities that will be granted roles necessary for OS Login administrators. | <code>list(string)</code> | | <code>[]</code> |
|
| [oslogin](variables.tf#L176) | Enable OS Login. | <code>bool</code> | | <code>false</code> |
|
||||||
| [oslogin_users](variables.tf#L150) | List of IAM-style identities that will be granted roles necessary for OS Login users. | <code>list(string)</code> | | <code>[]</code> |
|
| [oslogin_admins](variables.tf#L182) | List of IAM-style identities that will be granted roles necessary for OS Login administrators. | <code>list(string)</code> | | <code>[]</code> |
|
||||||
| [parent](variables.tf#L157) | Parent folder or organization in 'folders/folder_id' or 'organizations/org_id' format. | <code>string</code> | | <code>null</code> |
|
| [oslogin_users](variables.tf#L190) | List of IAM-style identities that will be granted roles necessary for OS Login users. | <code>list(string)</code> | | <code>[]</code> |
|
||||||
| [policy_boolean](variables.tf#L167) | Map of boolean org policies and enforcement value, set value to null for policy restore. | <code>map(bool)</code> | | <code>{}</code> |
|
| [parent](variables.tf#L197) | Parent folder or organization in 'folders/folder_id' or 'organizations/org_id' format. | <code>string</code> | | <code>null</code> |
|
||||||
| [policy_list](variables.tf#L174) | Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny. | <code title="map(object({ inherit_from_parent = bool suggested_value = string status = bool values = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
| [prefix](variables.tf#L207) | Prefix used to generate project id and name. | <code>string</code> | | <code>null</code> |
|
||||||
| [prefix](variables.tf#L186) | Prefix used to generate project id and name. | <code>string</code> | | <code>null</code> |
|
| [project_create](variables.tf#L213) | Create project. When set to false, uses a data source to reference existing project. | <code>bool</code> | | <code>true</code> |
|
||||||
| [project_create](variables.tf#L192) | Create project. When set to false, uses a data source to reference existing project. | <code>bool</code> | | <code>true</code> |
|
| [service_config](variables.tf#L219) | Configure service API activation. | <code title="object({ disable_on_destroy = bool disable_dependent_services = bool })">object({…})</code> | | <code title="{ disable_on_destroy = false disable_dependent_services = false }">{…}</code> |
|
||||||
| [service_config](variables.tf#L198) | Configure service API activation. | <code title="object({ disable_on_destroy = bool disable_dependent_services = bool })">object({…})</code> | | <code title="{ disable_on_destroy = false disable_dependent_services = false }">{…}</code> |
|
| [service_encryption_key_ids](variables.tf#L231) | Cloud KMS encryption key in {SERVICE => [KEY_URL]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
| [service_encryption_key_ids](variables.tf#L210) | Cloud KMS encryption key in {SERVICE => [KEY_URL]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
| [service_perimeter_bridges](variables.tf#L238) | Name of VPC-SC Bridge perimeters to add project into. See comment in the variables file for format. | <code>list(string)</code> | | <code>null</code> |
|
||||||
| [service_perimeter_bridges](variables.tf#L217) | Name of VPC-SC Bridge perimeters to add project into. See comment in the variables file for format. | <code>list(string)</code> | | <code>null</code> |
|
| [service_perimeter_standard](variables.tf#L245) | Name of VPC-SC Standard perimeter to add project into. See comment in the variables file for format. | <code>string</code> | | <code>null</code> |
|
||||||
| [service_perimeter_standard](variables.tf#L224) | Name of VPC-SC Standard perimeter to add project into. See comment in the variables file for format. | <code>string</code> | | <code>null</code> |
|
| [services](variables.tf#L251) | Service APIs to enable. | <code>list(string)</code> | | <code>[]</code> |
|
||||||
| [services](variables.tf#L230) | Service APIs to enable. | <code>list(string)</code> | | <code>[]</code> |
|
| [shared_vpc_host_config](variables.tf#L257) | Configures this project as a Shared VPC host project (mutually exclusive with shared_vpc_service_project). | <code title="object({ enabled = bool service_projects = optional(list(string), []) })">object({…})</code> | | <code>null</code> |
|
||||||
| [shared_vpc_host_config](variables.tf#L236) | Configures this project as a Shared VPC host project (mutually exclusive with shared_vpc_service_project). | <code title="object({ enabled = bool service_projects = optional(list(string), []) })">object({…})</code> | | <code>null</code> |
|
| [shared_vpc_service_config](variables.tf#L266) | Configures this project as a Shared VPC service project (mutually exclusive with shared_vpc_host_config). | <code title="object({ host_project = string service_identity_iam = optional(map(list(string))) })">object({…})</code> | | <code>null</code> |
|
||||||
| [shared_vpc_service_config](variables.tf#L245) | Configures this project as a Shared VPC service project (mutually exclusive with shared_vpc_host_config). | <code title="object({ host_project = string service_identity_iam = optional(map(list(string))) })">object({…})</code> | | <code>null</code> |
|
| [skip_delete](variables.tf#L276) | Allows the underlying resources to be destroyed without destroying the project itself. | <code>bool</code> | | <code>false</code> |
|
||||||
| [skip_delete](variables.tf#L255) | Allows the underlying resources to be destroyed without destroying the project itself. | <code>bool</code> | | <code>false</code> |
|
| [tag_bindings](variables.tf#L282) | Tag bindings for this project, in key => tag value id format. | <code>map(string)</code> | | <code>null</code> |
|
||||||
| [tag_bindings](variables.tf#L261) | Tag bindings for this project, in key => tag value id format. | <code>map(string)</code> | | <code>null</code> |
|
|
||||||
|
|
||||||
## Outputs
|
## Outputs
|
||||||
|
|
||||||
|
@ -402,9 +401,9 @@ output "compute_robot" {
|
||||||
|---|---|:---:|
|
|---|---|:---:|
|
||||||
| [custom_roles](outputs.tf#L17) | Ids of the created custom roles. | |
|
| [custom_roles](outputs.tf#L17) | Ids of the created custom roles. | |
|
||||||
| [name](outputs.tf#L25) | Project name. | |
|
| [name](outputs.tf#L25) | Project name. | |
|
||||||
| [number](outputs.tf#L38) | Project number. | |
|
| [number](outputs.tf#L37) | Project number. | |
|
||||||
| [project_id](outputs.tf#L56) | Project id. | |
|
| [project_id](outputs.tf#L54) | Project id. | |
|
||||||
| [service_accounts](outputs.tf#L76) | Product robot service accounts in project. | |
|
| [service_accounts](outputs.tf#L73) | Product robot service accounts in project. | |
|
||||||
| [sink_writer_identities](outputs.tf#L92) | Writer identities created for each sink. | |
|
| [sink_writer_identities](outputs.tf#L89) | Writer identities created for each sink. | |
|
||||||
|
|
||||||
<!-- END TFDOC -->
|
<!-- END TFDOC -->
|
||||||
|
|
|
@ -16,75 +16,79 @@
|
||||||
|
|
||||||
# tfdoc:file:description Project-level organization policies.
|
# tfdoc:file:description Project-level organization policies.
|
||||||
|
|
||||||
resource "google_project_organization_policy" "boolean" {
|
locals {
|
||||||
for_each = var.policy_boolean
|
org_policies = {
|
||||||
project = local.project.project_id
|
for k, v in var.org_policies :
|
||||||
constraint = each.key
|
k => merge(v, {
|
||||||
|
is_boolean_policy = v.allow == null && v.deny == null
|
||||||
dynamic "boolean_policy" {
|
has_values = (
|
||||||
for_each = each.value == null ? [] : [each.value]
|
length(coalesce(try(v.allow.values, []), [])) > 0 ||
|
||||||
iterator = policy
|
length(coalesce(try(v.deny.values, []), [])) > 0
|
||||||
content {
|
)
|
||||||
enforced = policy.value
|
rules = [
|
||||||
}
|
for r in v.rules :
|
||||||
}
|
merge(r, {
|
||||||
|
has_values = (
|
||||||
dynamic "restore_policy" {
|
length(coalesce(try(r.allow.values, []), [])) > 0 ||
|
||||||
for_each = each.value == null ? [""] : []
|
length(coalesce(try(r.deny.values, []), [])) > 0
|
||||||
content {
|
)
|
||||||
default = true
|
})
|
||||||
}
|
]
|
||||||
|
})
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "google_project_organization_policy" "list" {
|
resource "google_org_policy_policy" "default" {
|
||||||
for_each = var.policy_list
|
for_each = local.org_policies
|
||||||
project = local.project.project_id
|
name = "projects/${local.project.project_id}/policies/${each.key}"
|
||||||
constraint = each.key
|
parent = "projects/${local.project.project_id}"
|
||||||
|
|
||||||
dynamic "list_policy" {
|
spec {
|
||||||
for_each = each.value.status == null ? [] : [each.value]
|
inherit_from_parent = each.value.inherit_from_parent
|
||||||
iterator = policy
|
reset = each.value.reset
|
||||||
content {
|
|
||||||
inherit_from_parent = policy.value.inherit_from_parent
|
rules {
|
||||||
suggested_value = policy.value.suggested_value
|
allow_all = try(each.value.allow.all, null) == true ? "TRUE" : null
|
||||||
dynamic "allow" {
|
deny_all = try(each.value.deny.all, null) == true ? "TRUE" : null
|
||||||
for_each = policy.value.status ? [""] : []
|
enforce = (
|
||||||
content {
|
each.value.is_boolean_policy && each.value.enforce != null
|
||||||
values = (
|
? upper(tostring(each.value.enforce))
|
||||||
try(length(policy.value.values) > 0, false)
|
|
||||||
? policy.value.values
|
|
||||||
: null
|
: null
|
||||||
)
|
)
|
||||||
all = (
|
dynamic "values" {
|
||||||
try(length(policy.value.values) > 0, false)
|
for_each = each.value.has_values ? [1] : []
|
||||||
? null
|
|
||||||
: true
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
dynamic "deny" {
|
|
||||||
for_each = policy.value.status ? [] : [""]
|
|
||||||
content {
|
content {
|
||||||
values = (
|
allowed_values = try(each.value.allow.values, null)
|
||||||
try(length(policy.value.values) > 0, false)
|
denied_values = try(each.value.deny.values, null)
|
||||||
? policy.value.values
|
|
||||||
: null
|
|
||||||
)
|
|
||||||
all = (
|
|
||||||
try(length(policy.value.values) > 0, false)
|
|
||||||
? null
|
|
||||||
: true
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
dynamic "restore_policy" {
|
dynamic "rules" {
|
||||||
for_each = each.value.status == null ? [true] : []
|
for_each = each.value.rules
|
||||||
|
iterator = rule
|
||||||
content {
|
content {
|
||||||
default = true
|
allow_all = try(rule.value.allow.all, false) == true ? "TRUE" : null
|
||||||
|
deny_all = try(rule.value.deny.all, false) == true ? "TRUE" : null
|
||||||
|
enforce = (
|
||||||
|
each.value.is_boolean_policy && rule.value.enforce != null
|
||||||
|
? upper(tostring(rule.value.enforce))
|
||||||
|
: null
|
||||||
|
)
|
||||||
|
condition {
|
||||||
|
description = rule.value.condition.description
|
||||||
|
expression = rule.value.condition.expression
|
||||||
|
location = rule.value.condition.location
|
||||||
|
title = rule.value.condition.title
|
||||||
|
}
|
||||||
|
dynamic "values" {
|
||||||
|
for_each = rule.value.has_values ? [1] : [0]
|
||||||
|
content {
|
||||||
|
allowed_values = try(rule.value.allow.values, null)
|
||||||
|
denied_values = try(rule.value.deny.values, null)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -26,8 +26,7 @@ output "name" {
|
||||||
description = "Project name."
|
description = "Project name."
|
||||||
value = local.project.name
|
value = local.project.name
|
||||||
depends_on = [
|
depends_on = [
|
||||||
google_project_organization_policy.boolean,
|
google_org_policy_policy.default,
|
||||||
google_project_organization_policy.list,
|
|
||||||
google_project_service.project_services,
|
google_project_service.project_services,
|
||||||
google_compute_shared_vpc_service_project.service_projects,
|
google_compute_shared_vpc_service_project.service_projects,
|
||||||
google_project_iam_member.shared_vpc_host_robots,
|
google_project_iam_member.shared_vpc_host_robots,
|
||||||
|
@ -39,8 +38,7 @@ output "number" {
|
||||||
description = "Project number."
|
description = "Project number."
|
||||||
value = local.project.number
|
value = local.project.number
|
||||||
depends_on = [
|
depends_on = [
|
||||||
google_project_organization_policy.boolean,
|
google_org_policy_policy.default,
|
||||||
google_project_organization_policy.list,
|
|
||||||
google_project_service.project_services,
|
google_project_service.project_services,
|
||||||
google_compute_shared_vpc_host_project.shared_vpc_host,
|
google_compute_shared_vpc_host_project.shared_vpc_host,
|
||||||
google_compute_shared_vpc_service_project.shared_vpc_service,
|
google_compute_shared_vpc_service_project.shared_vpc_service,
|
||||||
|
@ -59,8 +57,7 @@ output "project_id" {
|
||||||
depends_on = [
|
depends_on = [
|
||||||
google_project.project,
|
google_project.project,
|
||||||
data.google_project.project,
|
data.google_project.project,
|
||||||
google_project_organization_policy.boolean,
|
google_org_policy_policy.default,
|
||||||
google_project_organization_policy.list,
|
|
||||||
google_project_service.project_services,
|
google_project_service.project_services,
|
||||||
google_compute_shared_vpc_host_project.shared_vpc_host,
|
google_compute_shared_vpc_host_project.shared_vpc_host,
|
||||||
google_compute_shared_vpc_service_project.shared_vpc_service,
|
google_compute_shared_vpc_service_project.shared_vpc_service,
|
||||||
|
|
|
@ -40,18 +40,18 @@ variable "custom_roles" {
|
||||||
nullable = false
|
nullable = false
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "descriptive_name" {
|
|
||||||
description = "Name of the project name. Used for project name instead of `name` variable."
|
|
||||||
type = string
|
|
||||||
default = null
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "default_service_account" {
|
variable "default_service_account" {
|
||||||
description = "Project default service account setting: can be one of `delete`, `deprivilege`, `disable`, or `keep`."
|
description = "Project default service account setting: can be one of `delete`, `deprivilege`, `disable`, or `keep`."
|
||||||
default = "keep"
|
default = "keep"
|
||||||
type = string
|
type = string
|
||||||
}
|
}
|
||||||
|
|
||||||
|
variable "descriptive_name" {
|
||||||
|
description = "Name of the project name. Used for project name instead of `name` variable."
|
||||||
|
type = string
|
||||||
|
default = null
|
||||||
|
}
|
||||||
|
|
||||||
variable "group_iam" {
|
variable "group_iam" {
|
||||||
description = "Authoritative IAM binding for organization groups, in {GROUP_EMAIL => [ROLES]} format. Group emails need to be static. Can be used in combination with the `iam` variable."
|
description = "Authoritative IAM binding for organization groups, in {GROUP_EMAIL => [ROLES]} format. Group emails need to be static. Can be used in combination with the `iam` variable."
|
||||||
type = map(list(string))
|
type = map(list(string))
|
||||||
|
@ -133,6 +133,46 @@ variable "name" {
|
||||||
type = string
|
type = string
|
||||||
}
|
}
|
||||||
|
|
||||||
|
variable "org_policies" {
|
||||||
|
description = "Organization policies applied to this project keyed by policy name."
|
||||||
|
type = map(object({
|
||||||
|
inherit_from_parent = optional(bool) # for list policies only.
|
||||||
|
reset = optional(bool)
|
||||||
|
|
||||||
|
# default (unconditional) values
|
||||||
|
allow = optional(object({
|
||||||
|
all = optional(bool)
|
||||||
|
values = optional(list(string))
|
||||||
|
}))
|
||||||
|
deny = optional(object({
|
||||||
|
all = optional(bool)
|
||||||
|
values = optional(list(string))
|
||||||
|
}))
|
||||||
|
enforce = optional(bool, true) # for boolean policies only.
|
||||||
|
|
||||||
|
# conditional values
|
||||||
|
rules = optional(list(object({
|
||||||
|
allow = optional(object({
|
||||||
|
all = optional(bool)
|
||||||
|
values = optional(list(string))
|
||||||
|
}))
|
||||||
|
deny = optional(object({
|
||||||
|
all = optional(bool)
|
||||||
|
values = optional(list(string))
|
||||||
|
}))
|
||||||
|
enforce = optional(bool, true) # for boolean policies only.
|
||||||
|
condition = object({
|
||||||
|
description = optional(string)
|
||||||
|
expression = optional(string)
|
||||||
|
location = optional(string)
|
||||||
|
title = optional(string)
|
||||||
|
})
|
||||||
|
})), [])
|
||||||
|
}))
|
||||||
|
default = {}
|
||||||
|
nullable = false
|
||||||
|
}
|
||||||
|
|
||||||
variable "oslogin" {
|
variable "oslogin" {
|
||||||
description = "Enable OS Login."
|
description = "Enable OS Login."
|
||||||
type = bool
|
type = bool
|
||||||
|
@ -164,25 +204,6 @@ variable "parent" {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "policy_boolean" {
|
|
||||||
description = "Map of boolean org policies and enforcement value, set value to null for policy restore."
|
|
||||||
type = map(bool)
|
|
||||||
default = {}
|
|
||||||
nullable = false
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "policy_list" {
|
|
||||||
description = "Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny."
|
|
||||||
type = map(object({
|
|
||||||
inherit_from_parent = bool
|
|
||||||
suggested_value = string
|
|
||||||
status = bool
|
|
||||||
values = list(string)
|
|
||||||
}))
|
|
||||||
default = {}
|
|
||||||
nullable = false
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "prefix" {
|
variable "prefix" {
|
||||||
description = "Prefix used to generate project id and name."
|
description = "Prefix used to generate project id and name."
|
||||||
type = string
|
type = string
|
||||||
|
|
Loading…
Reference in New Issue