819894d2ba
* IAM modules refactor proposal * policy * subheading * Update 20230816-iam-refactor.md * log Julio's +1 * data-catalog-policy-tag * dataproc * dataproc * folder * folder * folder * folder * project * better filtering in test examples * project * folder * folder * organization * fix variable descriptions * kms * net-vpc * dataplex-datascan * modules/iam-service-account * modules/source-repository/ * blueprints/cloud-operations/vm-migration/ * blueprints/third-party-solutions/wordpress * dataplex-datascan * blueprints/cloud-operations/workload-identity-federation * blueprints/data-solutions/cloudsql-multiregion/ * blueprints/data-solutions/composer-2 * Update 20230816-iam-refactor.md * Update 20230816-iam-refactor.md * capture discussion in architectural doc * update variable names and refactor proposal * project * blueprints first round * folder * organization * data-catalog-policy-tag * re-enable folder inventory * project module style fix * dataproc * source-repository * source-repository tests * dataplex-datascan * dataplex-datascan tests * net-vpc * net-vpc test examples * iam-service-account * iam-service-account test examples * kms * boilerplate * tfdoc * fix module tests * more blueprint fixes * fix typo in data blueprints * incomplete refactor of data platform foundations * tfdoc * data platform foundation * refactor data platform foundation iam locals * remove redundant example test * shielded folder fix * fix typo * project factory * project factory outputs * tfdoc * test workflow: less verbose tests, fix tf version * re-enable -vv, shorter traceback, fix action version * ignore github extension warning, re-enable action version * fast bootstrap IAM, untested * bootstrap stage IAM fixes * stage 0 tests * fast stage 1 * tenant stage 1 * minor changes to fast stage 0 and 1 * fast security stage * fast mt stage 0 * fast mt stage 0 * fast pf |
||
---|---|---|
.. | ||
README.md | ||
iam.tf | ||
main.tf | ||
outputs.tf | ||
tags.tf | ||
variables.tf | ||
versions.tf |
README.md
Google KMS Module
This module allows creating and managing KMS crypto keys and IAM bindings at both the keyring and crypto key level. An existing keyring can be used, or a new one can be created and managed by the module if needed.
When using an existing keyring be mindful about applying IAM bindings, as all bindings used by this module are authoritative, and you might inadvertently override bindings managed by the keyring creator.
Protecting against destroy
In this module no lifecycle blocks are set on resources to prevent destroy, in order to allow for experimentation and testing where rapid apply
/destroy
cycles are needed. If you plan on using this module to manage non-development resources, clone it and uncomment the lifecycle blocks found in main.tf
.
Examples
Using an existing keyring
module "kms" {
source = "./fabric/modules/kms"
project_id = "my-project"
iam = {
"roles/cloudkms.admin" = ["user:user1@example.com"]
}
keyring = { location = "europe-west1", name = "test" }
keyring_create = false
keys = { key-a = null, key-b = null, key-c = null }
}
# tftest skip (uses data sources)
Keyring creation and crypto key rotation and IAM roles
module "kms" {
source = "./fabric/modules/kms"
project_id = "my-project"
key_iam = {
key-a = {
"roles/cloudkms.admin" = ["user:user3@example.com"]
}
}
key_iam_bindings_additive = {
key-b-am1 = {
key = "key-b"
member = "user:am1@example.com"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
}
}
keyring = { location = "europe-west1", name = "test" }
keys = {
key-a = null
key-b = { rotation_period = "604800s", labels = null }
key-c = { rotation_period = null, labels = { env = "test" } }
}
}
# tftest modules=1 resources=6
Crypto key purpose
module "kms" {
source = "./fabric/modules/kms"
project_id = "my-project"
key_purpose = {
key-c = {
purpose = "ASYMMETRIC_SIGN"
version_template = {
algorithm = "EC_SIGN_P384_SHA384"
protection_level = null
}
}
}
keyring = { location = "europe-west1", name = "test" }
keys = { key-a = null, key-b = null, key-c = null }
}
# tftest modules=1 resources=4
Variables
name | description | type | required | default |
---|---|---|---|---|
keyring | Keyring attributes. | object({…}) |
✓ | |
project_id | Project id where the keyring will be created. | string |
✓ | |
iam | Keyring IAM bindings in {ROLE => [MEMBERS]} format. | map(list(string)) |
{} |
|
iam_bindings | Keyring authoritative IAM bindings in {ROLE => {members = [], condition = {}}}. | map(object({…})) |
{} |
|
iam_bindings_additive | Keyring individual additive IAM bindings. Keys are arbitrary. | map(object({…})) |
{} |
|
key_iam | Key IAM bindings in {KEY => {ROLE => [MEMBERS]}} format. | map(map(list(string))) |
{} |
|
key_iam_bindings | Key authoritative IAM bindings in {KEY => {ROLE => {members = [], condition = {}}}}. | map(object({…})) |
{} |
|
key_iam_bindings_additive | Key individual additive IAM bindings. Keys are arbitrary. | map(object({…})) |
{} |
|
key_purpose | Per-key purpose, if not set defaults will be used. If purpose is not ENCRYPT_DECRYPT (the default), version_template.algorithm is required. |
map(object({…})) |
{} |
|
key_purpose_defaults | Defaults used for key purpose when not defined at the key level. If purpose is not ENCRYPT_DECRYPT (the default), version_template.algorithm is required. |
object({…}) |
{…} |
|
keyring_create | Set to false to manage keys and IAM bindings in an existing keyring. | bool |
true |
|
keys | Key names and base attributes. Set attributes to null if not needed. | map(object({…})) |
{} |
|
tag_bindings | Tag bindings for this keyring, in key => tag value id format. | map(string) |
null |
Outputs
name | description | sensitive |
---|---|---|
id | Fully qualified keyring id. | |
key_ids | Fully qualified key ids. | |
keyring | Keyring resource. | |
keys | Key resources. | |
location | Keyring location. | |
name | Keyring name. |