130 lines
4.8 KiB
HCL
130 lines
4.8 KiB
HCL
/**
|
|
* Copyright 2023 Google LLC
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
# tfdoc:file:description Service identities and supporting resources.
|
|
|
|
locals {
|
|
_service_accounts_cmek_service_dependencies = {
|
|
"composer" : [
|
|
"composer",
|
|
"artifactregistry", "container-engine", "compute", "pubsub", "storage"
|
|
]
|
|
"dataflow" : ["dataflow", "compute"]
|
|
}
|
|
_service_agents_data = yamldecode(file("${path.module}/service-agents.yaml"))
|
|
service_accounts_default = {
|
|
cloudbuild = "${local.project.number}@cloudbuild.gserviceaccount.com"
|
|
compute = "${local.project.number}-compute@developer.gserviceaccount.com"
|
|
gae = "${local.project.project_id}@appspot.gserviceaccount.com"
|
|
workstations = "service-${local.project.number}@gcp-sa-workstationsvm.iam.gserviceaccount.com"
|
|
}
|
|
service_account_cloud_services = (
|
|
"${local.project.number}@cloudservices.gserviceaccount.com"
|
|
)
|
|
service_accounts_robots = merge(
|
|
{
|
|
for agent in local._service_agents_data :
|
|
agent.name => format(agent.service_agent, local.project.number)
|
|
},
|
|
{
|
|
for agent in local._service_agents_data :
|
|
agent.alias => format(agent.service_agent, local.project.number)
|
|
if lookup(agent, "alias", null) != null
|
|
},
|
|
{
|
|
gke-mcs-importer = "${local.project.project_id}.svc.id.goog[gke-mcs/gke-mcs-importer]"
|
|
}
|
|
)
|
|
service_accounts_jit_services = [
|
|
for agent in local._service_agents_data :
|
|
"${agent.name}.googleapis.com"
|
|
if lookup(agent, "jit", false)
|
|
]
|
|
service_accounts_cmek_service_keys = distinct(flatten([
|
|
for s in keys(var.service_encryption_key_ids) : [
|
|
for ss in try(local._service_accounts_cmek_service_dependencies[s], [s]) : [
|
|
for key in var.service_encryption_key_ids[s] : {
|
|
service = ss
|
|
key = key
|
|
} if key != null
|
|
]
|
|
]
|
|
]))
|
|
}
|
|
|
|
data "google_storage_project_service_account" "gcs_sa" {
|
|
count = contains(var.services, "storage.googleapis.com") ? 1 : 0
|
|
project = local.project.project_id
|
|
depends_on = [google_project_service.project_services]
|
|
}
|
|
|
|
data "google_bigquery_default_service_account" "bq_sa" {
|
|
count = contains(var.services, "bigquery.googleapis.com") ? 1 : 0
|
|
project = local.project.project_id
|
|
depends_on = [google_project_service.project_services]
|
|
}
|
|
|
|
resource "google_project_service_identity" "servicenetworking" {
|
|
provider = google-beta
|
|
count = contains(var.services, "servicenetworking.googleapis.com") ? 1 : 0
|
|
project = local.project.project_id
|
|
service = "servicenetworking.googleapis.com"
|
|
depends_on = [google_project_service.project_services]
|
|
}
|
|
|
|
resource "google_project_iam_member" "servicenetworking" {
|
|
count = contains(var.services, "servicenetworking.googleapis.com") ? 1 : 0
|
|
project = local.project.project_id
|
|
role = "roles/servicenetworking.serviceAgent"
|
|
member = "serviceAccount:${google_project_service_identity.servicenetworking.0.email}"
|
|
}
|
|
|
|
# Secret Manager SA created just in time, we need to trigger the creation.
|
|
resource "google_project_service_identity" "jit_si" {
|
|
for_each = setintersection(var.services, local.service_accounts_jit_services)
|
|
provider = google-beta
|
|
project = local.project.project_id
|
|
service = each.value
|
|
depends_on = [google_project_service.project_services]
|
|
}
|
|
|
|
resource "google_kms_crypto_key_iam_member" "service_identity_cmek" {
|
|
for_each = {
|
|
for service_key in local.service_accounts_cmek_service_keys :
|
|
"${service_key.service}.${service_key.key}" => service_key
|
|
if service_key != service_key.key
|
|
}
|
|
crypto_key_id = each.value.key
|
|
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
|
|
member = "serviceAccount:${local.service_accounts_robots[each.value.service]}"
|
|
depends_on = [
|
|
google_project.project,
|
|
google_project_service.project_services,
|
|
google_project_service_identity.jit_si,
|
|
data.google_bigquery_default_service_account.bq_sa,
|
|
data.google_project.project,
|
|
data.google_storage_project_service_account.gcs_sa,
|
|
]
|
|
}
|
|
|
|
resource "google_project_default_service_accounts" "default_service_accounts" {
|
|
count = upper(var.default_service_account) == "KEEP" ? 0 : 1
|
|
action = upper(var.default_service_account)
|
|
project = local.project.project_id
|
|
restore_policy = "REVERT_AND_IGNORE_FAILURE"
|
|
depends_on = [google_project_service.project_services]
|
|
}
|