b3df6598d4 | ||
---|---|---|
.. | ||
README.md | ||
main.tf | ||
outputs.tf | ||
variables.tf | ||
versions.tf |
README.md
Project Module
Examples
Minimal example with IAM
module "project" {
source = "./modules/project"
billing_account = "123456-123456-123456"
name = "project-example"
parent = "folders/1234567890"
prefix = "foo"
services = [
"container.googleapis.com",
"stackdriver.googleapis.com"
]
iam_roles = ["roles/container.hostServiceAgentUser"]
iam_members = {
"roles/container.hostServiceAgentUser" = [
"serviceAccount:${var.gke_service_account}"
]
}
}
Organization policies
module "project" {
source = "./modules/project"
billing_account = "123456-123456-123456"
name = "project-example"
parent = "folders/1234567890"
prefix = "foo"
services = [
"container.googleapis.com",
"stackdriver.googleapis.com"
]
policy_boolean = {
"constraints/compute.disableGuestAttributesAccess" = true
"constraints/compute.skipDefaultNetworkCreation" = true
}
policy_list = {
"constraints/compute.trustedImageProjects" = {
inherit_from_parent = null
suggested_value = null
status = true
values = ["projects/my-project"]
}
}
}
Variables
name | description | type | required | default |
---|---|---|---|---|
name | Project name and id suffix. | string |
✓ | |
parent | The resource name of the parent Folder or Organization. Must be of the form folders/folder_id or organizations/org_id. | string |
✓ | |
auto_create_network | Whether to create the default network for the project | bool |
false |
|
billing_account | Billing account id. | string |
|
|
custom_roles | Map of role name => list of permissions to create in this project. | map(list(string)) |
{} |
|
iam_additive_members | Map of member lists used to set non authoritative bindings, keyed by role. | map(list(string)) |
{} |
|
iam_additive_roles | List of roles used to set non authoritative bindings. | list(string) |
[] |
|
iam_members | Map of member lists used to set authoritative bindings, keyed by role. | map(list(string)) |
{} |
|
iam_roles | List of roles used to set authoritative bindings. | list(string) |
[] |
|
labels | Resource labels. | map(string) |
{} |
|
lien_reason | If non-empty, creates a project lien with this description. | string |
|
|
oslogin | Enable OS Login. | bool |
false |
|
oslogin_admins | List of IAM-style identities that will be granted roles necessary for OS Login administrators. | list(string) |
[] |
|
oslogin_users | List of IAM-style identities that will be granted roles necessary for OS Login users. | list(string) |
[] |
|
policy_boolean | Map of boolean org policies and enforcement value, set value to null for policy restore. | map(bool) |
{} |
|
policy_list | Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny. | map(object({...})) |
{} |
|
prefix | Prefix used to generate project id and name. | string |
null |
|
services | Service APIs to enable. | list(string) |
[] |
Outputs
name | description | sensitive |
---|---|---|
cloudsvc_service_account | Cloud services service account. | |
custom_roles | Ids of the created custom roles. | |
gce_service_account | Default GCE service account. | |
gcr_service_account | Default GCR service account. | |
gke_service_account | Default GKE service account. | |
name | Project ame. | |
number | Project number. | |
project_id | Project id. |