2.7 KiB
2.7 KiB
Google Cloud Folder Module
This module allow creation and management of sets of folders sharing a common parent, and their individual IAM bindings. It also allows setting a common set of organization policies on all folders.
Examples
IAM bindings
module "folder" {
source = "./modules/folders"
parent = "organizations/1234567890"
names = ["Folder one", "Folder two"]
iam_members = {
"Folder one" = {
"roles/owner" = ["group:users@example.com"]
}
}
iam_roles = {
"Folder one" = ["roles/owner"]
}
}
Organization policies
module "folder" {
source = "./modules/folders"
parent = "organizations/1234567890"
names = ["Folder one", "Folder two"]
policy_boolean = {
"constraints/compute.disableGuestAttributesAccess" = true
"constraints/compute.skipDefaultNetworkCreation" = true
}
policy_list = {
"constraints/compute.trustedImageProjects" = {
inherit_from_parent = null
suggested_value = null
status = true
values = ["projects/my-project"]
}
}
}
Variables
name | description | type | required | default |
---|---|---|---|---|
parent | Parent in folders/folder_id or organizations/org_id format. | string |
✓ | |
iam_members | List of IAM members keyed by folder name and role. | map(map(list(string))) |
null |
|
iam_roles | List of IAM roles keyed by folder name. | map(list(string)) |
null |
|
names | Folder names. | list(string) |
[] |
|
policy_boolean | Map of boolean org policies and enforcement value, set value to null for policy restore. | map(bool) |
{} |
|
policy_list | Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny. | map(object({...})) |
{} |
Outputs
name | description | sensitive |
---|---|---|
folder | Folder resource (for single use). | |
folders | Folder resources. | |
id | Folder id (for single use). | |
ids | Folder ids. | |
ids_list | List of folder ids. | |
name | Folder name (for single use). | |
names | Folder names. | |
names_list | List of folder names. |