194 lines
7.7 KiB
Markdown
194 lines
7.7 KiB
Markdown
# Google Cloud Folder Module
|
|
|
|
This module allows the creation and management of folders, including support for IAM bindings, organization policies, and hierarchical firewall rules.
|
|
|
|
## Examples
|
|
|
|
### IAM bindings
|
|
|
|
```hcl
|
|
module "folder" {
|
|
source = "./modules/folder"
|
|
parent = "organizations/1234567890"
|
|
name = "Folder name"
|
|
group_iam = {
|
|
"cloud-owners@example.org" = ["roles/owner", "roles/projectCreator"]
|
|
}
|
|
iam = {
|
|
"roles/owner" = ["user:one@example.com"]
|
|
}
|
|
}
|
|
# tftest:modules=1:resources=3
|
|
```
|
|
|
|
### Organization policies
|
|
|
|
```hcl
|
|
module "folder" {
|
|
source = "./modules/folder"
|
|
parent = "organizations/1234567890"
|
|
name = "Folder name"
|
|
policy_boolean = {
|
|
"constraints/compute.disableGuestAttributesAccess" = true
|
|
"constraints/compute.skipDefaultNetworkCreation" = true
|
|
}
|
|
policy_list = {
|
|
"constraints/compute.trustedImageProjects" = {
|
|
inherit_from_parent = null
|
|
suggested_value = null
|
|
status = true
|
|
values = ["projects/my-project"]
|
|
}
|
|
}
|
|
}
|
|
# tftest:modules=1:resources=4
|
|
```
|
|
|
|
### Logging Sinks
|
|
|
|
```hcl
|
|
module "gcs" {
|
|
source = "./modules/gcs"
|
|
project_id = "my-project"
|
|
name = "gcs_sink"
|
|
force_destroy = true
|
|
}
|
|
|
|
module "dataset" {
|
|
source = "./modules/bigquery-dataset"
|
|
project_id = "my-project"
|
|
id = "bq_sink"
|
|
}
|
|
|
|
module "pubsub" {
|
|
source = "./modules/pubsub"
|
|
project_id = "my-project"
|
|
name = "pubsub_sink"
|
|
}
|
|
|
|
module "bucket" {
|
|
source = "./modules/logging-bucket"
|
|
parent_type = "project"
|
|
parent = "my-project"
|
|
id = "bucket"
|
|
}
|
|
|
|
module "folder-sink" {
|
|
source = "./modules/folder"
|
|
parent = "folders/657104291943"
|
|
name = "my-folder"
|
|
logging_sinks = {
|
|
warnings = {
|
|
type = "gcs"
|
|
destination = module.gcs.name
|
|
filter = "severity=WARNING"
|
|
iam = false
|
|
include_children = true
|
|
exclusions = {}
|
|
}
|
|
info = {
|
|
type = "bigquery"
|
|
destination = module.dataset.id
|
|
filter = "severity=INFO"
|
|
iam = false
|
|
include_children = true
|
|
exclusions = {}
|
|
}
|
|
notice = {
|
|
type = "pubsub"
|
|
destination = module.pubsub.id
|
|
filter = "severity=NOTICE"
|
|
iam = true
|
|
include_children = true
|
|
exclusions = {}
|
|
}
|
|
debug = {
|
|
type = "logging"
|
|
destination = module.bucket.id
|
|
filter = "severity=DEBUG"
|
|
iam = true
|
|
include_children = true
|
|
exclusions = {
|
|
no-compute = "logName:compute"
|
|
}
|
|
}
|
|
}
|
|
logging_exclusions = {
|
|
no-gce-instances = "resource.type=gce_instance"
|
|
}
|
|
}
|
|
# tftest:modules=5:resources=12
|
|
```
|
|
|
|
### Hierarchical firewall policies
|
|
|
|
```hcl
|
|
module "folder1" {
|
|
source = "./modules/folder"
|
|
parent = var.organization_id
|
|
name = "policy-container"
|
|
|
|
firewall_policies = {
|
|
iap-policy = {
|
|
allow-iap-ssh = {
|
|
description = "Always allow ssh from IAP"
|
|
direction = "INGRESS"
|
|
action = "allow"
|
|
priority = 100
|
|
ranges = ["35.235.240.0/20"]
|
|
ports = {
|
|
tcp = ["22"]
|
|
}
|
|
target_service_accounts = null
|
|
target_resources = null
|
|
logging = false
|
|
}
|
|
}
|
|
}
|
|
firewall_policy_attachments = {
|
|
iap-policy = module.folder1.firewall_policy_id["iap-policy"]
|
|
}
|
|
}
|
|
|
|
module "folder2" {
|
|
source = "./modules/folder"
|
|
parent = var.organization_id
|
|
name = "hf2"
|
|
firewall_policy_attachments = {
|
|
iap-policy = module.folder1.firewall_policy_id["iap-policy"]
|
|
}
|
|
}
|
|
# tftest:modules=2:resources=6
|
|
```
|
|
|
|
<!-- BEGIN TFDOC -->
|
|
## Variables
|
|
|
|
| name | description | type | required | default |
|
|
|---|---|:---: |:---:|:---:|
|
|
| *contacts* | List of essential contacts for this resource. Must be in the form EMAIL -> [NOTIFICATION_TYPES]. Valid notification types are ALL, SUSPENSION, SECURITY, TECHNICAL, BILLING, LEGAL, PRODUCT_UPDATES | <code title="map(list(string))">map(list(string))</code> | | <code title="">{}</code> |
|
|
| *firewall_policies* | Hierarchical firewall policies to *create* in this folder. | <code title="map(map(object({ description = string direction = string action = string priority = number ranges = list(string) ports = map(list(string)) target_service_accounts = list(string) target_resources = list(string) logging = bool })))">map(map(object({...})))</code> | | <code title="">{}</code> |
|
|
| *firewall_policy_attachments* | List of hierarchical firewall policy IDs to *attach* to this folder. | <code title="map(string)">map(string)</code> | | <code title="">{}</code> |
|
|
| *folder_create* | Create folder. When set to false, uses id to reference an existing folder. | <code title="">bool</code> | | <code title="">true</code> |
|
|
| *group_iam* | Authoritative IAM binding for organization groups, in {GROUP_EMAIL => [ROLES]} format. Group emails need to be static. Can be used in combination with the `iam` variable. | <code title="map(list(string))">map(list(string))</code> | | <code title="">{}</code> |
|
|
| *iam* | IAM bindings in {ROLE => [MEMBERS]} format. | <code title="map(list(string))">map(list(string))</code> | | <code title="">{}</code> |
|
|
| *id* | Folder ID in case you use folder_create=false | <code title="">string</code> | | <code title="">null</code> |
|
|
| *logging_exclusions* | Logging exclusions for this folder in the form {NAME -> FILTER}. | <code title="map(string)">map(string)</code> | | <code title="">{}</code> |
|
|
| *logging_sinks* | Logging sinks to create for this folder. | <code title="map(object({ destination = string type = string filter = string iam = bool include_children = bool exclusions = map(string) }))">map(object({...}))</code> | | <code title="">{}</code> |
|
|
| *name* | Folder name. | <code title="">string</code> | | <code title="">null</code> |
|
|
| *parent* | Parent in folders/folder_id or organizations/org_id format. | <code title="">string</code> | | <code title="null validation { condition = var.parent == null || can(regex("(organizations|folders)/[0-9]+", var.parent)) error_message = "Parent must be of the form folders/folder_id or organizations/organization_id." }">...</code> |
|
|
| *policy_boolean* | Map of boolean org policies and enforcement value, set value to null for policy restore. | <code title="map(bool)">map(bool)</code> | | <code title="">{}</code> |
|
|
| *policy_list* | Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny. | <code title="map(object({ inherit_from_parent = bool suggested_value = string status = bool values = list(string) }))">map(object({...}))</code> | | <code title="">{}</code> |
|
|
|
|
## Outputs
|
|
|
|
| name | description | sensitive |
|
|
|---|---|:---:|
|
|
| firewall_policies | Map of firewall policy resources created in this folder. | |
|
|
| firewall_policy_id | Map of firewall policy ids created in this folder. | |
|
|
| folder | Folder resource. | |
|
|
| id | Folder id. | |
|
|
| name | Folder name. | |
|
|
| sink_writer_identities | Writer identities created for each sink. | |
|
|
<!-- END TFDOC -->
|