cloud-foundation-fabric/blueprints/data-solutions/cmek-via-centralized-kms

GCE and GCS CMEK via centralized Cloud KMS

This example creates a sample centralized Cloud KMS configuration, and uses it to implement CMEK for Cloud Storage and Compute Engine in a service project.

The example is designed to match real-world use cases with a minimum amount of resources, and be used as a starting point for scenarios where application projects implement CMEK using keys managed by a central team. It also includes the IAM wiring needed to make such scenarios work. Regional resources are used in this example, but the same logic will apply for 'dual regional', 'multi regional' or 'global' resources.

This is the high level diagram:

Managed resources and services

This sample creates several distinct groups of resources:

• projects
  • Cloud KMS project
  • Service Project configured for GCE instances and GCS buckets
• networking
  • VPC network
  • One subnet
  • Firewall rules for SSH access via IAP and open communication within the VPC
• IAM
  • One service account for the GGE instance
• KMS
  • One key ring
  • One crypto key (Protection level: software) for Cloud Engine
  • One crypto key (Protection level: software) for Cloud Storage
• GCE
  • One instance encrypted with a CMEK Cryptokey hosted in Cloud KMS
• GCS
  • One bucket encrypted with a CMEK Cryptokey hosted in Cloud KMS

Variables

name	description	type	required	default
prefix	Optional prefix used to generate resources names.	string	✓
project_config	Provide 'billing_account_id' and 'parent' values if project creation is needed, uses existing 'projects_id' if null. Parent is in 'folders/nnn' or 'organizations/nnn' format.	object({…})	✓
deletion_protection	Prevent Terraform from destroying data storage resources (storage buckets, GKE clusters, CloudSQL instances) in this blueprint. When this field is set in Terraform state, a terraform destroy or terraform apply that would delete data storage resources will fail.	bool		false
location	The location where resources will be deployed.	string		"europe"
region	The region where resources will be deployed.	string		"europe-west1"
vpc_ip_cidr_range	Ip range used in the subnet deployef in the Service Project.	string		"10.0.0.0/20"
vpc_name	Name of the VPC created in the Service Project.	string		"local"
vpc_subnet_name	Name of the subnet created in the Service Project.	string		"subnet"

Outputs

name	description	sensitive
bucket	GCS Bucket URL.
bucket_keys	GCS Bucket Cloud KMS crypto keys.
projects	Project ids.
vm	GCE VM.
vm_keys	GCE VM Cloud KMS crypto keys.

Test

module "test" {
  source = "./fabric/blueprints/data-solutions/cmek-via-centralized-kms/"
  project_config = {
    billing_account_id = "123456-123456-123456"
    parent             = "folders/12345678"
  }
  prefix = "prefix"
}
# tftest modules=8 resources=29