# Google Cloud Folder Module This module allows the creation and management of folders, including support for IAM bindings, organization policies, and hierarchical firewall rules. ## Examples ### IAM bindings ```hcl module "folder" { source = "./fabric/modules/folder" parent = "organizations/1234567890" name = "Folder name" group_iam = { "cloud-owners@example.org" = [ "roles/owner", "roles/resourcemanager.projectCreator" ] } iam = { "roles/owner" = ["user:one@example.com"] } } # tftest modules=1 resources=3 ``` ### Organization policies To manage organization policies, the `orgpolicy.googleapis.com` service should be enabled in the quota project. ```hcl module "folder" { source = "./fabric/modules/folder" parent = "organizations/1234567890" name = "Folder name" org_policies = { "compute.disableGuestAttributesAccess" = { enforce = true } "constraints/compute.skipDefaultNetworkCreation" = { enforce = true } "iam.disableServiceAccountKeyCreation" = { enforce = true } "iam.disableServiceAccountKeyUpload" = { enforce = false rules = [ { condition = { expression = "resource.matchTagId(\"tagKeys/1234\", \"tagValues/1234\")" title = "condition" description = "test condition" location = "somewhere" } enforce = true } ] } "constraints/iam.allowedPolicyMemberDomains" = { allow = { values = ["C0xxxxxxx", "C0yyyyyyy"] } } "constraints/compute.trustedImageProjects" = { allow = { values = ["projects/my-project"] } } "constraints/compute.vmExternalIpAccess" = { deny = { all = true } } } } # tftest modules=1 resources=8 ``` ### Organization policy factory See the [organization policy factory in the project module](../project#organization-policy-factory). ### Firewall policy factory In the same way as for the [organization](../organization) module, the in-built factory allows you to define a single policy, using one file for rules, and an optional file for CIDR range substitution variables. Remember that non-absolute paths are relative to the root module (the folder where you run `terraform`). ```hcl module "folder" { source = "./fabric/modules/folder" parent = "organizations/1234567890" name = "Folder name" firewall_policy_factory = { cidr_file = "configs/firewall-policies/cidrs.yaml" policy_name = null rules_file = "configs/firewall-policies/rules.yaml" } firewall_policy_association = { factory-policy = module.folder.firewall_policy_id["factory"] } } # tftest modules=1 resources=5 files=cidrs,rules ``` ```yaml # tftest-file id=cidrs path=configs/firewall-policies/cidrs.yaml rfc1918: - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 ``` ```yaml # tftest-file id=rules path=configs/firewall-policies/rules.yaml allow-admins: description: Access from the admin subnet to all subnets direction: INGRESS action: allow priority: 1000 ranges: - $rfc1918 ports: all: [] target_resources: null enable_logging: false allow-ssh-from-iap: description: Enable SSH from IAP direction: INGRESS action: allow priority: 1002 ranges: - 35.235.240.0/20 ports: tcp: ["22"] target_resources: null enable_logging: false ``` ### Logging Sinks ```hcl module "gcs" { source = "./fabric/modules/gcs" project_id = "my-project" name = "gcs_sink" force_destroy = true } module "dataset" { source = "./fabric/modules/bigquery-dataset" project_id = "my-project" id = "bq_sink" } module "pubsub" { source = "./fabric/modules/pubsub" project_id = "my-project" name = "pubsub_sink" } module "bucket" { source = "./fabric/modules/logging-bucket" parent_type = "project" parent = "my-project" id = "bucket" } module "folder-sink" { source = "./fabric/modules/folder" parent = "folders/657104291943" name = "my-folder" logging_sinks = { warnings = { destination = module.gcs.id filter = "severity=WARNING" type = "storage" } info = { destination = module.dataset.id filter = "severity=INFO" type = "bigquery" } notice = { destination = module.pubsub.id filter = "severity=NOTICE" type = "pubsub" } debug = { destination = module.bucket.id filter = "severity=DEBUG" exclusions = { no-compute = "logName:compute" } type = "logging" } } logging_exclusions = { no-gce-instances = "resource.type=gce_instance" } } # tftest modules=5 resources=14 ``` ### Hierarchical firewall policies ```hcl module "folder1" { source = "./fabric/modules/folder" parent = var.organization_id name = "policy-container" firewall_policies = { iap-policy = { allow-iap-ssh = { description = "Always allow ssh from IAP" direction = "INGRESS" action = "allow" priority = 100 ranges = ["35.235.240.0/20"] ports = { tcp = ["22"] } target_service_accounts = null target_resources = null logging = false } } } firewall_policy_association = { iap-policy = "iap-policy" } } module "folder2" { source = "./fabric/modules/folder" parent = var.organization_id name = "hf2" firewall_policy_association = { iap-policy = module.folder1.firewall_policy_id["iap-policy"] } } # tftest modules=2 resources=6 ``` ## Tags Refer to the [Creating and managing tags](https://cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing) documentation for details on usage. ```hcl module "org" { source = "./fabric/modules/organization" organization_id = var.organization_id tags = { environment = { description = "Environment specification." iam = null values = { dev = null prod = null } } } } module "folder" { source = "./fabric/modules/folder" name = "Test" parent = module.org.organization_id tag_bindings = { env-prod = module.org.tag_values["environment/prod"].id foo = "tagValues/12345678" } } # tftest modules=2 resources=6 ``` ## Files | name | description | resources | |---|---|---| | [firewall-policies.tf](./firewall-policies.tf) | None | google_compute_firewall_policy · google_compute_firewall_policy_association · google_compute_firewall_policy_rule | | [iam.tf](./iam.tf) | IAM bindings, roles and audit logging resources. | google_folder_iam_binding · google_folder_iam_member | | [logging.tf](./logging.tf) | Log sinks and supporting resources. | google_bigquery_dataset_iam_member · google_logging_folder_exclusion · google_logging_folder_sink · google_project_iam_member · google_pubsub_topic_iam_member · google_storage_bucket_iam_member | | [main.tf](./main.tf) | Module-level locals and resources. | google_essential_contacts_contact · google_folder | | [organization-policies.tf](./organization-policies.tf) | Folder-level organization policies. | google_org_policy_policy | | [outputs.tf](./outputs.tf) | Module outputs. | | | [tags.tf](./tags.tf) | None | google_tags_tag_binding | | [variables.tf](./variables.tf) | Module variables. | | | [versions.tf](./versions.tf) | Version pins. | | ## Variables | name | description | type | required | default | |---|---|:---:|:---:|:---:| | [contacts](variables.tf#L17) | List of essential contacts for this resource. Must be in the form EMAIL -> [NOTIFICATION_TYPES]. Valid notification types are ALL, SUSPENSION, SECURITY, TECHNICAL, BILLING, LEGAL, PRODUCT_UPDATES. | map(list(string)) | | {} | | [firewall_policies](variables.tf#L24) | Hierarchical firewall policies created in this folder. | map(map(object({…}))) | | {} | | [firewall_policy_association](variables.tf#L41) | The hierarchical firewall policy to associate to this folder. Must be either a key in the `firewall_policies` map or the id of a policy defined somewhere else. | map(string) | | {} | | [firewall_policy_factory](variables.tf#L48) | Configuration for the firewall policy factory. | object({…}) | | null | | [folder_create](variables.tf#L58) | Create folder. When set to false, uses id to reference an existing folder. | bool | | true | | [group_iam](variables.tf#L64) | Authoritative IAM binding for organization groups, in {GROUP_EMAIL => [ROLES]} format. Group emails need to be static. Can be used in combination with the `iam` variable. | map(list(string)) | | {} | | [iam](variables.tf#L71) | IAM bindings in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | | [iam_additive](variables.tf#L78) | Non authoritative IAM bindings, in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | | [iam_additive_members](variables.tf#L85) | IAM additive bindings in {MEMBERS => [ROLE]} format. This might break if members are dynamic values. | map(list(string)) | | {} | | [id](variables.tf#L92) | Folder ID in case you use folder_create=false. | string | | null | | [logging_exclusions](variables.tf#L98) | Logging exclusions for this folder in the form {NAME -> FILTER}. | map(string) | | {} | | [logging_sinks](variables.tf#L105) | Logging sinks to create for the organization. | map(object({…})) | | {} | | [name](variables.tf#L135) | Folder name. | string | | null | | [org_policies](variables.tf#L141) | Organization policies applied to this folder keyed by policy name. | map(object({…})) | | {} | | [org_policies_data_path](variables.tf#L181) | Path containing org policies in YAML format. | string | | null | | [parent](variables.tf#L187) | Parent in folders/folder_id or organizations/org_id format. | string | | null | | [tag_bindings](variables.tf#L197) | Tag bindings for this folder, in key => tag value id format. | map(string) | | null | ## Outputs | name | description | sensitive | |---|---|:---:| | [firewall_policies](outputs.tf#L16) | Map of firewall policy resources created in this folder. | | | [firewall_policy_id](outputs.tf#L21) | Map of firewall policy ids created in this folder. | | | [folder](outputs.tf#L26) | Folder resource. | | | [id](outputs.tf#L31) | Folder id. | | | [name](outputs.tf#L40) | Folder name. | | | [sink_writer_identities](outputs.tf#L45) | Writer identities created for each sink. | |