cloud-foundation-fabric/modules/organization/tags.tf

122 lines
3.3 KiB
HCL

/**
* Copyright 2022 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
locals {
_tag_values = flatten([
for tag, attrs in local.tags : [
for value, value_attrs in coalesce(attrs.values, {}) : {
description = coalesce(
value_attrs == null ? null : value_attrs.description,
"Managed by the Terraform organization module."
)
key = "${tag}/${value}"
name = value
roles = keys(coalesce(
value_attrs == null ? null : value_attrs.iam, {}
))
tag = tag
}
]
])
_tag_values_iam = flatten([
for key, value_attrs in local.tag_values : [
for role in value_attrs.roles : {
key = value_attrs.key
name = value_attrs.name
role = role
tag = value_attrs.tag
}
]
])
_tags_iam = flatten([
for tag, attrs in local.tags : [
for role in keys(coalesce(attrs.iam, {})) : {
role = role
tag = tag
}
]
])
tag_values = {
for t in local._tag_values : t.key => t
}
tag_values_iam = {
for t in local._tag_values_iam : "${t.key}:${t.role}" => t
}
tags = {
for k, v in coalesce(var.tags, {}) :
k => v == null ? { description = null, iam = {}, values = null } : v
}
tags_iam = {
for t in local._tags_iam : "${t.tag}:${t.role}" => t
}
}
# keys
resource "google_tags_tag_key" "default" {
for_each = local.tags
parent = var.organization_id
short_name = each.key
description = coalesce(
each.value.description,
"Managed by the Terraform organization module."
)
depends_on = [
google_organization_iam_binding.authoritative,
google_organization_iam_member.additive,
google_organization_iam_policy.authoritative,
]
}
resource "google_tags_tag_key_iam_binding" "default" {
for_each = local.tags_iam
tag_key = google_tags_tag_key.default[each.value.tag].id
role = each.value.role
members = coalesce(
local.tags[each.value.tag]["iam"][each.value.role], []
)
}
# values
resource "google_tags_tag_value" "default" {
for_each = local.tag_values
parent = google_tags_tag_key.default[each.value.tag].id
short_name = each.value.name
description = coalesce(
each.value.description,
"Managed by the Terraform organization module."
)
}
resource "google_tags_tag_value_iam_binding" "default" {
for_each = local.tag_values_iam
tag_value = google_tags_tag_value.default[each.value.key].id
role = each.value.role
members = coalesce(
local.tags[each.value.tag]["values"][each.value.name]["iam"][each.value.role],
[]
)
}
# bindings
resource "google_tags_tag_binding" "binding" {
for_each = coalesce(var.tag_bindings, {})
parent = "//cloudresourcemanager.googleapis.com/${var.organization_id}"
tag_value = each.value
}