260 lines
13 KiB
Markdown
260 lines
13 KiB
Markdown
# Google Cloud Storage Module
|
|
|
|
## Example
|
|
|
|
```hcl
|
|
module "bucket" {
|
|
source = "./fabric/modules/gcs"
|
|
project_id = var.project_id
|
|
prefix = var.prefix
|
|
name = "my-bucket"
|
|
versioning = true
|
|
labels = {
|
|
cost-center = "devops"
|
|
}
|
|
}
|
|
# tftest modules=1 resources=1 inventory=simple.yaml e2e
|
|
```
|
|
|
|
### Example with Cloud KMS
|
|
|
|
```hcl
|
|
module "project" {
|
|
source = "./fabric/modules/project"
|
|
name = var.project_id
|
|
project_create = false
|
|
}
|
|
|
|
module "kms" {
|
|
source = "./fabric/modules/kms"
|
|
project_id = var.project_id
|
|
keyring = {
|
|
location = "europe" # location of the KMS must match location of the bucket
|
|
name = "test"
|
|
}
|
|
keys = {
|
|
bucket_key = {
|
|
iam_bindings = {
|
|
bucket_key_iam = {
|
|
members = ["serviceAccount:${module.project.service_accounts.robots.storage}"]
|
|
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
module "bucket" {
|
|
source = "./fabric/modules/gcs"
|
|
project_id = var.project_id
|
|
prefix = var.prefix
|
|
name = "my-bucket"
|
|
encryption_key = module.kms.keys.bucket_key.id
|
|
location = "EU"
|
|
}
|
|
|
|
# tftest modules=3 skip e2e
|
|
```
|
|
|
|
### Example with retention policy and logging
|
|
|
|
```hcl
|
|
module "bucket" {
|
|
source = "./fabric/modules/gcs"
|
|
project_id = var.project_id
|
|
prefix = var.prefix
|
|
name = "my-bucket"
|
|
retention_policy = {
|
|
retention_period = 100
|
|
is_locked = true
|
|
}
|
|
logging_config = {
|
|
log_bucket = "log-bucket"
|
|
log_object_prefix = null
|
|
}
|
|
}
|
|
# tftest modules=1 resources=1 inventory=retention-logging.yaml
|
|
```
|
|
|
|
### Example with lifecycle rule
|
|
|
|
```hcl
|
|
module "bucket" {
|
|
source = "./fabric/modules/gcs"
|
|
project_id = var.project_id
|
|
prefix = var.prefix
|
|
name = "my-bucket"
|
|
lifecycle_rules = {
|
|
lr-0 = {
|
|
action = {
|
|
type = "SetStorageClass"
|
|
storage_class = "STANDARD"
|
|
}
|
|
condition = {
|
|
age = 30
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=1 resources=1 inventory=lifecycle.yaml e2e
|
|
```
|
|
|
|
### Minimal example with GCS notifications
|
|
|
|
```hcl
|
|
module "project" {
|
|
source = "./fabric/modules/project"
|
|
name = var.project_id
|
|
project_create = false
|
|
}
|
|
|
|
module "bucket-gcs-notification" {
|
|
source = "./fabric/modules/gcs"
|
|
project_id = var.project_id
|
|
prefix = var.prefix
|
|
name = "my-bucket"
|
|
notification_config = {
|
|
enabled = true
|
|
payload_format = "JSON_API_V1"
|
|
sa_email = module.project.service_accounts.robots.storage
|
|
topic_name = "gcs-notification-topic"
|
|
event_types = ["OBJECT_FINALIZE"]
|
|
custom_attributes = {}
|
|
}
|
|
}
|
|
# tftest skip e2e
|
|
```
|
|
|
|
### Example with object upload
|
|
|
|
```hcl
|
|
module "bucket" {
|
|
source = "./fabric/modules/gcs"
|
|
project_id = var.project_id
|
|
prefix = var.prefix
|
|
name = "my-bucket"
|
|
objects_to_upload = {
|
|
sample-data = {
|
|
name = "example-file.csv"
|
|
source = "assets/example-file.csv"
|
|
content_type = "text/csv"
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=1 resources=2 inventory=object-upload.yaml e2e
|
|
```
|
|
|
|
### Examples of IAM
|
|
|
|
```hcl
|
|
module "bucket" {
|
|
source = "./fabric/modules/gcs"
|
|
project_id = var.project_id
|
|
prefix = var.prefix
|
|
name = "my-bucket"
|
|
iam = {
|
|
"roles/storage.admin" = ["group:${var.group_email}"]
|
|
}
|
|
}
|
|
# tftest modules=1 resources=2 inventory=iam-authoritative.yaml e2e
|
|
```
|
|
|
|
```hcl
|
|
module "bucket" {
|
|
source = "./fabric/modules/gcs"
|
|
project_id = var.project_id
|
|
prefix = var.prefix
|
|
name = "my-bucket"
|
|
iam_bindings = {
|
|
storage-admin-with-delegated_roles = {
|
|
role = "roles/storage.admin"
|
|
members = ["group:${var.group_email}"]
|
|
condition = {
|
|
title = "delegated-role-grants"
|
|
expression = format(
|
|
"api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([%s])",
|
|
join(",", formatlist("'%s'",
|
|
[
|
|
"roles/storage.objectAdmin",
|
|
"roles/storage.objectViewer",
|
|
]
|
|
))
|
|
)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=1 resources=2 inventory=iam-bindings.yaml e2e
|
|
```
|
|
|
|
```hcl
|
|
module "bucket" {
|
|
source = "./fabric/modules/gcs"
|
|
project_id = var.project_id
|
|
prefix = var.prefix
|
|
name = "my-bucket"
|
|
iam_bindings_additive = {
|
|
storage-admin-with-delegated_roles = {
|
|
role = "roles/storage.admin"
|
|
member = "group:${var.group_email}"
|
|
condition = {
|
|
title = "delegated-role-grants"
|
|
expression = format(
|
|
"api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([%s])",
|
|
join(",", formatlist("'%s'",
|
|
[
|
|
"roles/storage.objectAdmin",
|
|
"roles/storage.objectViewer",
|
|
]
|
|
))
|
|
)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=1 resources=2 inventory=iam-bindings-additive.yaml e2e
|
|
```
|
|
<!-- BEGIN TFDOC -->
|
|
## Variables
|
|
|
|
| name | description | type | required | default |
|
|
|---|---|:---:|:---:|:---:|
|
|
| [name](variables.tf#L164) | Bucket name suffix. | <code>string</code> | ✓ | |
|
|
| [project_id](variables.tf#L219) | Bucket project id. | <code>string</code> | ✓ | |
|
|
| [autoclass](variables.tf#L17) | Enable autoclass to automatically transition objects to appropriate storage classes based on their access pattern. If set to true, storage_class must be set to STANDARD. Defaults to false. | <code>bool</code> | | <code>false</code> |
|
|
| [cors](variables.tf#L23) | CORS configuration for the bucket. Defaults to null. | <code title="object({ origin = optional(list(string)) method = optional(list(string)) response_header = optional(list(string)) max_age_seconds = optional(number) })">object({…})</code> | | <code>null</code> |
|
|
| [custom_placement_config](variables.tf#L34) | The bucket's custom location configuration, which specifies the individual regions that comprise a dual-region bucket. If the bucket is designated as REGIONAL or MULTI_REGIONAL, the parameters are empty. | <code>list(string)</code> | | <code>null</code> |
|
|
| [default_event_based_hold](variables.tf#L40) | Enable event based hold to new objects added to specific bucket, defaults to false. | <code>bool</code> | | <code>null</code> |
|
|
| [encryption_key](variables.tf#L46) | KMS key that will be used for encryption. | <code>string</code> | | <code>null</code> |
|
|
| [force_destroy](variables.tf#L52) | Optional map to set force destroy keyed by name, defaults to false. | <code>bool</code> | | <code>false</code> |
|
|
| [iam](variables.tf#L58) | IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
|
| [iam_bindings](variables.tf#L64) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code title="map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [iam_bindings_additive](variables.tf#L79) | Individual additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [labels](variables.tf#L94) | Labels to be attached to all buckets. | <code>map(string)</code> | | <code>{}</code> |
|
|
| [lifecycle_rules](variables.tf#L100) | Bucket lifecycle rule. | <code title="map(object({ action = object({ type = string storage_class = optional(string) }) condition = object({ age = optional(number) created_before = optional(string) custom_time_before = optional(string) days_since_custom_time = optional(number) days_since_noncurrent_time = optional(number) matches_prefix = optional(list(string)) matches_storage_class = optional(list(string)) # STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE, DURABLE_REDUCED_AVAILABILITY matches_suffix = optional(list(string)) noncurrent_time_before = optional(string) num_newer_versions = optional(number) with_state = optional(string) # "LIVE", "ARCHIVED", "ANY" }) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [location](variables.tf#L149) | Bucket location. | <code>string</code> | | <code>"EU"</code> |
|
|
| [logging_config](variables.tf#L155) | Bucket logging configuration. | <code title="object({ log_bucket = string log_object_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
|
| [notification_config](variables.tf#L169) | GCS Notification configuration. | <code title="object({ enabled = bool payload_format = string topic_name = string sa_email = string event_types = optional(list(string)) custom_attributes = optional(map(string)) object_name_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
|
| [objects_to_upload](variables.tf#L183) | Objects to be uploaded to bucket. | <code title="map(object({ name = string metadata = optional(map(string)) content = optional(string) source = optional(string) cache_control = optional(string) content_disposition = optional(string) content_encoding = optional(string) content_language = optional(string) content_type = optional(string) event_based_hold = optional(bool) temporary_hold = optional(bool) detect_md5hash = optional(string) storage_class = optional(string) kms_key_name = optional(string) customer_encryption = optional(object({ encryption_algorithm = optional(string) encryption_key = string })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [prefix](variables.tf#L209) | Optional prefix used to generate the bucket name. | <code>string</code> | | <code>null</code> |
|
|
| [public_access_prevention](variables.tf#L224) | Prevents public access to a bucket. Acceptable values are inherited or enforced. If inherited, the bucket uses public access prevention, only if the bucket is subject to the public access prevention organization policy constraint. | <code>string</code> | | <code>null</code> |
|
|
| [requester_pays](variables.tf#L230) | Enables Requester Pays on a storage bucket. | <code>bool</code> | | <code>null</code> |
|
|
| [retention_policy](variables.tf#L236) | Bucket retention policy. | <code title="object({ retention_period = number is_locked = optional(bool) })">object({…})</code> | | <code>null</code> |
|
|
| [storage_class](variables.tf#L245) | Bucket storage class. | <code>string</code> | | <code>"MULTI_REGIONAL"</code> |
|
|
| [uniform_bucket_level_access](variables.tf#L255) | Allow using object ACLs (false) or not (true, this is the recommended behavior) , defaults to true (which is the recommended practice, but not the behavior of storage API). | <code>bool</code> | | <code>true</code> |
|
|
| [versioning](variables.tf#L261) | Enable versioning, defaults to false. | <code>bool</code> | | <code>false</code> |
|
|
| [website](variables.tf#L267) | Bucket website. | <code title="object({ main_page_suffix = optional(string) not_found_page = optional(string) })">object({…})</code> | | <code>null</code> |
|
|
|
|
## Outputs
|
|
|
|
| name | description | sensitive |
|
|
|---|---|:---:|
|
|
| [bucket](outputs.tf#L17) | Bucket resource. | |
|
|
| [id](outputs.tf#L28) | Fully qualified bucket id. | |
|
|
| [name](outputs.tf#L37) | Bucket name. | |
|
|
| [notification](outputs.tf#L46) | GCS Notification self link. | |
|
|
| [objects](outputs.tf#L51) | Objects in GCS bucket. | |
|
|
| [topic](outputs.tf#L63) | Topic ID used by GCS. | |
|
|
| [url](outputs.tf#L68) | Bucket URL. | |
|
|
<!-- END TFDOC -->
|