4.1 KiB
4.1 KiB
Google Cloud Unit Folders Module
This module allows creation and management of an organizational hierarchy "unit" composed of a parent folder (usually mapped to a business unit or team), and a set of child folders (usually mapped to environments) each with a corresponding set of service accounts, IAM bindings and GCS buckets.
Example
module "folders-unit" {
source = "./modules/folders-unit"
name = "Business Intelligence"
short_name = "bi"
automation_project_id = "automation-project-394yr923811"
billing_account_id = "015617-16GHBC-AF02D9"
organization_id = "506128240800"
root_node = "folders/93469270123701"
prefix = "unique-prefix"
environments = {
dev = "Development",
test = "Testing",
prod = "Production"
}
service_account_keys = true
}
Variables
name | description | type | required | default |
---|---|---|---|---|
automation_project_id | Project id used for automation service accounts. | string |
✓ | |
billing_account_id | Country billing account account. | string |
✓ | |
name | Top folder name. | string |
✓ | |
organization_id | Organization id in organizations/nnnnnn format. | string |
✓ | |
root_node | Root node in folders/folder_id or organizations/org_id format. | string |
✓ | |
short_name | Short name used as GCS bucket and service account prefixes, do not use capital letters or spaces. | string |
✓ | |
environments | Unit environments short names. | map(string) |
... |
|
gcs_defaults | Defaults use for the state GCS buckets. | map(string) |
... |
|
iam_billing_config | Grant billing user role to service accounts, defaults to granting on the billing account. | object({...}) |
... |
|
iam_enviroment_roles | IAM roles granted to the environment service account on the environment sub-folder. | list(string) |
... |
|
iam_members | IAM members for roles applied on the unit folder. | map(list(string)) |
null |
|
iam_roles | IAM roles applied on the unit folder. | list(string) |
null |
|
iam_xpn_config | Grant Shared VPC creation roles to service accounts, defaults to granting at folder level. | object({...}) |
... |
|
prefix | Optional prefix used for GCS bucket names to ensure uniqueness. | string |
null |
|
service_account_keys | Generate and store service account keys in the state file. | bool |
false |
Outputs
name | description | sensitive |
---|---|---|
env_folders | Unit environments folders. | |
env_gcs_buckets | Unit environments tfstate gcs buckets. | |
env_sa_keys | Unit environments service account keys. | ✓ |
env_service_accounts | Unit environments service accounts. | |
unit_folder | Unit top level folder. |