History

Ludovico Magnocavallo 9b33ece703 Update README.md		2020-06-10 18:45:43 +02:00
..
README.md	Update README.md	2020-06-10 18:45:43 +02:00
backend.tf.sample	- Rename example to `cmek-via-centralized-kms`	2020-06-10 15:22:43 +02:00
diagram.png	- Rename example to `cmek-via-centralized-kms`	2020-06-10 15:22:43 +02:00
main.tf	Fix encryption_keys variable name	2020-06-10 16:31:42 +02:00
outputs.tf	- Rename example to `cmek-via-centralized-kms`	2020-06-10 15:22:43 +02:00
variables.tf	- Rename example to `cmek-via-centralized-kms`	2020-06-10 15:22:43 +02:00
versions.tf	- Rename example to `cmek-via-centralized-kms`	2020-06-10 15:22:43 +02:00

README.md

GCE and GCS CMEK via centralized Cloud KMS

This example creates a sample centralized Cloud KMS configuration, and uses it to implement CMEK for Cloud Storage and Compute Engine in a separate project.

The example is designed to match real-world use cases with a minimum amount of resources, and be used as a starting point for scenarios where application projects implement CMEK using keys managed by a central team. It also includes the IAM wiring needd to make such scenarios work.

This is the hgh level diagram:

Managed resources and services

This sample creates several distinct groups of resources:

projects
- Cloud KMS project
- Service Project configured for GCE instances and GCS buckets
networking
- VPC network
- One subnet
- Firewall rules for SSH access via IAP and open communication within the VPC
IAM
- One service account for the GGE instance
KMS
- One key ring
- One crypto key (Procection level: softwere) for Cloud Engine
- One crypto key (Protection level: softwere) for Cloud Storage
GCE
- One instance encrypted with a CMEK Cryptokey hosted in Cloud KMS
GCS
- One bucket encrypted with a CMEK Cryptokey hosted in Cloud KMS

Variables

name	description	type	required	default
billing_account	Billing account id used as default for new projects.	`string`	✓
projects_parent	The resource name of the parent Folder or Organization. Must be of the form folders/folder_id or organizations/org_id.	`string`	✓
project_kms_name	Name for the new KMS Project.	`string`		`my-project-kms-001`
project_service_name	Name for the new Service Project.	`string`		`my-project-service-001`
resource_location	The location where resources will be deployed.	`string`		`europe`
resource_region	The region where resources will be deployed.	`string`		`europe-west1`
resource_zone	The zone where resources will be deployed.	`string`		`europe-west1-b`
vpc_ip_cidr_range	Ip range used in the subnet deployef in the Service Project.	`string`		`10.0.0.0/20`
vpc_name	Name of the VPC created in the Service Project.	`string`		`local`
vpc_subnet_name	Name of the subnet created in the Service Project.	`string`		`subnet`

Outputs

name	description	sensitive
buckets_keys	GCS Buckets Cloud KMS crypto keys.
projects	Project ids.
vms_keys	GCE VMs Cloud KMS crypto keys.