diff --git a/examples/data-solutions/data-platform-foundations/05-datalake.tf b/examples/data-solutions/data-platform-foundations/05-datalake.tf index 31f44051..2377c2c2 100644 --- a/examples/data-solutions/data-platform-foundations/05-datalake.tf +++ b/examples/data-solutions/data-platform-foundations/05-datalake.tf @@ -140,8 +140,8 @@ module "lake-plg-project" { billing_account = var.billing_account_id prefix = var.prefix name = "dtl-plg" - group_iam = local.lake_group_iam - iam = local.lake_iam + group_iam = local.lake_plg_group_iam + iam = {} services = local.lake_services service_encryption_key_ids = { bq = [try(local.service_encryption_keys.bq, null)] diff --git a/examples/data-solutions/data-platform-foundations/IAM.md b/examples/data-solutions/data-platform-foundations/IAM.md index 9d8bcea8..bc641eaa 100644 --- a/examples/data-solutions/data-platform-foundations/IAM.md +++ b/examples/data-solutions/data-platform-foundations/IAM.md @@ -43,10 +43,8 @@ Legend: + additive, conditional. | members | roles | |---|---| -|gcp-data-analysts
group|[roles/bigquery.dataViewer](https://cloud.google.com/iam/docs/understanding-roles#bigquery.dataViewer)
[roles/bigquery.jobUser](https://cloud.google.com/iam/docs/understanding-roles#bigquery.jobUser)
[roles/bigquery.user](https://cloud.google.com/iam/docs/understanding-roles#bigquery.user)
[roles/datacatalog.tagTemplateViewer](https://cloud.google.com/iam/docs/understanding-roles#datacatalog.tagTemplateViewer)
[roles/datacatalog.viewer](https://cloud.google.com/iam/docs/understanding-roles#datacatalog.viewer)
[roles/storage.objectViewer](https://cloud.google.com/iam/docs/understanding-roles#storage.objectViewer) | +|gcp-data-analysts
group|[roles/bigquery.dataEditor](https://cloud.google.com/iam/docs/understanding-roles#bigquery.dataEditor)
[roles/bigquery.jobUser](https://cloud.google.com/iam/docs/understanding-roles#bigquery.jobUser)
[roles/bigquery.user](https://cloud.google.com/iam/docs/understanding-roles#bigquery.user)
[roles/datacatalog.tagTemplateViewer](https://cloud.google.com/iam/docs/understanding-roles#datacatalog.tagTemplateViewer)
[roles/datacatalog.viewer](https://cloud.google.com/iam/docs/understanding-roles#datacatalog.viewer)
[roles/storage.objectAdmin](https://cloud.google.com/iam/docs/understanding-roles#storage.objectAdmin) | |gcp-data-engineers
group|[roles/bigquery.dataEditor](https://cloud.google.com/iam/docs/understanding-roles#bigquery.dataEditor)
[roles/storage.admin](https://cloud.google.com/iam/docs/understanding-roles#storage.admin) | -|trf-bq-0
serviceAccount|[roles/bigquery.dataEditor](https://cloud.google.com/iam/docs/understanding-roles#bigquery.dataEditor)
[roles/bigquery.jobUser](https://cloud.google.com/iam/docs/understanding-roles#bigquery.jobUser) | -|trf-df-0
serviceAccount|[roles/bigquery.dataEditor](https://cloud.google.com/iam/docs/understanding-roles#bigquery.dataEditor)
[roles/storage.objectCreator](https://cloud.google.com/iam/docs/understanding-roles#storage.objectCreator)
[roles/storage.objectViewer](https://cloud.google.com/iam/docs/understanding-roles#storage.objectViewer) | ## Project lnd diff --git a/examples/data-solutions/data-platform-foundations/state.json b/examples/data-solutions/data-platform-foundations/state.json index c48c6540..fbc1957b 100644 --- a/examples/data-solutions/data-platform-foundations/state.json +++ b/examples/data-solutions/data-platform-foundations/state.json @@ -1,7 +1,7 @@ { "version": 4, "terraform_version": "1.1.4", - "serial": 382, + "serial": 389, "lineage": "9a069296-8e71-4472-3a4c-7800c8c7f9bc", "outputs": { "bigquery-datasets": { @@ -559,6 +559,7 @@ "sensitive_attributes": [], "private": "bnVsbA==", "dependencies": [ + "module.common-project.data.google_project.project", "module.common-project.google_project.project", "module.common-project.google_project_iam_custom_role.roles", "module.common-project.google_project_service.project_services", @@ -575,7 +576,6 @@ "module.load-project.google_project_service.project_services", "module.load-project.google_project_service_identity.jit_si", "module.load-sa-df-0.data.google_service_account.service_account", - "module.common-project.data.google_project.project", "module.load-sa-df-0.google_service_account.service_account", "module.transf-project.data.google_bigquery_default_service_account.bq_sa", "module.transf-project.data.google_project.project", @@ -610,6 +610,7 @@ "private": "bnVsbA==", "dependencies": [ "module.common-project.data.google_project.project", + "module.common-project.google_project.project", "module.common-project.google_project_iam_custom_role.roles", "module.common-project.google_project_service.project_services", "module.load-project.data.google_bigquery_default_service_account.bq_sa", @@ -617,7 +618,6 @@ "module.load-project.data.google_storage_project_service_account.gcs_sa", "module.load-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.load-project.google_compute_shared_vpc_service_project.service_projects", - "module.common-project.google_project.project", "module.load-project.google_kms_crypto_key_iam_member.service_identity_cmek", "module.load-project.google_project.project", "module.load-project.google_project_iam_member.shared_vpc_host_robots", @@ -1122,24 +1122,32 @@ "module.lake-0-project.google_project.project", "module.lake-0-project.google_project_iam_custom_role.roles", "module.lake-0-project.google_project_service.project_services", + "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.data.google_project.project", + "module.load-project.data.google_storage_project_service_account.gcs_sa", + "module.load-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.load-project.google_compute_shared_vpc_service_project.service_projects", "module.load-project.google_kms_crypto_key_iam_member.service_identity_cmek", - "module.load-project.google_project.project", "module.load-project.google_project_iam_member.shared_vpc_host_robots", + "module.load-project.google_project.project", "module.load-project.google_project_organization_policy.boolean", "module.load-project.google_project_organization_policy.list", "module.load-project.google_project_service.project_services", + "module.load-project.google_project_service_identity.jit_si", "module.load-sa-df-0.data.google_service_account.service_account", "module.load-sa-df-0.google_service_account.service_account", + "module.transf-project.data.google_bigquery_default_service_account.bq_sa", "module.transf-project.data.google_project.project", - "module.transf-project.google_compute_shared_vpc_service_project.service_projects", + "module.transf-project.data.google_storage_project_service_account.gcs_sa", + "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", "module.transf-project.google_project.project", "module.transf-project.google_project_iam_member.shared_vpc_host_robots", + "module.transf-project.google_compute_shared_vpc_service_project.service_projects", "module.transf-project.google_project_organization_policy.boolean", "module.transf-project.google_project_organization_policy.list", "module.transf-project.google_project_service.project_services", + "module.transf-project.google_project_service_identity.jit_si", "module.transf-sa-bq-0.data.google_service_account.service_account", "module.transf-sa-bq-0.google_service_account.service_account", "module.transf-sa-df-0.data.google_service_account.service_account", @@ -1162,6 +1170,7 @@ "sensitive_attributes": [], "private": "bnVsbA==", "dependencies": [ + "module.lake-0-project.data.google_project.project", "module.lake-0-project.google_project.project", "module.lake-0-project.google_project_iam_custom_role.roles", "module.lake-0-project.google_project_service.project_services", @@ -1174,12 +1183,11 @@ "module.load-project.google_project.project", "module.load-project.google_project_iam_member.shared_vpc_host_robots", "module.load-project.google_project_organization_policy.boolean", - "module.lake-0-project.data.google_project.project", "module.load-project.google_project_organization_policy.list", "module.load-project.google_project_service.project_services", "module.load-project.google_project_service_identity.jit_si", - "module.load-sa-df-0.google_service_account.service_account", "module.load-sa-df-0.data.google_service_account.service_account", + "module.load-sa-df-0.google_service_account.service_account", "module.transf-project.data.google_bigquery_default_service_account.bq_sa", "module.transf-project.data.google_project.project", "module.transf-project.data.google_storage_project_service_account.gcs_sa", @@ -1326,25 +1334,25 @@ "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.data.google_project.project", "module.load-project.data.google_storage_project_service_account.gcs_sa", - "module.load-project.google_compute_shared_vpc_service_project.service_projects", "module.load-project.google_compute_shared_vpc_host_project.shared_vpc_host", + "module.load-project.google_compute_shared_vpc_service_project.service_projects", "module.load-project.google_kms_crypto_key_iam_member.service_identity_cmek", - "module.load-project.google_project.project", "module.load-project.google_project_iam_member.shared_vpc_host_robots", + "module.load-project.google_project.project", "module.load-project.google_project_organization_policy.boolean", "module.load-project.google_project_organization_policy.list", + "module.load-project.google_project_service.project_services", "module.load-project.google_project_service_identity.jit_si", "module.load-sa-df-0.data.google_service_account.service_account", - "module.load-project.google_project_service.project_services", "module.load-sa-df-0.google_service_account.service_account", "module.transf-project.data.google_bigquery_default_service_account.bq_sa", - "module.transf-project.data.google_project.project", "module.transf-project.data.google_storage_project_service_account.gcs_sa", "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", - "module.transf-project.google_compute_shared_vpc_service_project.service_projects", "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", "module.transf-project.google_project.project", "module.transf-project.google_project_iam_member.shared_vpc_host_robots", + "module.transf-project.data.google_project.project", + "module.transf-project.google_compute_shared_vpc_service_project.service_projects", "module.transf-project.google_project_organization_policy.boolean", "module.transf-project.google_project_organization_policy.list", "module.transf-project.google_project_service.project_services", @@ -1371,17 +1379,18 @@ "sensitive_attributes": [], "private": "bnVsbA==", "dependencies": [ - "module.lake-0-project.data.google_project.project", - "module.lake-0-project.google_project.project", + "module.transf-project.data.google_bigquery_default_service_account.bq_sa", "module.lake-0-project.google_project_iam_custom_role.roles", "module.lake-0-project.google_project_service.project_services", - "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.data.google_project.project", + "module.load-project.google_kms_crypto_key_iam_member.service_identity_cmek", + "module.lake-0-project.data.google_project.project", "module.load-project.data.google_storage_project_service_account.gcs_sa", + "module.load-project.google_project.project", + "module.lake-0-project.google_project.project", + "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.load-project.google_compute_shared_vpc_service_project.service_projects", - "module.load-project.google_kms_crypto_key_iam_member.service_identity_cmek", - "module.load-project.google_project.project", "module.load-project.google_project_iam_member.shared_vpc_host_robots", "module.load-project.google_project_organization_policy.boolean", "module.load-project.google_project_organization_policy.list", @@ -1389,7 +1398,6 @@ "module.load-project.google_project_service_identity.jit_si", "module.load-sa-df-0.data.google_service_account.service_account", "module.load-sa-df-0.google_service_account.service_account", - "module.transf-project.data.google_bigquery_default_service_account.bq_sa", "module.transf-project.data.google_project.project", "module.transf-project.data.google_storage_project_service_account.gcs_sa", "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", @@ -1482,16 +1490,16 @@ "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.data.google_project.project", "module.load-project.data.google_storage_project_service_account.gcs_sa", - "module.load-project.google_compute_shared_vpc_service_project.service_projects", "module.load-project.google_compute_shared_vpc_host_project.shared_vpc_host", + "module.load-project.google_compute_shared_vpc_service_project.service_projects", "module.load-project.google_kms_crypto_key_iam_member.service_identity_cmek", "module.load-project.google_project.project", "module.load-project.google_project_iam_member.shared_vpc_host_robots", "module.load-project.google_project_organization_policy.boolean", "module.load-project.google_project_organization_policy.list", + "module.load-project.google_project_service.project_services", "module.load-project.google_project_service_identity.jit_si", "module.load-sa-df-0.data.google_service_account.service_account", - "module.load-project.google_project_service.project_services", "module.load-sa-df-0.google_service_account.service_account", "module.transf-project.data.google_bigquery_default_service_account.bq_sa", "module.transf-project.data.google_project.project", @@ -1543,8 +1551,8 @@ "module.load-project.google_project_organization_policy.list", "module.load-project.google_project_service.project_services", "module.load-project.google_project_service_identity.jit_si", - "module.load-sa-df-0.google_service_account.service_account", "module.load-sa-df-0.data.google_service_account.service_account", + "module.load-sa-df-0.google_service_account.service_account", "module.transf-project.data.google_bigquery_default_service_account.bq_sa", "module.transf-project.data.google_project.project", "module.transf-project.data.google_storage_project_service_account.gcs_sa", @@ -2347,6 +2355,7 @@ "private": "bnVsbA==", "dependencies": [ "module.lake-1-project.data.google_project.project", + "module.lake-1-project.google_project.project", "module.lake-1-project.google_project_iam_custom_role.roles", "module.lake-1-project.google_project_service.project_services", "module.transf-project.data.google_bigquery_default_service_account.bq_sa", @@ -2356,7 +2365,6 @@ "module.transf-project.google_compute_shared_vpc_service_project.service_projects", "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", "module.transf-project.google_project.project", - "module.lake-1-project.google_project.project", "module.transf-project.google_project_iam_member.shared_vpc_host_robots", "module.transf-project.google_project_organization_policy.boolean", "module.transf-project.google_project_organization_policy.list", @@ -2923,8 +2931,8 @@ "sensitive_attributes": [], "private": "bnVsbA==", "dependencies": [ + "module.lake-2-project.data.google_project.project", "module.lake-2-project.google_project.project", - "module.transf-project.google_project.project", "module.lake-2-project.google_project_iam_custom_role.roles", "module.lake-2-project.google_project_service.project_services", "module.transf-project.data.google_bigquery_default_service_account.bq_sa", @@ -2933,7 +2941,7 @@ "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.transf-project.google_compute_shared_vpc_service_project.service_projects", "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", - "module.lake-2-project.data.google_project.project", + "module.transf-project.google_project.project", "module.transf-project.google_project_iam_member.shared_vpc_host_robots", "module.transf-project.google_project_organization_policy.boolean", "module.transf-project.google_project_organization_policy.list", @@ -2962,16 +2970,16 @@ "private": "bnVsbA==", "dependencies": [ "module.lake-2-project.data.google_project.project", + "module.lake-2-project.google_project.project", "module.lake-2-project.google_project_iam_custom_role.roles", "module.lake-2-project.google_project_service.project_services", "module.transf-project.data.google_bigquery_default_service_account.bq_sa", - "module.transf-project.google_project.project", - "module.lake-2-project.google_project.project", "module.transf-project.data.google_project.project", "module.transf-project.data.google_storage_project_service_account.gcs_sa", "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.transf-project.google_compute_shared_vpc_service_project.service_projects", "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", + "module.transf-project.google_project.project", "module.transf-project.google_project_iam_member.shared_vpc_host_robots", "module.transf-project.google_project_organization_policy.boolean", "module.transf-project.google_project_organization_policy.list", @@ -3000,12 +3008,12 @@ "sensitive_attributes": [], "private": "bnVsbA==", "dependencies": [ + "module.lake-2-project.data.google_project.project", "module.lake-2-project.google_project.project", "module.lake-2-project.google_project_iam_custom_role.roles", "module.lake-2-project.google_project_service.project_services", - "module.transf-project.data.google_project.project", "module.transf-project.data.google_bigquery_default_service_account.bq_sa", - "module.lake-2-project.data.google_project.project", + "module.transf-project.data.google_project.project", "module.transf-project.data.google_storage_project_service_account.gcs_sa", "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.transf-project.google_compute_shared_vpc_service_project.service_projects", @@ -3229,18 +3237,18 @@ "sensitive_attributes": [], "private": "bnVsbA==", "dependencies": [ + "module.lake-2-project.data.google_project.project", "module.lake-2-project.google_project.project", "module.lake-2-project.google_project_iam_custom_role.roles", "module.lake-2-project.google_project_service.project_services", - "module.transf-project.data.google_project.project", "module.transf-project.data.google_bigquery_default_service_account.bq_sa", - "module.transf-project.google_project_iam_member.shared_vpc_host_robots", + "module.transf-project.data.google_project.project", "module.transf-project.data.google_storage_project_service_account.gcs_sa", "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.transf-project.google_compute_shared_vpc_service_project.service_projects", "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", - "module.lake-2-project.data.google_project.project", "module.transf-project.google_project.project", + "module.transf-project.google_project_iam_member.shared_vpc_host_robots", "module.transf-project.google_project_organization_policy.boolean", "module.transf-project.google_project_organization_policy.list", "module.transf-project.google_project_service.project_services", @@ -3754,12 +3762,11 @@ "schema_version": 0, "attributes": { "condition": [], - "etag": "BwXXzVpxCoU=", + "etag": "BwXXzofnD34=", "id": "lc0210-dtl-plg/roles/bigquery.dataEditor", "members": [ - "group:gcp-data-engineers@caggioland.com", - "serviceAccount:lc0210-trf-bq-0@lc0210-trf.iam.gserviceaccount.com", - "serviceAccount:lc0210-trf-df-0@lc0210-trf.iam.gserviceaccount.com" + "group:gcp-data-analysts@caggioland.com", + "group:gcp-data-engineers@caggioland.com" ], "project": "lc0210-dtl-plg", "role": "roles/bigquery.dataEditor" @@ -3770,61 +3777,7 @@ "module.lake-plg-project.data.google_project.project", "module.lake-plg-project.google_project.project", "module.lake-plg-project.google_project_iam_custom_role.roles", - "module.lake-plg-project.google_project_service.project_services", - "module.transf-project.data.google_bigquery_default_service_account.bq_sa", - "module.transf-project.data.google_project.project", - "module.transf-project.data.google_storage_project_service_account.gcs_sa", - "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", - "module.transf-project.google_compute_shared_vpc_service_project.service_projects", - "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", - "module.transf-project.google_project.project", - "module.transf-project.google_project_iam_member.shared_vpc_host_robots", - "module.transf-project.google_project_organization_policy.boolean", - "module.transf-project.google_project_organization_policy.list", - "module.transf-project.google_project_service.project_services", - "module.transf-project.google_project_service_identity.jit_si", - "module.transf-sa-bq-0.data.google_service_account.service_account", - "module.transf-sa-bq-0.google_service_account.service_account", - "module.transf-sa-df-0.data.google_service_account.service_account", - "module.transf-sa-df-0.google_service_account.service_account" - ] - }, - { - "index_key": "roles/bigquery.dataViewer", - "schema_version": 0, - "attributes": { - "condition": [], - "etag": "BwXXpdPN95A=", - "id": "lc0210-dtl-plg/roles/bigquery.dataViewer", - "members": [ - "group:gcp-data-analysts@caggioland.com" - ], - "project": "lc0210-dtl-plg", - "role": "roles/bigquery.dataViewer" - }, - "sensitive_attributes": [], - "private": "bnVsbA==", - "dependencies": [ - "module.lake-plg-project.data.google_project.project", - "module.lake-plg-project.google_project.project", - "module.lake-plg-project.google_project_iam_custom_role.roles", - "module.lake-plg-project.google_project_service.project_services", - "module.transf-project.data.google_bigquery_default_service_account.bq_sa", - "module.transf-project.data.google_project.project", - "module.transf-project.data.google_storage_project_service_account.gcs_sa", - "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", - "module.transf-project.google_compute_shared_vpc_service_project.service_projects", - "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", - "module.transf-project.google_project.project", - "module.transf-project.google_project_iam_member.shared_vpc_host_robots", - "module.transf-project.google_project_organization_policy.boolean", - "module.transf-project.google_project_organization_policy.list", - "module.transf-project.google_project_service.project_services", - "module.transf-project.google_project_service_identity.jit_si", - "module.transf-sa-bq-0.data.google_service_account.service_account", - "module.transf-sa-bq-0.google_service_account.service_account", - "module.transf-sa-df-0.data.google_service_account.service_account", - "module.transf-sa-df-0.google_service_account.service_account" + "module.lake-plg-project.google_project_service.project_services" ] }, { @@ -3832,11 +3785,10 @@ "schema_version": 0, "attributes": { "condition": [], - "etag": "BwXXzVnXEKE=", + "etag": "BwXXzofnD34=", "id": "lc0210-dtl-plg/roles/bigquery.jobUser", "members": [ - "group:gcp-data-analysts@caggioland.com", - "serviceAccount:lc0210-trf-bq-0@lc0210-trf.iam.gserviceaccount.com" + "group:gcp-data-analysts@caggioland.com" ], "project": "lc0210-dtl-plg", "role": "roles/bigquery.jobUser" @@ -3847,23 +3799,7 @@ "module.lake-plg-project.data.google_project.project", "module.lake-plg-project.google_project.project", "module.lake-plg-project.google_project_iam_custom_role.roles", - "module.lake-plg-project.google_project_service.project_services", - "module.transf-project.data.google_bigquery_default_service_account.bq_sa", - "module.transf-project.data.google_project.project", - "module.transf-project.data.google_storage_project_service_account.gcs_sa", - "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", - "module.transf-project.google_compute_shared_vpc_service_project.service_projects", - "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", - "module.transf-project.google_project.project", - "module.transf-project.google_project_iam_member.shared_vpc_host_robots", - "module.transf-project.google_project_organization_policy.boolean", - "module.transf-project.google_project_organization_policy.list", - "module.transf-project.google_project_service.project_services", - "module.transf-project.google_project_service_identity.jit_si", - "module.transf-sa-bq-0.data.google_service_account.service_account", - "module.transf-sa-bq-0.google_service_account.service_account", - "module.transf-sa-df-0.data.google_service_account.service_account", - "module.transf-sa-df-0.google_service_account.service_account" + "module.lake-plg-project.google_project_service.project_services" ] }, { @@ -3885,23 +3821,7 @@ "module.lake-plg-project.data.google_project.project", "module.lake-plg-project.google_project.project", "module.lake-plg-project.google_project_iam_custom_role.roles", - "module.lake-plg-project.google_project_service.project_services", - "module.transf-project.data.google_bigquery_default_service_account.bq_sa", - "module.transf-project.data.google_project.project", - "module.transf-project.data.google_storage_project_service_account.gcs_sa", - "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", - "module.transf-project.google_compute_shared_vpc_service_project.service_projects", - "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", - "module.transf-project.google_project.project", - "module.transf-project.google_project_iam_member.shared_vpc_host_robots", - "module.transf-project.google_project_organization_policy.boolean", - "module.transf-project.google_project_organization_policy.list", - "module.transf-project.google_project_service.project_services", - "module.transf-project.google_project_service_identity.jit_si", - "module.transf-sa-bq-0.data.google_service_account.service_account", - "module.transf-sa-bq-0.google_service_account.service_account", - "module.transf-sa-df-0.data.google_service_account.service_account", - "module.transf-sa-df-0.google_service_account.service_account" + "module.lake-plg-project.google_project_service.project_services" ] }, { @@ -3922,24 +3842,8 @@ "dependencies": [ "module.lake-plg-project.data.google_project.project", "module.lake-plg-project.google_project.project", - "module.transf-project.google_project_iam_member.shared_vpc_host_robots", - "module.lake-plg-project.google_project_service.project_services", - "module.transf-project.data.google_bigquery_default_service_account.bq_sa", - "module.transf-project.data.google_project.project", - "module.transf-project.data.google_storage_project_service_account.gcs_sa", - "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", - "module.transf-project.google_compute_shared_vpc_service_project.service_projects", - "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", - "module.transf-project.google_project.project", "module.lake-plg-project.google_project_iam_custom_role.roles", - "module.transf-project.google_project_organization_policy.boolean", - "module.transf-project.google_project_organization_policy.list", - "module.transf-project.google_project_service.project_services", - "module.transf-project.google_project_service_identity.jit_si", - "module.transf-sa-bq-0.data.google_service_account.service_account", - "module.transf-sa-bq-0.google_service_account.service_account", - "module.transf-sa-df-0.data.google_service_account.service_account", - "module.transf-sa-df-0.google_service_account.service_account" + "module.lake-plg-project.google_project_service.project_services" ] }, { @@ -3958,26 +3862,10 @@ "sensitive_attributes": [], "private": "bnVsbA==", "dependencies": [ - "module.lake-plg-project.google_project.project", "module.lake-plg-project.data.google_project.project", - "module.lake-plg-project.google_project_service.project_services", - "module.transf-project.data.google_bigquery_default_service_account.bq_sa", - "module.transf-project.data.google_project.project", - "module.transf-project.data.google_storage_project_service_account.gcs_sa", - "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", - "module.transf-project.google_compute_shared_vpc_service_project.service_projects", - "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", - "module.transf-project.google_project.project", + "module.lake-plg-project.google_project.project", "module.lake-plg-project.google_project_iam_custom_role.roles", - "module.transf-project.google_project_iam_member.shared_vpc_host_robots", - "module.transf-project.google_project_organization_policy.boolean", - "module.transf-project.google_project_organization_policy.list", - "module.transf-project.google_project_service.project_services", - "module.transf-project.google_project_service_identity.jit_si", - "module.transf-sa-bq-0.data.google_service_account.service_account", - "module.transf-sa-bq-0.google_service_account.service_account", - "module.transf-sa-df-0.data.google_service_account.service_account", - "module.transf-sa-df-0.google_service_account.service_account" + "module.lake-plg-project.google_project_service.project_services" ] }, { @@ -3999,37 +3887,21 @@ "module.lake-plg-project.data.google_project.project", "module.lake-plg-project.google_project.project", "module.lake-plg-project.google_project_iam_custom_role.roles", - "module.lake-plg-project.google_project_service.project_services", - "module.transf-project.data.google_bigquery_default_service_account.bq_sa", - "module.transf-project.data.google_project.project", - "module.transf-project.data.google_storage_project_service_account.gcs_sa", - "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", - "module.transf-project.google_compute_shared_vpc_service_project.service_projects", - "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", - "module.transf-project.google_project.project", - "module.transf-project.google_project_iam_member.shared_vpc_host_robots", - "module.transf-project.google_project_organization_policy.boolean", - "module.transf-project.google_project_organization_policy.list", - "module.transf-project.google_project_service.project_services", - "module.transf-project.google_project_service_identity.jit_si", - "module.transf-sa-bq-0.data.google_service_account.service_account", - "module.transf-sa-bq-0.google_service_account.service_account", - "module.transf-sa-df-0.data.google_service_account.service_account", - "module.transf-sa-df-0.google_service_account.service_account" + "module.lake-plg-project.google_project_service.project_services" ] }, { - "index_key": "roles/storage.objectCreator", + "index_key": "roles/storage.objectAdmin", "schema_version": 0, "attributes": { "condition": [], - "etag": "BwXXzeS/a5A=", - "id": "lc0210-dtl-plg/roles/storage.objectCreator", + "etag": "BwXXzofnD34=", + "id": "lc0210-dtl-plg/roles/storage.objectAdmin", "members": [ - "serviceAccount:lc0210-trf-df-0@lc0210-trf.iam.gserviceaccount.com" + "group:gcp-data-analysts@caggioland.com" ], "project": "lc0210-dtl-plg", - "role": "roles/storage.objectCreator" + "role": "roles/storage.objectAdmin" }, "sensitive_attributes": [], "private": "bnVsbA==", @@ -4037,62 +3909,7 @@ "module.lake-plg-project.data.google_project.project", "module.lake-plg-project.google_project.project", "module.lake-plg-project.google_project_iam_custom_role.roles", - "module.lake-plg-project.google_project_service.project_services", - "module.transf-project.data.google_bigquery_default_service_account.bq_sa", - "module.transf-project.data.google_project.project", - "module.transf-project.data.google_storage_project_service_account.gcs_sa", - "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", - "module.transf-project.google_compute_shared_vpc_service_project.service_projects", - "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", - "module.transf-project.google_project.project", - "module.transf-project.google_project_iam_member.shared_vpc_host_robots", - "module.transf-project.google_project_organization_policy.boolean", - "module.transf-project.google_project_organization_policy.list", - "module.transf-project.google_project_service.project_services", - "module.transf-project.google_project_service_identity.jit_si", - "module.transf-sa-bq-0.data.google_service_account.service_account", - "module.transf-sa-bq-0.google_service_account.service_account", - "module.transf-sa-df-0.data.google_service_account.service_account", - "module.transf-sa-df-0.google_service_account.service_account" - ] - }, - { - "index_key": "roles/storage.objectViewer", - "schema_version": 0, - "attributes": { - "condition": [], - "etag": "BwXXzVpxCoU=", - "id": "lc0210-dtl-plg/roles/storage.objectViewer", - "members": [ - "group:gcp-data-analysts@caggioland.com", - "serviceAccount:lc0210-trf-df-0@lc0210-trf.iam.gserviceaccount.com" - ], - "project": "lc0210-dtl-plg", - "role": "roles/storage.objectViewer" - }, - "sensitive_attributes": [], - "private": "bnVsbA==", - "dependencies": [ - "module.lake-plg-project.data.google_project.project", - "module.lake-plg-project.google_project.project", - "module.lake-plg-project.google_project_iam_custom_role.roles", - "module.lake-plg-project.google_project_service.project_services", - "module.transf-project.data.google_bigquery_default_service_account.bq_sa", - "module.transf-project.data.google_project.project", - "module.transf-project.data.google_storage_project_service_account.gcs_sa", - "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", - "module.transf-project.google_compute_shared_vpc_service_project.service_projects", - "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", - "module.transf-project.google_project.project", - "module.transf-project.google_project_iam_member.shared_vpc_host_robots", - "module.transf-project.google_project_organization_policy.boolean", - "module.transf-project.google_project_organization_policy.list", - "module.transf-project.google_project_service.project_services", - "module.transf-project.google_project_service_identity.jit_si", - "module.transf-sa-bq-0.data.google_service_account.service_account", - "module.transf-sa-bq-0.google_service_account.service_account", - "module.transf-sa-df-0.data.google_service_account.service_account", - "module.transf-sa-df-0.google_service_account.service_account" + "module.lake-plg-project.google_project_service.project_services" ] } ] @@ -4627,7 +4444,7 @@ "module.land-sa-bq-0.google_service_account.service_account", "module.land-sa-cs-0.data.google_service_account.service_account", "module.land-sa-cs-0.google_service_account.service_account", - "module.land-sa-ps-0.data.google_service_account.service_account", + "module.land-sa-ps-0.google_service_account.service_account", "module.land-sa-ps-0.google_service_account.service_account", "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.data.google_project.project", @@ -4692,7 +4509,7 @@ "module.land-sa-bq-0.google_service_account.service_account", "module.land-sa-cs-0.data.google_service_account.service_account", "module.land-sa-cs-0.google_service_account.service_account", - "module.land-sa-ps-0.data.google_service_account.service_account", + "module.land-sa-ps-0.google_service_account.service_account", "module.land-sa-ps-0.google_service_account.service_account", "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.data.google_project.project", @@ -4757,7 +4574,7 @@ "module.land-sa-bq-0.google_service_account.service_account", "module.land-sa-cs-0.data.google_service_account.service_account", "module.land-sa-cs-0.google_service_account.service_account", - "module.land-sa-ps-0.data.google_service_account.service_account", + "module.land-sa-ps-0.google_service_account.service_account", "module.land-sa-ps-0.google_service_account.service_account", "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.data.google_project.project", @@ -4822,7 +4639,7 @@ "module.land-sa-bq-0.google_service_account.service_account", "module.land-sa-cs-0.data.google_service_account.service_account", "module.land-sa-cs-0.google_service_account.service_account", - "module.land-sa-ps-0.data.google_service_account.service_account", + "module.land-sa-ps-0.google_service_account.service_account", "module.land-sa-ps-0.google_service_account.service_account", "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.data.google_project.project", @@ -4888,7 +4705,7 @@ "module.land-sa-bq-0.google_service_account.service_account", "module.land-sa-cs-0.data.google_service_account.service_account", "module.land-sa-cs-0.google_service_account.service_account", - "module.land-sa-ps-0.data.google_service_account.service_account", + "module.land-sa-ps-0.google_service_account.service_account", "module.land-sa-ps-0.google_service_account.service_account", "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.data.google_project.project", @@ -4947,18 +4764,17 @@ "module.land-project.google_project_iam_custom_role.roles", "module.land-project.google_project_iam_member.shared_vpc_host_robots", "module.land-project.google_project_organization_policy.boolean", - "module.land-project.google_project_organization_policy.list", "module.land-project.google_project_service.project_services", "module.land-project.google_project_service_identity.jit_si", "module.land-sa-bq-0.data.google_service_account.service_account", + "module.land-project.google_project_organization_policy.list", "module.land-sa-bq-0.google_service_account.service_account", "module.land-sa-cs-0.data.google_service_account.service_account", "module.land-sa-cs-0.google_service_account.service_account", - "module.land-sa-ps-0.data.google_service_account.service_account", + "module.land-sa-ps-0.google_service_account.service_account", "module.land-sa-ps-0.google_service_account.service_account", "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.data.google_project.project", - "module.load-project.data.google_storage_project_service_account.gcs_sa", "module.load-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.load-project.google_compute_shared_vpc_service_project.service_projects", "module.load-project.google_kms_crypto_key_iam_member.service_identity_cmek", @@ -4972,6 +4788,7 @@ "module.load-sa-df-0.google_service_account.service_account", "module.orch-project.data.google_bigquery_default_service_account.bq_sa", "module.orch-project.data.google_project.project", + "module.load-project.data.google_storage_project_service_account.gcs_sa", "module.orch-project.data.google_storage_project_service_account.gcs_sa", "module.orch-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.orch-project.google_compute_shared_vpc_service_project.service_projects", @@ -5012,31 +4829,31 @@ "module.land-project.google_project_iam_custom_role.roles", "module.land-project.google_project_iam_member.shared_vpc_host_robots", "module.land-project.google_project_organization_policy.boolean", - "module.land-project.google_project_organization_policy.list", "module.land-project.google_project_service.project_services", "module.land-project.google_project_service_identity.jit_si", "module.land-sa-bq-0.data.google_service_account.service_account", "module.land-sa-bq-0.google_service_account.service_account", - "module.land-sa-cs-0.data.google_service_account.service_account", + "module.land-project.google_project_organization_policy.list", "module.land-sa-cs-0.google_service_account.service_account", - "module.land-sa-ps-0.data.google_service_account.service_account", + "module.land-sa-ps-0.google_service_account.service_account", "module.land-sa-ps-0.google_service_account.service_account", "module.load-project.data.google_bigquery_default_service_account.bq_sa", - "module.load-project.data.google_project.project", - "module.load-project.data.google_storage_project_service_account.gcs_sa", - "module.load-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.load-project.google_compute_shared_vpc_service_project.service_projects", + "module.land-sa-cs-0.data.google_service_account.service_account", + "module.load-project.data.google_project.project", + "module.load-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.load-project.google_kms_crypto_key_iam_member.service_identity_cmek", "module.load-project.google_project.project", "module.load-project.google_project_iam_member.shared_vpc_host_robots", - "module.load-project.google_project_organization_policy.boolean", "module.load-project.google_project_organization_policy.list", + "module.load-project.google_project_organization_policy.boolean", "module.load-project.google_project_service.project_services", "module.load-project.google_project_service_identity.jit_si", "module.load-sa-df-0.data.google_service_account.service_account", "module.load-sa-df-0.google_service_account.service_account", "module.orch-project.data.google_bigquery_default_service_account.bq_sa", "module.orch-project.data.google_project.project", + "module.load-project.data.google_storage_project_service_account.gcs_sa", "module.orch-project.data.google_storage_project_service_account.gcs_sa", "module.orch-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.orch-project.google_compute_shared_vpc_service_project.service_projects", @@ -5084,7 +4901,7 @@ "module.land-sa-bq-0.google_service_account.service_account", "module.land-sa-cs-0.data.google_service_account.service_account", "module.land-sa-cs-0.google_service_account.service_account", - "module.land-sa-ps-0.data.google_service_account.service_account", + "module.land-sa-ps-0.google_service_account.service_account", "module.land-sa-ps-0.google_service_account.service_account", "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.data.google_project.project", @@ -5149,7 +4966,7 @@ "module.land-sa-bq-0.google_service_account.service_account", "module.land-sa-cs-0.data.google_service_account.service_account", "module.land-sa-cs-0.google_service_account.service_account", - "module.land-sa-ps-0.data.google_service_account.service_account", + "module.land-sa-ps-0.google_service_account.service_account", "module.land-sa-ps-0.google_service_account.service_account", "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.data.google_project.project", @@ -6061,7 +5878,6 @@ "sensitive_attributes": [], "private": "bnVsbA==", "dependencies": [ - "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.data.google_project.project", "module.load-project.data.google_storage_project_service_account.gcs_sa", "module.load-project.google_compute_shared_vpc_host_project.shared_vpc_host", @@ -6071,6 +5887,7 @@ "module.load-project.google_project_iam_custom_role.roles", "module.load-project.google_project_iam_member.shared_vpc_host_robots", "module.load-project.google_project_organization_policy.boolean", + "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.google_project_organization_policy.list", "module.load-project.google_project_service.project_services", "module.load-project.google_project_service_identity.jit_si", @@ -7379,18 +7196,18 @@ "sensitive_attributes": [], "private": "bnVsbA==", "dependencies": [ + "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.data.google_project.project", "module.load-project.data.google_storage_project_service_account.gcs_sa", - "module.load-project.data.google_bigquery_default_service_account.bq_sa", "module.load-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.load-project.google_compute_shared_vpc_service_project.service_projects", + "module.load-project.google_kms_crypto_key_iam_member.service_identity_cmek", "module.load-project.google_project.project", "module.load-project.google_project_iam_member.shared_vpc_host_robots", "module.load-project.google_project_organization_policy.boolean", "module.load-project.google_project_organization_policy.list", "module.load-project.google_project_service.project_services", "module.load-project.google_project_service_identity.jit_si", - "module.load-project.google_kms_crypto_key_iam_member.service_identity_cmek", "module.load-sa-df-0.data.google_service_account.service_account", "module.load-sa-df-0.google_service_account.service_account", "module.orch-project.data.google_bigquery_default_service_account.bq_sa", @@ -7470,8 +7287,8 @@ "module.orch-project.google_project_service_identity.jit_si", "module.orch-sa-cmp-0.data.google_service_account.service_account", "module.orch-sa-cmp-0.google_service_account.service_account", - "module.transf-project.data.google_bigquery_default_service_account.bq_sa", "module.transf-project.data.google_project.project", + "module.transf-project.data.google_bigquery_default_service_account.bq_sa", "module.transf-project.data.google_storage_project_service_account.gcs_sa", "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.transf-project.google_compute_shared_vpc_service_project.service_projects", @@ -7825,12 +7642,12 @@ "module.orch-project.data.google_bigquery_default_service_account.bq_sa", "module.orch-project.data.google_project.project", "module.orch-project.data.google_storage_project_service_account.gcs_sa", - "module.orch-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.orch-project.google_compute_shared_vpc_service_project.service_projects", "module.orch-project.google_kms_crypto_key_iam_member.service_identity_cmek", "module.orch-project.google_project.project", "module.orch-project.google_project_iam_custom_role.roles", "module.orch-project.google_project_iam_member.shared_vpc_host_robots", + "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.orch-project.google_project_organization_policy.boolean", "module.orch-project.google_project_organization_policy.list", "module.orch-project.google_project_service.project_services", @@ -7840,7 +7657,7 @@ "module.transf-project.data.google_bigquery_default_service_account.bq_sa", "module.transf-project.data.google_project.project", "module.transf-project.data.google_storage_project_service_account.gcs_sa", - "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", + "module.orch-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.transf-project.google_compute_shared_vpc_service_project.service_projects", "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", "module.transf-project.google_project.project", @@ -7886,12 +7703,11 @@ "module.orch-project.data.google_bigquery_default_service_account.bq_sa", "module.orch-project.data.google_project.project", "module.orch-project.data.google_storage_project_service_account.gcs_sa", - "module.orch-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.orch-project.google_compute_shared_vpc_service_project.service_projects", "module.orch-project.google_kms_crypto_key_iam_member.service_identity_cmek", "module.orch-project.google_project.project", "module.orch-project.google_project_iam_custom_role.roles", - "module.orch-project.google_project_iam_member.shared_vpc_host_robots", + "module.orch-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.orch-project.google_project_organization_policy.boolean", "module.orch-project.google_project_organization_policy.list", "module.orch-project.google_project_service.project_services", @@ -7900,8 +7716,9 @@ "module.orch-sa-cmp-0.google_service_account.service_account", "module.transf-project.data.google_bigquery_default_service_account.bq_sa", "module.transf-project.data.google_project.project", - "module.transf-project.data.google_storage_project_service_account.gcs_sa", "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", + "module.orch-project.google_project_iam_member.shared_vpc_host_robots", + "module.transf-project.data.google_storage_project_service_account.gcs_sa", "module.transf-project.google_compute_shared_vpc_service_project.service_projects", "module.transf-project.google_kms_crypto_key_iam_member.service_identity_cmek", "module.transf-project.google_project.project", @@ -9284,14 +9101,13 @@ "sensitive_attributes": [], "private": "bnVsbA==", "dependencies": [ - "module.transf-project.data.google_project.project", + "module.orch-project.data.google_bigquery_default_service_account.bq_sa", "module.orch-project.data.google_project.project", "module.orch-project.data.google_storage_project_service_account.gcs_sa", "module.orch-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.orch-project.google_compute_shared_vpc_service_project.service_projects", "module.orch-project.google_kms_crypto_key_iam_member.service_identity_cmek", "module.orch-project.google_project.project", - "module.orch-project.data.google_bigquery_default_service_account.bq_sa", "module.orch-project.google_project_iam_member.shared_vpc_host_robots", "module.orch-project.google_project_organization_policy.boolean", "module.orch-project.google_project_organization_policy.list", @@ -9300,6 +9116,7 @@ "module.orch-sa-cmp-0.data.google_service_account.service_account", "module.orch-sa-cmp-0.google_service_account.service_account", "module.transf-project.data.google_bigquery_default_service_account.bq_sa", + "module.transf-project.data.google_project.project", "module.transf-project.data.google_storage_project_service_account.gcs_sa", "module.transf-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.transf-project.google_compute_shared_vpc_service_project.service_projects", @@ -9383,16 +9200,16 @@ "sensitive_attributes": [], "private": "bnVsbA==", "dependencies": [ - "module.orch-project.data.google_bigquery_default_service_account.bq_sa", "module.orch-project.data.google_project.project", - "module.orch-project.data.google_storage_project_service_account.gcs_sa", + "module.orch-project.data.google_bigquery_default_service_account.bq_sa", + "module.orch-project.google_project_organization_policy.list", "module.orch-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.orch-project.google_compute_shared_vpc_service_project.service_projects", "module.orch-project.google_kms_crypto_key_iam_member.service_identity_cmek", "module.orch-project.google_project.project", "module.orch-project.google_project_iam_member.shared_vpc_host_robots", "module.orch-project.google_project_organization_policy.boolean", - "module.orch-project.google_project_organization_policy.list", + "module.orch-project.data.google_storage_project_service_account.gcs_sa", "module.orch-project.google_project_service.project_services", "module.orch-project.google_project_service_identity.jit_si", "module.orch-sa-cmp-0.data.google_service_account.service_account", @@ -9433,8 +9250,8 @@ "sensitive_attributes": [], "private": "bnVsbA==", "dependencies": [ - "module.orch-project.data.google_bigquery_default_service_account.bq_sa", "module.orch-project.data.google_project.project", + "module.orch-project.data.google_bigquery_default_service_account.bq_sa", "module.orch-project.data.google_storage_project_service_account.gcs_sa", "module.orch-project.google_compute_shared_vpc_host_project.shared_vpc_host", "module.orch-project.google_compute_shared_vpc_service_project.service_projects", diff --git a/tests/examples/data_solutions/data_platform_foundations/test_plan.py b/tests/examples/data_solutions/data_platform_foundations/test_plan.py index e8a70a83..8f5bf595 100644 --- a/tests/examples/data_solutions/data_platform_foundations/test_plan.py +++ b/tests/examples/data_solutions/data_platform_foundations/test_plan.py @@ -24,4 +24,4 @@ def test_resources(e2e_plan_runner): "Test that plan works and the numbers of resources is as expected." modules, resources = e2e_plan_runner(FIXTURES_DIR) assert len(modules) == 40 - assert len(resources) == 287 + assert len(resources) == 283