History

Ludovico Magnocavallo f6775aca1b Use the same versions file everywhere, pin to tf 1.0+ provider 4.0+ (#355 ) * add default versions file, remove old providers and versions * use default versions file everywhere * fix kms module * re-add provider configuration for data platform step 2 * update kms module outputs sorting * update kms documentation * fix data solutions tests * fix GKE workload identity attribute name * work around firewall provider issue in datafusion example		2021-11-03 15:05:43 +01:00
..
README.md	Use the same versions file everywhere, pin to tf 1.0+ provider 4.0+ (#355 )	2021-11-03 15:05:43 +01:00
main.tf	Use the same versions file everywhere, pin to tf 1.0+ provider 4.0+ (#355 )	2021-11-03 15:05:43 +01:00
outputs.tf	Use the same versions file everywhere, pin to tf 1.0+ provider 4.0+ (#355 )	2021-11-03 15:05:43 +01:00
variables.tf	Update copyright to 2021	2021-02-15 09:38:10 +01:00
versions.tf	Use the same versions file everywhere, pin to tf 1.0+ provider 4.0+ (#355 )	2021-11-03 15:05:43 +01:00

README.md

Google KMS Module

This module allows creating and managing KMS crypto keys and IAM bindings at both the keyring and crypto key level. An existing keyring can be used, or a new one can be created and managed by the module if needed.

When using an existing keyring be mindful about applying IAM bindings, as all bindings used by this module are authoritative, and you might inadvertently override bindings managed by the keyring creator.

Protecting against destroy

In this module no lifecycle blocks are set on resources to prevent destroy, in order to allow for experimentation and testing where rapid apply/destroy cycles are needed. If you plan on using this module to manage non-development resources, clone it and uncomment the lifecycle blocks found in main.tf.

Examples

Using an existing keyring

module "kms" {
  source         = "./modules/kms"
  project_id     = "my-project"
  iam    = {
    "roles/owner" = ["user:user1@example.com"]
  }
  keyring        = { location = "europe-west1", name = "test" }
  keyring_create = false
  keys           = { key-a = null, key-b = null, key-c = null }
}
# tftest:skip

Keyring creation and crypto key rotation and IAM roles

module "kms" {
  source     = "./modules/kms"
  project_id = "my-project"
  key_iam = {
    key-a = {
      "roles/owner" = ["user:user1@example.com"]
    }
  }
  keyring = { location = "europe-west1", name = "test" }
  keys = {
    key-a = null
    key-b = { rotation_period = "604800s", labels = null }
    key-c = { rotation_period = null, labels = { env = "test" } }
  }
}
# tftest:modules=1:resources=5

Crypto key purpose

module "kms" {
  source      = "./modules/kms"
  project_id  = "my-project"
  key_purpose = {
    key-c = {
      purpose = "ASYMMETRIC_SIGN"
      version_template = {
        algorithm        = "EC_SIGN_P384_SHA384"
        protection_level = null
      }
    }
  }
  keyring     = { location = "europe-west1", name = "test" }
  keys        = { key-a = null, key-b = null, key-c = null }
}
# tftest:modules=1:resources=4

Variables

name	description	type	required	default
keyring	Keyring attributes.	`object({...})`	✓
project_id	Project id where the keyring will be created.	`string`	✓
iam	Keyring IAM bindings for topic in {ROLE => [MEMBERS]} format.	`map(list(string))`		`{}`
key_iam	Key IAM bindings for topic in {KEY => {ROLE => [MEMBERS]}} format.	`map(map(list(string)))`		`{}`
key_purpose	Per-key purpose, if not set defaults will be used. If purpose is not `ENCRYPT_DECRYPT` (the default), `version_template.algorithm` is required.	`map(object({...}))`		`{}`
key_purpose_defaults	Defaults used for key purpose when not defined at the key level. If purpose is not `ENCRYPT_DECRYPT` (the default), `version_template.algorithm` is required.	`object({...})`		`...`
keyring_create	Set to false to manage keys and IAM bindings in an existing keyring.	`bool`		`true`
keys	Key names and base attributes. Set attributes to null if not needed.	`map(object({...}))`		`{}`

Outputs

name	description	sensitive
id	Keyring self link.
key_ids	Key self links.
keyring	Keyring resource.
keys	Key resources.
location	Keyring location.
name	Keyring name.