cloud-foundation-fabric/modules/folders-unit

Google Cloud Unit Folders Module

This module allows creation and management of an organizational hierarchy "unit" composed of a parent folder (usually mapped to a business unit or team), and a set of child folders (usually mapped to environments) each with a corresponding set of service accounts, IAM bindings and GCS buckets.

Example

module "folders-unit" {
  source                = "./modules/folders-unit"
  name                  = "Business Intelligence"
  short_name            = "bi"
  automation_project_id = "automation-project-394yr923811"
  billing_account_id    = "015617-16GHBC-AF02D9"
  organization_id       = "506128240800"
  root_node             = "folders/93469270123701"
  prefix                = "unique-prefix"
  environments          = {
    dev = "Development",
    test = "Testing",
    prod = "Production"
  }
  service_account_keys  = true
}
# tftest modules=1 resources=37

Variables

name	description	type	required	default
automation_project_id	Project id used for automation service accounts.	string	✓
billing_account_id	Country billing account account.	string	✓
name	Top folder name.	string	✓
organization_id	Organization id in organizations/nnnnnn format.	string	✓
root_node	Root node in folders/folder_id or organizations/org_id format.	string	✓
short_name	Short name used as GCS bucket and service account prefixes, do not use capital letters or spaces.	string	✓
environments	Unit environments short names.	map(string)		{…}
gcs_defaults	Defaults use for the state GCS buckets.	map(string)		{…}
iam	IAM bindings for the top-level folder in {ROLE => [MEMBERS]} format.	map(list(string))		{}
iam_billing_config	Grant billing user role to service accounts, defaults to granting on the billing account.	object({…})		{…}
iam_enviroment_roles	IAM roles granted to the environment service account on the environment sub-folder.	list(string)		[…]
iam_xpn_config	Grant Shared VPC creation roles to service accounts, defaults to granting at folder level.	object({…})		{…}
prefix	Optional prefix used for GCS bucket names to ensure uniqueness.	string		null
service_account_keys	Generate and store service account keys in the state file.	bool		false

Outputs

name	description	sensitive
env_folders	Unit environments folders.
env_gcs_buckets	Unit environments tfstate gcs buckets.
env_sa_keys	Unit environments service account keys.	✓
env_service_accounts	Unit environments service accounts.
unit_folder	Unit top level folder.