# Project Module ## Examples ### Minimal example with IAM ```hcl locals { gke_service_account = "my_gke_service_account" } module "project" { source = "./modules/project" billing_account = "123456-123456-123456" name = "project-example" parent = "folders/1234567890" prefix = "foo" services = [ "container.googleapis.com", "stackdriver.googleapis.com" ] iam = { "roles/container.hostServiceAgentUser" = [ "serviceAccount:${local.gke_service_account}" ] } } # tftest modules=1 resources=4 ``` ### Minimal example with IAM additive roles ```hcl module "project" { source = "./modules/project" name = "project-example" iam_additive = { "roles/viewer" = ["group:one@example.org", "group:two@xample.org"], "roles/storage.objectAdmin" = ["group:two@example.org"], "roles/owner" = ["group:three@example.org"], } } # tftest modules=1 resources=5 ``` ### Organization policies ```hcl module "project" { source = "./modules/project" billing_account = "123456-123456-123456" name = "project-example" parent = "folders/1234567890" prefix = "foo" services = [ "container.googleapis.com", "stackdriver.googleapis.com" ] policy_boolean = { "constraints/compute.disableGuestAttributesAccess" = true "constraints/compute.skipDefaultNetworkCreation" = true } policy_list = { "constraints/compute.trustedImageProjects" = { inherit_from_parent = null suggested_value = null status = true values = ["projects/my-project"] } } } # tftest modules=1 resources=6 ``` ## Logging Sinks ```hcl module "gcs" { source = "./modules/gcs" project_id = var.project_id name = "gcs_sink" force_destroy = true } module "dataset" { source = "./modules/bigquery-dataset" project_id = var.project_id id = "bq_sink" } module "pubsub" { source = "./modules/pubsub" project_id = var.project_id name = "pubsub_sink" } module "bucket" { source = "./modules/logging-bucket" parent_type = "project" parent = "my-project" id = "bucket" } module "project-host" { source = "./modules/project" name = "my-project" billing_account = "123456-123456-123456" parent = "folders/1234567890" logging_sinks = { warnings = { type = "storage" destination = module.gcs.name filter = "severity=WARNING" iam = false unique_writer = false exclusions = {} } info = { type = "bigquery" destination = module.dataset.id filter = "severity=INFO" iam = false unique_writer = false exclusions = {} } notice = { type = "pubsub" destination = module.pubsub.id filter = "severity=NOTICE" iam = true unique_writer = false exclusions = {} } debug = { type = "logging" destination = module.bucket.id filter = "severity=DEBUG" iam = true unique_writer = false exclusions = { no-compute = "logName:compute" } } } logging_exclusions = { no-gce-instances = "resource.type=gce_instance" } } # tftest modules=5 resources=12 ``` ## Cloud KMS encryption keys ```hcl module "project" { source = "./modules/project" name = "my-project" billing_account = "123456-123456-123456" prefix = "foo" services = [ "compute.googleapis.com", "storage.googleapis.com" ] service_encryption_key_ids = { compute = [ "projects/kms-central-prj/locations/europe-west3/keyRings/my-keyring/cryptoKeys/europe3-gce", "projects/kms-central-prj/locations/europe-west4/keyRings/my-keyring/cryptoKeys/europe4-gce" ] storage = [ "projects/kms-central-prj/locations/europe/keyRings/my-keyring/cryptoKeys/europe-gcs" ] } } # tftest modules=1 resources=7 ``` ## Files | name | description | resources | |---|---|---| | [iam.tf](./iam.tf) | Generic and OSLogin-specific IAM bindings and roles. | google_project_iam_binding · google_project_iam_custom_role · google_project_iam_member | | [logging.tf](./logging.tf) | Log sinks and supporting resources. | google_bigquery_dataset_iam_member · google_logging_project_exclusion · google_logging_project_sink · google_project_iam_member · google_pubsub_topic_iam_member · google_storage_bucket_iam_member | | [main.tf](./main.tf) | Module-level locals and resources. | google_compute_project_metadata_item · google_essential_contacts_contact · google_monitoring_monitored_project · google_project · google_project_service · google_resource_manager_lien | | [organization-policies.tf](./organization-policies.tf) | Project-level organization policies. | google_project_organization_policy | | [outputs.tf](./outputs.tf) | Module outputs. | | | [service-accounts.tf](./service-accounts.tf) | Service identities and supporting resources. | google_kms_crypto_key_iam_member · google_project_service_identity | | [shared-vpc.tf](./shared-vpc.tf) | Shared VPC project-level configuration. | google_compute_shared_vpc_host_project · google_compute_shared_vpc_service_project | | [variables.tf](./variables.tf) | Module variables. | | | [versions.tf](./versions.tf) | Version pins. | | | [vpc-sc.tf](./vpc-sc.tf) | VPC-SC project-level perimeter configuration. | google_access_context_manager_service_perimeter_resource | ## Variables | name | description | type | required | default | |---|---|:---:|:---:|:---:| | [name](variables.tf#L125) | Project name and id suffix. | string | ✓ | | | [auto_create_network](variables.tf#L17) | Whether to create the default network for the project. | bool | | false | | [billing_account](variables.tf#L23) | Billing account id. | string | | null | | [contacts](variables.tf#L29) | List of essential contacts for this resource. Must be in the form EMAIL -> [NOTIFICATION_TYPES]. Valid notification types are ALL, SUSPENSION, SECURITY, TECHNICAL, BILLING, LEGAL, PRODUCT_UPDATES. | map(list(string)) | | {} | | [custom_roles](variables.tf#L36) | Map of role name => list of permissions to create in this project. | map(list(string)) | | {} | | [descriptive_name](variables.tf#L43) | Name of the project name. Used for project name instead of `name` variable. | string | | null | | [group_iam](variables.tf#L49) | Authoritative IAM binding for organization groups, in {GROUP_EMAIL => [ROLES]} format. Group emails need to be static. Can be used in combination with the `iam` variable. | map(list(string)) | | {} | | [iam](variables.tf#L56) | IAM bindings in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | | [iam_additive](variables.tf#L63) | IAM additive bindings in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | | [iam_additive_members](variables.tf#L70) | IAM additive bindings in {MEMBERS => [ROLE]} format. This might break if members are dynamic values. | map(list(string)) | | {} | | [labels](variables.tf#L76) | Resource labels. | map(string) | | {} | | [lien_reason](variables.tf#L83) | If non-empty, creates a project lien with this description. | string | | "" | | [logging_exclusions](variables.tf#L89) | Logging exclusions for this project in the form {NAME -> FILTER}. | map(string) | | {} | | [logging_sinks](variables.tf#L96) | Logging sinks to create for this project. | map(object({…})) | | {} | | [metric_scopes](variables.tf#L118) | List of projects that will act as metric scopes for this project. | list(string) | | [] | | [oslogin](variables.tf#L130) | Enable OS Login. | bool | | false | | [oslogin_admins](variables.tf#L136) | List of IAM-style identities that will be granted roles necessary for OS Login administrators. | list(string) | | [] | | [oslogin_users](variables.tf#L144) | List of IAM-style identities that will be granted roles necessary for OS Login users. | list(string) | | [] | | [parent](variables.tf#L151) | Parent folder or organization in 'folders/folder_id' or 'organizations/org_id' format. | string | | null | | [policy_boolean](variables.tf#L161) | Map of boolean org policies and enforcement value, set value to null for policy restore. | map(bool) | | {} | | [policy_list](variables.tf#L168) | Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny. | map(object({…})) | | {} | | [prefix](variables.tf#L180) | Prefix used to generate project id and name. | string | | null | | [project_create](variables.tf#L186) | Create project. When set to false, uses a data source to reference existing project. | bool | | true | | [service_config](variables.tf#L192) | Configure service API activation. | object({…}) | | {…} | | [service_encryption_key_ids](variables.tf#L204) | Cloud KMS encryption key in {SERVICE => [KEY_URL]} format. | map(list(string)) | | {} | | [service_perimeter_bridges](variables.tf#L211) | Name of VPC-SC Bridge perimeters to add project into. See comment in the variables file for format. | list(string) | | null | | [service_perimeter_standard](variables.tf#L218) | Name of VPC-SC Standard perimeter to add project into. See comment in the variables file for format. | string | | null | | [services](variables.tf#L224) | Service APIs to enable. | list(string) | | [] | | [shared_vpc_host_config](variables.tf#L230) | Configures this project as a Shared VPC host project (mutually exclusive with shared_vpc_service_project). | object({…}) | | {…} | | [shared_vpc_service_config](variables.tf#L243) | Configures this project as a Shared VPC service project (mutually exclusive with shared_vpc_host_config). | object({…}) | | {…} | | [skip_delete](variables.tf#L256) | Allows the underlying resources to be destroyed without destroying the project itself. | bool | | false | ## Outputs | name | description | sensitive | |---|---|:---:| | [custom_roles](outputs.tf#L17) | Ids of the created custom roles. | | | [name](outputs.tf#L25) | Project name. | | | [number](outputs.tf#L37) | Project number. | | | [project_id](outputs.tf#L49) | Project id. | | | [service_accounts](outputs.tf#L63) | Product robot service accounts in project. | | | [sink_writer_identities](outputs.tf#L79) | Writer identities created for each sink. | |