commit
d9ab23a19e
|
@ -9,14 +9,11 @@ module "bucket" {
|
||||||
prefix = "test"
|
prefix = "test"
|
||||||
name = "my-bucket"
|
name = "my-bucket"
|
||||||
versioning = true
|
versioning = true
|
||||||
iam = {
|
|
||||||
"roles/storage.admin" = ["group:storage@example.com"]
|
|
||||||
}
|
|
||||||
labels = {
|
labels = {
|
||||||
cost-center = "devops"
|
cost-center = "devops"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
# tftest modules=1 resources=2 inventory=simple.yaml
|
# tftest modules=1 resources=1 inventory=simple.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
### Example with Cloud KMS
|
### Example with Cloud KMS
|
||||||
|
@ -108,29 +105,99 @@ module "bucket" {
|
||||||
}
|
}
|
||||||
# tftest modules=1 resources=2 inventory=object-upload.yaml
|
# tftest modules=1 resources=2 inventory=object-upload.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
|
### Examples of IAM
|
||||||
|
|
||||||
|
```hcl
|
||||||
|
module "bucket" {
|
||||||
|
source = "./fabric/modules/gcs"
|
||||||
|
project_id = "myproject"
|
||||||
|
name = "my-bucket"
|
||||||
|
iam = {
|
||||||
|
"roles/storage.admin" = ["group:storage@example.com"]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
# tftest modules=1 resources=2 inventory=iam-authoritative.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
```hcl
|
||||||
|
module "bucket" {
|
||||||
|
source = "./fabric/modules/gcs"
|
||||||
|
project_id = "myproject"
|
||||||
|
name = "my-bucket"
|
||||||
|
iam_bindings = {
|
||||||
|
storage-admin-with-delegated_roles = {
|
||||||
|
role = "roles/storage.admin"
|
||||||
|
members = ["group:storage@example.com"]
|
||||||
|
condition = {
|
||||||
|
title = "delegated-role-grants"
|
||||||
|
expression = format(
|
||||||
|
"api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([%s])",
|
||||||
|
join(",", formatlist("'%s'",
|
||||||
|
[
|
||||||
|
"roles/storage.objectAdmin",
|
||||||
|
"roles/storage.objectViewer",
|
||||||
|
]
|
||||||
|
))
|
||||||
|
)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
# tftest modules=1 resources=2 inventory=iam-bindings.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
```hcl
|
||||||
|
module "bucket" {
|
||||||
|
source = "./fabric/modules/gcs"
|
||||||
|
project_id = "myproject"
|
||||||
|
name = "my-bucket"
|
||||||
|
iam_bindings_additive = {
|
||||||
|
storage-admin-with-delegated_roles = {
|
||||||
|
role = "roles/storage.admin"
|
||||||
|
member = "group:storage@example.com"
|
||||||
|
condition = {
|
||||||
|
title = "delegated-role-grants"
|
||||||
|
expression = format(
|
||||||
|
"api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([%s])",
|
||||||
|
join(",", formatlist("'%s'",
|
||||||
|
[
|
||||||
|
"roles/storage.objectAdmin",
|
||||||
|
"roles/storage.objectViewer",
|
||||||
|
]
|
||||||
|
))
|
||||||
|
)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
# tftest modules=1 resources=2 inventory=iam-bindings-additive.yaml
|
||||||
|
```
|
||||||
<!-- BEGIN TFDOC -->
|
<!-- BEGIN TFDOC -->
|
||||||
## Variables
|
## Variables
|
||||||
|
|
||||||
| name | description | type | required | default |
|
| name | description | type | required | default |
|
||||||
|---|---|:---:|:---:|:---:|
|
|---|---|:---:|:---:|:---:|
|
||||||
| [name](variables.tf#L116) | Bucket name suffix. | <code>string</code> | ✓ | |
|
| [name](variables.tf#L146) | Bucket name suffix. | <code>string</code> | ✓ | |
|
||||||
| [project_id](variables.tf#L171) | Bucket project id. | <code>string</code> | ✓ | |
|
| [project_id](variables.tf#L201) | Bucket project id. | <code>string</code> | ✓ | |
|
||||||
| [cors](variables.tf#L17) | CORS configuration for the bucket. Defaults to null. | <code title="object({ origin = optional(list(string)) method = optional(list(string)) response_header = optional(list(string)) max_age_seconds = optional(number) })">object({…})</code> | | <code>null</code> |
|
| [cors](variables.tf#L17) | CORS configuration for the bucket. Defaults to null. | <code title="object({ origin = optional(list(string)) method = optional(list(string)) response_header = optional(list(string)) max_age_seconds = optional(number) })">object({…})</code> | | <code>null</code> |
|
||||||
| [encryption_key](variables.tf#L28) | KMS key that will be used for encryption. | <code>string</code> | | <code>null</code> |
|
| [encryption_key](variables.tf#L28) | KMS key that will be used for encryption. | <code>string</code> | | <code>null</code> |
|
||||||
| [force_destroy](variables.tf#L34) | Optional map to set force destroy keyed by name, defaults to false. | <code>bool</code> | | <code>false</code> |
|
| [force_destroy](variables.tf#L34) | Optional map to set force destroy keyed by name, defaults to false. | <code>bool</code> | | <code>false</code> |
|
||||||
| [iam](variables.tf#L40) | IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
| [iam](variables.tf#L40) | IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
| [labels](variables.tf#L46) | Labels to be attached to all buckets. | <code>map(string)</code> | | <code>{}</code> |
|
| [iam_bindings](variables.tf#L46) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code title="map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||||
| [lifecycle_rules](variables.tf#L52) | Bucket lifecycle rule. | <code title="map(object({ action = object({ type = string storage_class = optional(string) }) condition = object({ age = optional(number) created_before = optional(string) custom_time_before = optional(string) days_since_custom_time = optional(number) days_since_noncurrent_time = optional(number) matches_prefix = optional(list(string)) matches_storage_class = optional(list(string)) # STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE, DURABLE_REDUCED_AVAILABILITY matches_suffix = optional(list(string)) noncurrent_time_before = optional(string) num_newer_versions = optional(number) with_state = optional(string) # "LIVE", "ARCHIVED", "ANY" }) }))">map(object({…}))</code> | | <code>{}</code> |
|
| [iam_bindings_additive](variables.tf#L61) | Individual additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||||
| [location](variables.tf#L101) | Bucket location. | <code>string</code> | | <code>"EU"</code> |
|
| [labels](variables.tf#L76) | Labels to be attached to all buckets. | <code>map(string)</code> | | <code>{}</code> |
|
||||||
| [logging_config](variables.tf#L107) | Bucket logging configuration. | <code title="object({ log_bucket = string log_object_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
| [lifecycle_rules](variables.tf#L82) | Bucket lifecycle rule. | <code title="map(object({ action = object({ type = string storage_class = optional(string) }) condition = object({ age = optional(number) created_before = optional(string) custom_time_before = optional(string) days_since_custom_time = optional(number) days_since_noncurrent_time = optional(number) matches_prefix = optional(list(string)) matches_storage_class = optional(list(string)) # STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE, DURABLE_REDUCED_AVAILABILITY matches_suffix = optional(list(string)) noncurrent_time_before = optional(string) num_newer_versions = optional(number) with_state = optional(string) # "LIVE", "ARCHIVED", "ANY" }) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||||
| [notification_config](variables.tf#L121) | GCS Notification configuration. | <code title="object({ enabled = bool payload_format = string topic_name = string sa_email = string event_types = optional(list(string)) custom_attributes = optional(map(string)) object_name_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
| [location](variables.tf#L131) | Bucket location. | <code>string</code> | | <code>"EU"</code> |
|
||||||
| [objects_to_upload](variables.tf#L135) | Objects to be uploaded to bucket. | <code title="map(object({ name = string metadata = optional(map(string)) content = optional(string) source = optional(string) cache_control = optional(string) content_disposition = optional(string) content_encoding = optional(string) content_language = optional(string) content_type = optional(string) event_based_hold = optional(bool) temporary_hold = optional(bool) detect_md5hash = optional(string) storage_class = optional(string) kms_key_name = optional(string) customer_encryption = optional(object({ encryption_algorithm = optional(string) encryption_key = string })) }))">map(object({…}))</code> | | <code>{}</code> |
|
| [logging_config](variables.tf#L137) | Bucket logging configuration. | <code title="object({ log_bucket = string log_object_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||||
| [prefix](variables.tf#L161) | Optional prefix used to generate the bucket name. | <code>string</code> | | <code>null</code> |
|
| [notification_config](variables.tf#L151) | GCS Notification configuration. | <code title="object({ enabled = bool payload_format = string topic_name = string sa_email = string event_types = optional(list(string)) custom_attributes = optional(map(string)) object_name_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||||
| [retention_policy](variables.tf#L176) | Bucket retention policy. | <code title="object({ retention_period = number is_locked = optional(bool) })">object({…})</code> | | <code>null</code> |
|
| [objects_to_upload](variables.tf#L165) | Objects to be uploaded to bucket. | <code title="map(object({ name = string metadata = optional(map(string)) content = optional(string) source = optional(string) cache_control = optional(string) content_disposition = optional(string) content_encoding = optional(string) content_language = optional(string) content_type = optional(string) event_based_hold = optional(bool) temporary_hold = optional(bool) detect_md5hash = optional(string) storage_class = optional(string) kms_key_name = optional(string) customer_encryption = optional(object({ encryption_algorithm = optional(string) encryption_key = string })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||||
| [storage_class](variables.tf#L185) | Bucket storage class. | <code>string</code> | | <code>"MULTI_REGIONAL"</code> |
|
| [prefix](variables.tf#L191) | Optional prefix used to generate the bucket name. | <code>string</code> | | <code>null</code> |
|
||||||
| [uniform_bucket_level_access](variables.tf#L195) | Allow using object ACLs (false) or not (true, this is the recommended behavior) , defaults to true (which is the recommended practice, but not the behavior of storage API). | <code>bool</code> | | <code>true</code> |
|
| [retention_policy](variables.tf#L206) | Bucket retention policy. | <code title="object({ retention_period = number is_locked = optional(bool) })">object({…})</code> | | <code>null</code> |
|
||||||
| [versioning](variables.tf#L201) | Enable versioning, defaults to false. | <code>bool</code> | | <code>false</code> |
|
| [storage_class](variables.tf#L215) | Bucket storage class. | <code>string</code> | | <code>"MULTI_REGIONAL"</code> |
|
||||||
| [website](variables.tf#L207) | Bucket website. | <code title="object({ main_page_suffix = optional(string) not_found_page = optional(string) })">object({…})</code> | | <code>null</code> |
|
| [uniform_bucket_level_access](variables.tf#L225) | Allow using object ACLs (false) or not (true, this is the recommended behavior) , defaults to true (which is the recommended practice, but not the behavior of storage API). | <code>bool</code> | | <code>true</code> |
|
||||||
|
| [versioning](variables.tf#L231) | Enable versioning, defaults to false. | <code>bool</code> | | <code>false</code> |
|
||||||
|
| [website](variables.tf#L237) | Bucket website. | <code title="object({ main_page_suffix = optional(string) not_found_page = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||||
|
|
||||||
## Outputs
|
## Outputs
|
||||||
|
|
||||||
|
|
|
@ -0,0 +1,54 @@
|
||||||
|
/**
|
||||||
|
* Copyright 2023 Google LLC
|
||||||
|
*
|
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
# tfdoc:file:description IAM bindings
|
||||||
|
|
||||||
|
resource "google_storage_bucket_iam_binding" "authoritative" {
|
||||||
|
for_each = var.iam
|
||||||
|
bucket = google_storage_bucket.bucket.name
|
||||||
|
role = each.key
|
||||||
|
members = each.value
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_storage_bucket_iam_binding" "bindings" {
|
||||||
|
for_each = var.iam_bindings
|
||||||
|
bucket = google_storage_bucket.bucket.name
|
||||||
|
role = each.value.role
|
||||||
|
members = each.value.members
|
||||||
|
dynamic "condition" {
|
||||||
|
for_each = each.value.condition == null ? [] : [""]
|
||||||
|
content {
|
||||||
|
expression = each.value.condition.expression
|
||||||
|
title = each.value.condition.title
|
||||||
|
description = each.value.condition.description
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_storage_bucket_iam_member" "bindings" {
|
||||||
|
for_each = var.iam_bindings_additive
|
||||||
|
bucket = google_storage_bucket.bucket.name
|
||||||
|
role = each.value.role
|
||||||
|
member = each.value.member
|
||||||
|
dynamic "condition" {
|
||||||
|
for_each = each.value.condition == null ? [] : [""]
|
||||||
|
content {
|
||||||
|
expression = each.value.condition.expression
|
||||||
|
title = each.value.condition.title
|
||||||
|
description = each.value.condition.description
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
|
@ -128,13 +128,6 @@ resource "google_storage_bucket_object" "objects" {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "google_storage_bucket_iam_binding" "bindings" {
|
|
||||||
for_each = var.iam
|
|
||||||
bucket = google_storage_bucket.bucket.name
|
|
||||||
role = each.key
|
|
||||||
members = each.value
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "google_storage_notification" "notification" {
|
resource "google_storage_notification" "notification" {
|
||||||
count = local.notification ? 1 : 0
|
count = local.notification ? 1 : 0
|
||||||
bucket = google_storage_bucket.bucket.name
|
bucket = google_storage_bucket.bucket.name
|
||||||
|
|
|
@ -43,6 +43,36 @@ variable "iam" {
|
||||||
default = {}
|
default = {}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
variable "iam_bindings" {
|
||||||
|
description = "Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary."
|
||||||
|
type = map(object({
|
||||||
|
members = list(string)
|
||||||
|
role = string
|
||||||
|
condition = optional(object({
|
||||||
|
expression = string
|
||||||
|
title = string
|
||||||
|
description = optional(string)
|
||||||
|
}))
|
||||||
|
}))
|
||||||
|
nullable = false
|
||||||
|
default = {}
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "iam_bindings_additive" {
|
||||||
|
description = "Individual additive IAM bindings. Keys are arbitrary."
|
||||||
|
type = map(object({
|
||||||
|
member = string
|
||||||
|
role = string
|
||||||
|
condition = optional(object({
|
||||||
|
expression = string
|
||||||
|
title = string
|
||||||
|
description = optional(string)
|
||||||
|
}))
|
||||||
|
}))
|
||||||
|
nullable = false
|
||||||
|
default = {}
|
||||||
|
}
|
||||||
|
|
||||||
variable "labels" {
|
variable "labels" {
|
||||||
description = "Labels to be attached to all buckets."
|
description = "Labels to be attached to all buckets."
|
||||||
type = map(string)
|
type = map(string)
|
||||||
|
|
|
@ -0,0 +1,47 @@
|
||||||
|
# Copyright 2023 Google LLC
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
values:
|
||||||
|
module.bucket.google_storage_bucket.bucket:
|
||||||
|
autoclass: []
|
||||||
|
cors: []
|
||||||
|
custom_placement_config: []
|
||||||
|
default_event_based_hold: null
|
||||||
|
encryption: []
|
||||||
|
force_destroy: false
|
||||||
|
labels: null
|
||||||
|
lifecycle_rule: []
|
||||||
|
location: EU
|
||||||
|
logging: []
|
||||||
|
name: my-bucket
|
||||||
|
project: myproject
|
||||||
|
requester_pays: null
|
||||||
|
retention_policy: []
|
||||||
|
storage_class: MULTI_REGIONAL
|
||||||
|
timeouts: null
|
||||||
|
uniform_bucket_level_access: true
|
||||||
|
versioning:
|
||||||
|
- enabled: false
|
||||||
|
module.bucket.google_storage_bucket_iam_binding.authoritative["roles/storage.admin"]:
|
||||||
|
bucket: my-bucket
|
||||||
|
condition: []
|
||||||
|
members:
|
||||||
|
- group:storage@example.com
|
||||||
|
role: roles/storage.admin
|
||||||
|
|
||||||
|
counts:
|
||||||
|
google_storage_bucket: 1
|
||||||
|
google_storage_bucket_iam_binding: 1
|
||||||
|
modules: 1
|
||||||
|
resources: 2
|
|
@ -0,0 +1,49 @@
|
||||||
|
# Copyright 2023 Google LLC
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
values:
|
||||||
|
module.bucket.google_storage_bucket.bucket:
|
||||||
|
autoclass: []
|
||||||
|
cors: []
|
||||||
|
custom_placement_config: []
|
||||||
|
default_event_based_hold: null
|
||||||
|
encryption: []
|
||||||
|
force_destroy: false
|
||||||
|
labels: null
|
||||||
|
lifecycle_rule: []
|
||||||
|
location: EU
|
||||||
|
logging: []
|
||||||
|
name: my-bucket
|
||||||
|
project: myproject
|
||||||
|
requester_pays: null
|
||||||
|
retention_policy: []
|
||||||
|
storage_class: MULTI_REGIONAL
|
||||||
|
timeouts: null
|
||||||
|
uniform_bucket_level_access: true
|
||||||
|
versioning:
|
||||||
|
- enabled: false
|
||||||
|
module.bucket.google_storage_bucket_iam_member.bindings["storage-admin-with-delegated_roles"]:
|
||||||
|
bucket: my-bucket
|
||||||
|
condition:
|
||||||
|
- description: null
|
||||||
|
expression: api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly(['roles/storage.objectAdmin','roles/storage.objectViewer'])
|
||||||
|
title: delegated-role-grants
|
||||||
|
member: group:storage@example.com
|
||||||
|
role: roles/storage.admin
|
||||||
|
|
||||||
|
counts:
|
||||||
|
google_storage_bucket: 1
|
||||||
|
google_storage_bucket_iam_member: 1
|
||||||
|
modules: 1
|
||||||
|
resources: 2
|
|
@ -0,0 +1,50 @@
|
||||||
|
# Copyright 2023 Google LLC
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
values:
|
||||||
|
module.bucket.google_storage_bucket.bucket:
|
||||||
|
autoclass: []
|
||||||
|
cors: []
|
||||||
|
custom_placement_config: []
|
||||||
|
default_event_based_hold: null
|
||||||
|
encryption: []
|
||||||
|
force_destroy: false
|
||||||
|
labels: null
|
||||||
|
lifecycle_rule: []
|
||||||
|
location: EU
|
||||||
|
logging: []
|
||||||
|
name: my-bucket
|
||||||
|
project: myproject
|
||||||
|
requester_pays: null
|
||||||
|
retention_policy: []
|
||||||
|
storage_class: MULTI_REGIONAL
|
||||||
|
timeouts: null
|
||||||
|
uniform_bucket_level_access: true
|
||||||
|
versioning:
|
||||||
|
- enabled: false
|
||||||
|
module.bucket.google_storage_bucket_iam_binding.bindings["storage-admin-with-delegated_roles"]:
|
||||||
|
bucket: my-bucket
|
||||||
|
condition:
|
||||||
|
- description: null
|
||||||
|
expression: api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly(['roles/storage.objectAdmin','roles/storage.objectViewer'])
|
||||||
|
title: delegated-role-grants
|
||||||
|
members:
|
||||||
|
- group:storage@example.com
|
||||||
|
role: roles/storage.admin
|
||||||
|
|
||||||
|
counts:
|
||||||
|
google_storage_bucket: 1
|
||||||
|
google_storage_bucket_iam_binding: 1
|
||||||
|
modules: 1
|
||||||
|
resources: 2
|
|
@ -34,13 +34,6 @@ values:
|
||||||
uniform_bucket_level_access: true
|
uniform_bucket_level_access: true
|
||||||
versioning:
|
versioning:
|
||||||
- enabled: true
|
- enabled: true
|
||||||
module.bucket.google_storage_bucket_iam_binding.bindings["roles/storage.admin"]:
|
|
||||||
bucket: test-my-bucket
|
|
||||||
condition: []
|
|
||||||
members:
|
|
||||||
- group:storage@example.com
|
|
||||||
role: roles/storage.admin
|
|
||||||
|
|
||||||
counts:
|
counts:
|
||||||
google_storage_bucket: 1
|
google_storage_bucket: 1
|
||||||
google_storage_bucket_iam_binding: 1
|
|
Loading…
Reference in New Issue