Simplify organization tags.tf locals (#1932)

* Simplify organization tags.tf locals

* Fix boilerplate

* Override github provider version for tests

fast/stages/1-resman/organization.tf

@@ -48,21 +48,21 @@ module "organization" {
       description = "Resource management context."
       iam         = {}
       values = {
-        data       = null
+        data       = {}
-        gke        = null
+        gke        = {}
-        networking = null
+        networking = {}
-        sandbox    = null
+        sandbox    = {}
-        security   = null
+        security   = {}
-        teams      = null
+        teams      = {}
-        tenant     = null
+        tenant     = {}
       }
     }
     (var.tag_names.environment) = {
       description = "Environment definition."
       iam         = {}
       values = {
-        development = null
+        development = {}
-        production  = null
+        production  = {}
       }
     }
     (var.tag_names.tenant) = {

modules/folder/README.md

@@ -303,10 +303,9 @@ module "org" {
   tags = {
     environment = {
       description = "Environment specification."
-      iam         = null
       values = {
-        dev  = null
+        dev  = {}
-        prod = null
+        prod = {}
       }
     }
   }

modules/organization/README.md

@@ -453,7 +453,7 @@ module "org" {
         "roles/resourcemanager.tagAdmin" = ["group:${var.group_email}"]
       }
       values = {
-        dev = null
+        dev = {}
         prod = {
           description = "Environment: production."
           iam = {
@@ -502,8 +502,8 @@ module "org" {
 | [network_tags](variables.tf#L148) | Network tags by key name. If `id` is provided, key creation is skipped. The `iam` attribute behaves like the similarly named one at module level. | <code title="map&#40;object&#40;&#123;&#10;  description &#61; optional&#40;string, &#34;Managed by the Terraform organization module.&#34;&#41;&#10;  iam         &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  id          &#61; optional&#40;string&#41;&#10;  network     &#61; string &#35; project_id&#47;vpc_name&#10;  values &#61; optional&#40;map&#40;object&#40;&#123;&#10;    description &#61; optional&#40;string, &#34;Managed by the Terraform organization module.&#34;&#41;&#10;    iam         &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [org_policies](variables.tf#L170) | Organization policies applied to this organization keyed by policy name. | <code title="map&#40;object&#40;&#123;&#10;  inherit_from_parent &#61; optional&#40;bool&#41; &#35; for list policies only.&#10;  reset               &#61; optional&#40;bool&#41;&#10;  rules &#61; optional&#40;list&#40;object&#40;&#123;&#10;    allow &#61; optional&#40;object&#40;&#123;&#10;      all    &#61; optional&#40;bool&#41;&#10;      values &#61; optional&#40;list&#40;string&#41;&#41;&#10;    &#125;&#41;&#41;&#10;    deny &#61; optional&#40;object&#40;&#123;&#10;      all    &#61; optional&#40;bool&#41;&#10;      values &#61; optional&#40;list&#40;string&#41;&#41;&#10;    &#125;&#41;&#41;&#10;    enforce &#61; optional&#40;bool&#41; &#35; for boolean policies only.&#10;    condition &#61; optional&#40;object&#40;&#123;&#10;      description &#61; optional&#40;string&#41;&#10;      expression  &#61; optional&#40;string&#41;&#10;      location    &#61; optional&#40;string&#41;&#10;      title       &#61; optional&#40;string&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;  &#125;&#41;&#41;, &#91;&#93;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [org_policy_custom_constraints](variables.tf#L197) | Organization policy custom constraints keyed by constraint name. | <code title="map&#40;object&#40;&#123;&#10;  display_name   &#61; optional&#40;string&#41;&#10;  description    &#61; optional&#40;string&#41;&#10;  action_type    &#61; string&#10;  condition      &#61; string&#10;  method_types   &#61; list&#40;string&#41;&#10;  resource_types &#61; list&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [tag_bindings](variables.tf#L220) | Tag bindings for this organization, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
+| [tag_bindings](variables.tf#L220) | Tag bindings for this organization, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
-| [tags](variables.tf#L226) | Tags by key name. If `id` is provided, key or value creation is skipped. The `iam` attribute behaves like the similarly named one at module level. | <code title="map&#40;object&#40;&#123;&#10;  description &#61; optional&#40;string, &#34;Managed by the Terraform organization module.&#34;&#41;&#10;  iam         &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  id          &#61; optional&#40;string&#41;&#10;  values &#61; optional&#40;map&#40;object&#40;&#123;&#10;    description &#61; optional&#40;string, &#34;Managed by the Terraform organization module.&#34;&#41;&#10;    iam         &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;    id          &#61; optional&#40;string&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [tags](variables.tf#L227) | Tags by key name. If `id` is provided, key or value creation is skipped. The `iam` attribute behaves like the similarly named one at module level. | <code title="map&#40;object&#40;&#123;&#10;  description &#61; optional&#40;string, &#34;Managed by the Terraform organization module.&#34;&#41;&#10;  iam         &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  id          &#61; optional&#40;string&#41;&#10;  values &#61; optional&#40;map&#40;object&#40;&#123;&#10;    description &#61; optional&#40;string, &#34;Managed by the Terraform organization module.&#34;&#41;&#10;    iam         &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;    id          &#61; optional&#40;string&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 
 ## Outputs
 

modules/organization/tags.tf

@@ -1,5 +1,5 @@
 /**
- * Copyright 2022 Google LLC
+ * Copyright 2023 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,17 +17,12 @@
 locals {
   _tag_values = flatten([
     for tag, attrs in local.tags : [
-      for value, value_attrs in coalesce(attrs.values, {}) : {
+      for value, value_attrs in attrs.values : {
-        description = coalesce(
+        description = value_attrs.description,
-          value_attrs == null ? null : value_attrs.description,
+        key         = "${tag}/${value}"
-          "Managed by the Terraform organization module."
+        id          = try(value_attrs.id, null)
-        )
+        name        = value
-        key  = "${tag}/${value}"
+        roles       = keys(value_attrs.iam)
-        id   = try(value_attrs.id, null)
-        name = value
-        roles = keys(coalesce(
-          value_attrs == null ? null : value_attrs.iam, {}
-        ))
         tag         = tag
         tag_id      = attrs.id
         tag_network = try(attrs.network, null) != null
@@ -47,7 +42,7 @@ locals {
   ])
   _tags_iam = flatten([
     for tag, attrs in local.tags : [
-      for role in keys(coalesce(attrs.iam, {})) : {
+      for role in keys(attrs.iam) : {
         role   = role
         tag    = tag
         tag_id = attrs.id
@@ -129,7 +124,7 @@ resource "google_tags_tag_value_iam_binding" "default" {
 # bindings
 
 resource "google_tags_tag_binding" "binding" {
-  for_each  = coalesce(var.tag_bindings, {})
+  for_each  = var.tag_bindings
   parent    = "//cloudresourcemanager.googleapis.com/${var.organization_id}"
   tag_value = each.value
 }

modules/organization/variables.tf

@@ -220,7 +220,8 @@ variable "organization_id" {
 variable "tag_bindings" {
   description = "Tag bindings for this organization, in key => tag value id format."
   type        = map(string)
-  default     = null
+  default     = {}
+  nullable    = false
 }
 
 variable "tags" {
@@ -238,9 +239,16 @@ variable "tags" {
   nullable = false
   default  = {}
   validation {
-    condition = alltrue([
+    condition = (
-      for k, v in var.tags : v != null
+      # all keys are non-null
-    ])
+      alltrue([
+        for k, v in var.tags : v != null
+      ]) &&
+      # all values are non-null
+      alltrue(flatten([
+        for k, v in var.tags : [for k2, v2 in v.values : v2 != null]
+      ]))
+    )
     error_message = "Use an empty map instead of null as value."
   }
 }

modules/project/README.md

@@ -666,10 +666,9 @@ module "org" {
   tags = {
     environment = {
       description = "Environment specification."
-      iam         = null
       values = {
-        dev  = null
+        dev  = {}
-        prod = null
+        prod = {}
       }
     }
   }

tests/modules/organization/tags.tfvars

@@ -13,8 +13,8 @@ tags = {
   baz = {
     id = "tagKeys/1234567890"
     values = {
-      one = null
+      one = {}
-      two = null
+      two = {}
     }
   }
   foobar = {
@@ -25,7 +25,7 @@ tags = {
       ]
     }
     values = {
-      one = null
+      one = {}
       two = {
         description = "Foobar 2."
         iam = {

tools/lockfile/default-versions_override.tf

@@ -0,0 +1,27 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This file specifies the required version of the github provider used
+# during testing. This has to be in an override file, otherwise the
+# setup-tf-providers job fails because it copies default-versions.tf
+# before running `terraform init`
+
+terraform {
+  required_providers {
+    github = {
+      source  = "integrations/github"
+      version = "~> 5.0"
+    }
+  }
+}

tools/lockfile/main.tf

@@ -12,15 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-terraform {
-  required_providers {
-    github = {
-      source  = "integrations/github"
-      version = "~> 5.0"
-    }
-  }
-}
-
 data "archive_file" "bundle" {}
 resource "azuread_user" "default" {}
 resource "azurerm_resource_group" "default" {}