From a9c47681d8c6a8e4ed7ff4f3ccfbdcf09fc575a4 Mon Sep 17 00:00:00 2001 From: Ludovico Magnocavallo Date: Thu, 10 Nov 2022 19:34:45 +0100 Subject: [PATCH] Refactor vps-sc module for Terraform 1.3 (#963) * wip * example tests * module tests * streamline example * fast * tfdoc * use collections.Counter in tests --- fast/stages/02-security/README.md | 135 +++++------ fast/stages/02-security/variables.tf | 133 ++++++----- fast/stages/02-security/vpc-sc.tf | 181 ++++++-------- modules/vpc-sc/README.md | 138 +++++------ modules/vpc-sc/access-levels.tf | 98 ++++---- modules/vpc-sc/service-perimeters-bridge.tf | 2 + modules/vpc-sc/service-perimeters-regular.tf | 222 +++++++----------- modules/vpc-sc/variables.tf | 206 ++++++++-------- .../fast/stages/s02_security/fixture/main.tf | 95 ++++---- tests/modules/vpc_sc/fixture/main.tf | 136 +---------- .../vpc_sc/fixture/test.regular.tfvars | 96 ++++++++ tests/modules/vpc_sc/fixture/variables.tf | 53 +++++ tests/modules/vpc_sc/test_plan.py | 23 +- 13 files changed, 715 insertions(+), 803 deletions(-) create mode 100644 tests/modules/vpc_sc/fixture/test.regular.tfvars create mode 100644 tests/modules/vpc_sc/fixture/variables.tf diff --git a/fast/stages/02-security/README.md b/fast/stages/02-security/README.md index e61918bb..7d1a83a3 100644 --- a/fast/stages/02-security/README.md +++ b/fast/stages/02-security/README.md @@ -156,109 +156,85 @@ This allows configuring VPC SC in a fairly flexible and concise way, without rep #### Dry-run vs. enforced -The VPC SC configuration is set up by default in dry-run mode to allow easy experimentation, and detecting violations before enforcement. Once everything is set up correctly, switching to enforced mode needs to be done in code, by swapping the contents of the `spec` and `status` attributes for perimeters in the `vpc-sc.tf` file. The effort involved is minimal (2 lines of code per perimeter), and comments help identify the correct lines. - -#### Perimeter resources - -Projects are added to perimeters via the `vpc_sc_perimeter_projects`, and that's currently the only way of doing it without generating permadiffs or conflicts, because of the way the Terraform provider is implemented. - -Once the Google Terraform Provider [implements support for dry-run mode in the additive resource](https://github.com/hashicorp/terraform-provider-google/issues/7270), it will be possible to concurrently manage perimeter resources both here and in subsequent Terraform configurations, for example to allow the Project Factory to add a project to a perimeter during the creation process. - -Bridge perimeters are auto-populated with all projects configured for the connected regular perimeters. - -An example of adding projects to perimeters using project numbers: - -```hcl -# terraform.tfvars - -vpc_sc_perimeter_projects = { - dev = ["projects/12345678", "projects/12345679"] - landing = ["projects/12345670"] - prod = ["projects/12345674", "projects/12345675"] -} -``` +The VPC SC configuration is set up by default in dry-run mode to allow easy experimentation, and detecting violations before enforcement. Once everything is set up correctly, switching to enforced mode needs to be done in code, by changing the `vpc_sc_explicit_dry_run_spec` local. #### Access levels -Below an example for an access level that allows unconditional ingress from a set of IP CIDR ranges can be configured once, and enabled on selected perimeters: +Access levels are defined via the `vpc_sc_access_levels` variable, and referenced by key in perimeter definitions: ```hcl -# terraform.tfvars - vpc_sc_access_levels = { onprem = { - combining_function = null, conditions = [{ - ip_subnetworks = ["101.101.101.0/24"], - members = null, negate = null, - regions = null, required_access_levels = null + ip_subnetworks = ["101.101.101.0/24"] }] } } -vpc_sc_perimeter_access_levels = { - dev = null - landing = ["onprem"] - prod = ["onprem"] -} ``` #### Ingress and Egress policies -The same applies to Ingress and Egress policies, as shown in the examples below referencing the automation service account for this stage. - -Below you can find an ingress policy configuration that allows applying Terraform from outside the perimeter, useful when bringing up this stage to avoid generating violations: +Ingress and egress policy are defined via the `vpc_sc_egress_policies` and `vpc_sc_ingress_policies`, and referenced by key in perimeter definitions: ```hcl -# terraform.tfvars - -vpc_sc_ingress_policies = { - iac = { - ingress_from = { - identities = [ - "serviceAccount:xxx-prod-resman-security-0@xxx-prod-iac-core-0.iam.gserviceaccount.com" - ] - source_access_levels = ["*"] - identity_type = null - source_resources = null - } - ingress_to = { - operations = [{ method_selectors = [], service_name = "*" }] - resources = ["*"] - } - } -} -vpc_sc_perimeter_ingress_policies = { - dev = ["iac"] - landing = ["iac"] - prod = ["iac"] -} -``` - -Below you can find an egress policy that allows writing Terraform state to the automation bucket, useful once Terraform starts running inside the perimeter in a pipeline: - -```hcl -# terraform.tfvars - vpc_sc_egress_policies = { iac-gcs = { - egress_from = { - identity_type = null + from = { identities = [ "serviceAccount:xxx-prod-resman-security-0@xxx-prod-iac-core-0.iam.gserviceaccount.com" ] } - egress_to = { + to = { operations = [{ - method_selectors = ["*"], service_name = "storage.googleapis.com" + method_selectors = ["*"] + service_name = "storage.googleapis.com" }] resources = ["projects/123456782"] } } } -vpc_sc_perimeter_ingress_policies = { - dev = ["iac-gcs"] - landing = ["iac-gcs"] - prod = ["iac-gcs"] +vpc_sc_ingress_policies = { + iac = { + from = { + identities = [ + "serviceAccount:xxx-prod-resman-security-0@xxx-prod-iac-core-0.iam.gserviceaccount.com" + ] + access_levels = ["*"] + } + to = { + operations = [{ method_selectors = [], service_name = "*" }] + resources = ["*"] + } + } +} +``` + +#### Perimeters + +Regular perimeters are defined via the the `vpc_sc_perimeters` variable, and bridge perimeters are automatically populated from that variable. + +Support for independently adding projects to perimeters outside of this Terraform setup is pending resolution of [this Google Terraform Provider issue](https://github.com/hashicorp/terraform-provider-google/issues/7270), which implements support for dry-run mode in the additive resource. + +Access levels and egress/ingress policies are referenced in perimeters via keys. + +```hcl +vpc_sc_perimeters = { + dev = { + egress_policies = ["iac-gcs"] + ingress_policies = ["iac"] + resources = ["projects/1111111111"] + } + dev = { + egress_policies = ["iac-gcs"] + ingress_policies = ["iac"] + resources = ["projects/0000000000"] + } + dev = { + access_levels = ["onprem"] + egress_policies = ["iac-gcs"] + ingress_policies = ["iac"] + resources = ["projects/2222222222"] + } } ``` @@ -296,13 +272,10 @@ Some references that might be useful in setting up this stage: | [kms_defaults](variables.tf#L57) | Defaults used for KMS keys. | object({…}) | | {…} | | | [kms_keys](variables.tf#L69) | KMS keys to create, keyed by name. Null attributes will be interpolated with defaults. | map(object({…})) | | {} | | | [outputs_location](variables.tf#L101) | Path where providers, tfvars files, and lists for the following stages are written. Leave empty to disable. | string | | null | | -| [vpc_sc_access_levels](variables.tf#L118) | VPC SC access level definitions. | map(object({…})) | | {} | | -| [vpc_sc_egress_policies](variables.tf#L133) | VPC SC egress policy defnitions. | map(object({…})) | | {} | | -| [vpc_sc_ingress_policies](variables.tf#L151) | VPC SC ingress policy defnitions. | map(object({…})) | | {} | | -| [vpc_sc_perimeter_access_levels](variables.tf#L171) | VPC SC perimeter access_levels. | object({…}) | | null | | -| [vpc_sc_perimeter_egress_policies](variables.tf#L181) | VPC SC egress policies per perimeter, values reference keys defined in the `vpc_sc_ingress_policies` variable. | object({…}) | | null | | -| [vpc_sc_perimeter_ingress_policies](variables.tf#L191) | VPC SC ingress policies per perimeter, values reference keys defined in the `vpc_sc_ingress_policies` variable. | object({…}) | | null | | -| [vpc_sc_perimeter_projects](variables.tf#L201) | VPC SC perimeter resources. | object({…}) | | null | | +| [vpc_sc_access_levels](variables.tf#L118) | VPC SC access level definitions. | map(object({…})) | | {} | | +| [vpc_sc_egress_policies](variables.tf#L147) | VPC SC egress policy defnitions. | map(object({…})) | | {} | | +| [vpc_sc_ingress_policies](variables.tf#L167) | VPC SC ingress policy defnitions. | map(object({…})) | | {} | | +| [vpc_sc_perimeters](variables.tf#L188) | VPC SC regular perimeter definitions. | object({…}) | | {} | | ## Outputs diff --git a/fast/stages/02-security/variables.tf b/fast/stages/02-security/variables.tf index ff0edc77..a28ed56a 100644 --- a/fast/stages/02-security/variables.tf +++ b/fast/stages/02-security/variables.tf @@ -118,92 +118,95 @@ variable "prefix" { variable "vpc_sc_access_levels" { description = "VPC SC access level definitions." type = map(object({ - combining_function = string - conditions = list(object({ - ip_subnetworks = list(string) - members = list(string) - negate = bool - regions = list(string) - required_access_levels = list(string) - })) + combining_function = optional(string) + conditions = optional(list(object({ + device_policy = optional(object({ + allowed_device_management_levels = optional(list(string)) + allowed_encryption_statuses = optional(list(string)) + require_admin_approval = bool + require_corp_owned = bool + require_screen_lock = optional(bool) + os_constraints = optional(list(object({ + os_type = string + minimum_version = optional(string) + require_verified_chrome_os = optional(bool) + }))) + })) + ip_subnetworks = optional(list(string), []) + members = optional(list(string), []) + negate = optional(bool) + regions = optional(list(string), []) + required_access_levels = optional(list(string), []) + })), []) + description = optional(string) })) - default = {} + default = {} + nullable = false } variable "vpc_sc_egress_policies" { description = "VPC SC egress policy defnitions." type = map(object({ - egress_from = object({ - identity_type = string - identities = list(string) + from = object({ + identity_type = optional(string, "ANY_IDENTITY") + identities = optional(list(string)) }) - egress_to = object({ - operations = list(object({ - method_selectors = list(string) + to = object({ + operations = optional(list(object({ + method_selectors = optional(list(string)) service_name = string - })) - resources = list(string) + })), []) + resources = optional(list(string)) + resource_type_external = optional(bool, false) }) })) - default = {} + default = {} + nullable = false } variable "vpc_sc_ingress_policies" { description = "VPC SC ingress policy defnitions." type = map(object({ - ingress_from = object({ - identity_type = string - identities = list(string) - source_access_levels = list(string) - source_resources = list(string) + from = object({ + access_levels = optional(list(string), []) + identity_type = optional(string) + identities = optional(list(string)) + resources = optional(list(string), []) }) - ingress_to = object({ - operations = list(object({ - method_selectors = list(string) + to = object({ + operations = optional(list(object({ + method_selectors = optional(list(string)) service_name = string - })) - resources = list(string) + })), []) + resources = optional(list(string)) }) })) - default = {} + default = {} + nullable = false } -variable "vpc_sc_perimeter_access_levels" { - description = "VPC SC perimeter access_levels." +variable "vpc_sc_perimeters" { + description = "VPC SC regular perimeter definitions." type = object({ - dev = list(string) - landing = list(string) - prod = list(string) + dev = optional(object({ + access_levels = optional(list(string), []) + egress_policies = optional(list(string), []) + ingress_policies = optional(list(string), []) + resources = optional(list(string), []) + }), {}) + landing = optional(object({ + access_levels = optional(list(string), []) + egress_policies = optional(list(string), []) + ingress_policies = optional(list(string), []) + resources = optional(list(string), []) + }), {}) + prod = optional(object({ + access_levels = optional(list(string), []) + egress_policies = optional(list(string), []) + ingress_policies = optional(list(string), []) + resources = optional(list(string), []) + }), {}) }) - default = null -} - -variable "vpc_sc_perimeter_egress_policies" { - description = "VPC SC egress policies per perimeter, values reference keys defined in the `vpc_sc_ingress_policies` variable." - type = object({ - dev = list(string) - landing = list(string) - prod = list(string) - }) - default = null -} - -variable "vpc_sc_perimeter_ingress_policies" { - description = "VPC SC ingress policies per perimeter, values reference keys defined in the `vpc_sc_ingress_policies` variable." - type = object({ - dev = list(string) - landing = list(string) - prod = list(string) - }) - default = null -} - -variable "vpc_sc_perimeter_projects" { - description = "VPC SC perimeter resources." - type = object({ - dev = list(string) - landing = list(string) - prod = list(string) - }) - default = null + default = {} + nullable = false } diff --git a/fast/stages/02-security/vpc-sc.tf b/fast/stages/02-security/vpc-sc.tf index e9887d20..60767fe5 100644 --- a/fast/stages/02-security/vpc-sc.tf +++ b/fast/stages/02-security/vpc-sc.tf @@ -15,118 +15,34 @@ */ locals { - _perimeter_names = ["dev", "landing", "prod"] - # dereference perimeter egress policy names to the actual objects - _vpc_sc_perimeter_egress_policies = { - for k, v in coalesce(var.vpc_sc_perimeter_egress_policies, {}) : - k => [ - for i in coalesce(v, []) : var.vpc_sc_egress_policies[i] - if lookup(var.vpc_sc_egress_policies, i, null) != null - ] - } - # dereference perimeter ingress policy names to the actual objects - _vpc_sc_perimeter_ingress_policies = { - for k, v in coalesce(var.vpc_sc_perimeter_ingress_policies, {}) : - k => [ - for i in coalesce(v, []) : var.vpc_sc_ingress_policies[i] - if lookup(var.vpc_sc_ingress_policies, i, null) != null - ] - } + _vpc_sc_vpc_accessible_services = null + _vpc_sc_restricted_services = yamldecode( + file("${path.module}/vpc-sc-restricted-services.yaml") + ) # compute the number of projects in each perimeter to detect which to create vpc_sc_counts = { - for k in local._perimeter_names : k => length( - local.vpc_sc_perimeter_projects[k] - ) + for k, v in var.vpc_sc_perimeters : k => length(v.resources) } # define dry run spec at file level for convenience vpc_sc_explicit_dry_run_spec = true # compute perimeter bridge resources (projects) - vpc_sc_p_bridge_resources = { + vpc_sc_bridge_resources = { landing_to_dev = concat( - local.vpc_sc_perimeter_projects.landing, - local.vpc_sc_perimeter_projects.dev + var.vpc_sc_perimeters.landing.resources, + var.vpc_sc_perimeters.dev.resources ) landing_to_prod = concat( - local.vpc_sc_perimeter_projects.landing, - local.vpc_sc_perimeter_projects.prod + var.vpc_sc_perimeters.landing.resources, + var.vpc_sc_perimeters.prod.resources ) } - # computer perimeter regular specs / status - vpc_sc_p_regular_specs = { - dev = { - access_levels = coalesce( - try(var.vpc_sc_perimeter_access_levels.dev, null), [] - ) - resources = local.vpc_sc_perimeter_projects.dev - restricted_services = local.vpc_sc_restricted_services - egress_policies = try( - local._vpc_sc_perimeter_egress_policies.dev, null - ) - ingress_policies = try( - local._vpc_sc_perimeter_ingress_policies.dev, null - ) - vpc_accessible_services = null - # vpc_accessible_services = { - # allowed_services = ["RESTRICTED-SERVICES"] - # enable_restriction = true - # } - } - landing = { - access_levels = coalesce( - try(var.vpc_sc_perimeter_access_levels.landing, null), [] - ) - resources = local.vpc_sc_perimeter_projects.landing - restricted_services = local.vpc_sc_restricted_services - egress_policies = try( - local._vpc_sc_perimeter_egress_policies.landing, null - ) - ingress_policies = try( - local._vpc_sc_perimeter_ingress_policies.landing, null - ) - vpc_accessible_services = null - # vpc_accessible_services = { - # allowed_services = ["RESTRICTED-SERVICES"] - # enable_restriction = true - # } - } - prod = { - access_levels = coalesce( - try(var.vpc_sc_perimeter_access_levels.prod, null), [] - ) - # combine the security project, and any specified in the variable - resources = local.vpc_sc_perimeter_projects.prod - restricted_services = local.vpc_sc_restricted_services - egress_policies = try( - local._vpc_sc_perimeter_egress_policies.prod, null - ) - ingress_policies = try( - local._vpc_sc_perimeter_ingress_policies.prod, null - ) - vpc_accessible_services = null - # vpc_accessible_services = { - # allowed_services = ["RESTRICTED-SERVICES"] - # enable_restriction = true - # } - } + # compute spec/status for each perimeter + vpc_sc_perimeters = { + dev = merge(var.vpc_sc_perimeters.dev, { + restricted_services = local._vpc_sc_restricted_services + vpc_accessible_services = local._vpc_sc_vpc_accessible_services + }) } - # account for null values in variable - vpc_sc_perimeter_projects = ( - var.vpc_sc_perimeter_projects == null ? - { - for k in local._perimeter_names : k => [] - } - : { - for k in local._perimeter_names : k => ( - var.vpc_sc_perimeter_projects[k] == null - ? [] - : var.vpc_sc_perimeter_projects[k] - ) - } - ) - # get the list of restricted services from the yaml file - vpc_sc_restricted_services = yamldecode( - file("${path.module}/vpc-sc-restricted-services.yaml") - ) } module "vpc-sc" { @@ -138,22 +54,39 @@ module "vpc-sc" { parent = "organizations/${var.organization.id}" title = "default" } - access_levels = coalesce(try(var.vpc_sc_access_levels, null), {}) - # bridge type perimeters + access_levels = var.vpc_sc_access_levels + egress_policies = var.vpc_sc_egress_policies + ingress_policies = var.vpc_sc_ingress_policies service_perimeters_bridge = merge( # landing to dev, only we have projects in landing and dev perimeters local.vpc_sc_counts.landing * local.vpc_sc_counts.dev == 0 ? {} : { landing_to_dev = { - spec_resources = local.vpc_sc_p_bridge_resources.landing_to_dev - status_resources = null + spec_resources = ( + local.vpc_sc_explicit_dry_run_spec + ? local.vpc_sc_bridge_resources.landing_to_dev + : null + ) + status_resources = ( + local.vpc_sc_explicit_dry_run_spec + ? null + : local.vpc_sc_bridge_resources.landing_to_dev + ) use_explicit_dry_run_spec = local.vpc_sc_explicit_dry_run_spec } }, # landing to prod, only we have projects in landing and prod perimeters local.vpc_sc_counts.landing * local.vpc_sc_counts.prod == 0 ? {} : { landing_to_prod = { - spec_resources = local.vpc_sc_p_bridge_resources.landing_to_prod - status_resources = null + spec_resources = ( + local.vpc_sc_explicit_dry_run_spec + ? local.vpc_sc_bridge_resources.landing_to_prod + : null + ) + status_resources = ( + local.vpc_sc_explicit_dry_run_spec + ? null + : local.vpc_sc_bridge_resources.landing_to_prod + ) use_explicit_dry_run_spec = local.vpc_sc_explicit_dry_run_spec } } @@ -163,24 +96,48 @@ module "vpc-sc" { # dev if we have projects in var.vpc_sc_perimeter_projects.dev local.vpc_sc_counts.dev == 0 ? {} : { dev = { - spec = local.vpc_sc_p_regular_specs.dev - status = null + spec = ( + local.vpc_sc_explicit_dry_run_spec + ? var.vpc_sc_perimeters.dev + : null + ) + status = ( + local.vpc_sc_explicit_dry_run_spec + ? null + : var.vpc_sc_perimeters.dev + ) use_explicit_dry_run_spec = local.vpc_sc_explicit_dry_run_spec } }, # landing if we have projects in var.vpc_sc_perimeter_projects.landing local.vpc_sc_counts.landing == 0 ? {} : { landing = { - spec = local.vpc_sc_p_regular_specs.landing - status = null + spec = ( + local.vpc_sc_explicit_dry_run_spec + ? var.vpc_sc_perimeters.landing + : null + ) + status = ( + local.vpc_sc_explicit_dry_run_spec + ? null + : var.vpc_sc_perimeters.landing + ) use_explicit_dry_run_spec = local.vpc_sc_explicit_dry_run_spec } }, # prod if we have projects in var.vpc_sc_perimeter_projects.prod local.vpc_sc_counts.prod == 0 ? {} : { prod = { - spec = local.vpc_sc_p_regular_specs.prod - status = null + spec = ( + local.vpc_sc_explicit_dry_run_spec + ? var.vpc_sc_perimeters.prod + : null + ) + status = ( + local.vpc_sc_explicit_dry_run_spec + ? null + : var.vpc_sc_perimeters.prod + ) use_explicit_dry_run_spec = local.vpc_sc_explicit_dry_run_spec } }, diff --git a/modules/vpc-sc/README.md b/modules/vpc-sc/README.md index 06407eeb..a78158e1 100644 --- a/modules/vpc-sc/README.md +++ b/modules/vpc-sc/README.md @@ -2,7 +2,7 @@ This module offers a unified interface to manage VPC Service Controls [Access Policy](https://cloud.google.com/access-context-manager/docs/create-access-policy), [Access Levels](https://cloud.google.com/access-context-manager/docs/manage-access-levels), and [Service Perimeters](https://cloud.google.com/vpc-service-controls/docs/service-perimeters). -Given the complexity of the underlying resources, the module intentionally mimics their interfaces to make it easier to map their documentation onto its variables, and reduce the internal complexity. The tradeoff is some verbosity, and a very complex type for the `service_perimeters_regular` variable (while [optional type attributes](https://www.terraform.io/language/expressions/type-constraints#experimental-optional-object-type-attributes) are still an experiment). +Given the complexity of the underlying resources, the module intentionally mimics their interfaces to make it easier to map their documentation onto its variables, and reduce the internal complexity. If you are using [Application Default Credentials](https://cloud.google.com/sdk/gcloud/reference/auth/application-default) with Terraform and run into permissions issues, make sure to check out the recommended provider configuration in the [VPC SC resources documentation](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/access_context_manager_access_level). @@ -44,21 +44,16 @@ module "test" { access_policy = "12345678" access_levels = { a1 = { - combining_function = null - conditions = [{ - members = ["user:user1@example.com"], ip_subnetworks = null, - negate = null, regions = null, required_access_levels = null - }] + conditions = [ + { members = ["user:user1@example.com"] } + ] } a2 = { combining_function = "OR" - conditions = [{ - regions = ["IT", "FR"], ip_subnetworks = null, - members = null, negate = null, required_access_levels = null - },{ - ip_subnetworks = ["101.101.101.0/24"], members = null, - negate = null, regions = null, required_access_levels = null - }] + conditions = [ + { regions = ["IT", "FR"] }, + { ip_subnetworks = ["101.101.101.0/24"] } + ] } } } @@ -85,12 +80,9 @@ module "test" { access_policy = "12345678" service_perimeters_bridge = { b1 = { - status_resources = ["projects/111110", "projects/111111"] - spec_resources = null - use_explicit_dry_run_spec = false + status_resources = ["projects/111110", "projects/111111"] } b2 = { - status_resources = null spec_resources = ["projects/222220", "projects/222221"] use_explicit_dry_run_spec = true } @@ -107,65 +99,61 @@ module "test" { access_policy = "12345678" access_levels = { a1 = { - combining_function = null - conditions = [{ - members = ["user:user1@example.com"], ip_subnetworks = null, - negate = null, regions = null, required_access_levels = null - }] + conditions = [ + { members = ["user:user1@example.com"] } + ] } a2 = { - combining_function = null - conditions = [{ - members = ["user:user2@example.com"], ip_subnetworks = null, - negate = null, regions = null, required_access_levels = null - }] + conditions = [ + { members = ["user:user2@example.com"] } + ] + } + } + egress_policies = { + # allow writing to external GCS bucket from a specific SA + gcs-sa-foo = { + from = { + identities = [ + "serviceAccount:foo@myproject.iam.gserviceaccount.com" + ] + } + to = { + operations = [{ + method_selectors = ["*"] + service_name = "storage.googleapis.com" + }] + resources = ["projects/123456789"] + } + } + } + ingress_policies = { + # allow management from external automation SA + sa-tf-test = { + from = { + identities = [ + "serviceAccount:test-tf@myproject.iam.gserviceaccount.com", + ], + source_access_levels = ["*"] + } + to = { + operations = [{ service_name = "*" }] + resources = ["*"] + } } } service_perimeters_regular = { r1 = { - spec = null status = { - access_levels = [module.test.access_level_names["a1"], "a2"] + access_levels = ["a1", "a2"] resources = ["projects/11111", "projects/111111"] restricted_services = ["storage.googleapis.com"] - # example: allow writing to external GCS bucket - egress_policies = [ - { - egress_from = { - identity_type = null - identities = [ - "serviceAccount:foo@myproject.iam.gserviceaccount.com" - ] - } - egress_to = { - operations = [{ - method_selectors = ["*"], service_name = "storage.googleapis.com" - }] - resources = ["projects/123456789"] - } - } - ] - # example: allow management from external automation SA - ingress_policies = [ - { - ingress_from = { - identities = [ - "serviceAccount:test-tf@myproject.iam.gserviceaccount.com", - ], - source_access_levels = ["*"], identity_type = null, source_resources = null - } - ingress_to = { - operations = [{ method_selectors = [], service_name = "*" }] - resources = ["*"] - } - } - ] + egress_policies = ["gcs-sa-foo"] + ingress_policies = ["sa-tf-test"] vpc_accessible_services = { allowed_services = ["storage.googleapis.com"] enable_restriction = true } } - use_explicit_dry_run_spec = false } } } @@ -179,17 +167,33 @@ module "test" { ## TODO - [ ] implement support for the `google_access_context_manager_gcp_user_access_binding` resource + + +## Files + +| name | description | resources | +|---|---|---| +| [access-levels.tf](./access-levels.tf) | Access level resources. | google_access_context_manager_access_level | +| [main.tf](./main.tf) | Module-level locals and resources. | google_access_context_manager_access_policy | +| [outputs.tf](./outputs.tf) | Module outputs. | | +| [service-perimeters-bridge.tf](./service-perimeters-bridge.tf) | Bridge service perimeter resources. | google_access_context_manager_service_perimeter | +| [service-perimeters-regular.tf](./service-perimeters-regular.tf) | Regular service perimeter resources. | google_access_context_manager_service_perimeter | +| [variables.tf](./variables.tf) | Module variables. | | +| [versions.tf](./versions.tf) | Version pins. | | + ## Variables | name | description | type | required | default | |---|---|:---:|:---:|:---:| -| [access_policy](variables.tf#L55) | Access Policy name, leave null to use auto-created one. | string | ✓ | | -| [access_levels](variables.tf#L17) | Map of access levels in name => [conditions] format. | map(object({…})) | | {} | -| [access_policy_create](variables.tf#L60) | Access Policy configuration, fill in to create. Parent is in 'organizations/123456' format. | object({…}) | | null | -| [service_perimeters_bridge](variables.tf#L69) | Bridge service perimeters. | map(object({…})) | | {} | -| [service_perimeters_regular](variables.tf#L79) | Regular service perimeters. | map(object({…})) | | {} | +| [access_policy](variables.tf#L56) | Access Policy name, set to null if creating one. | string | ✓ | | +| [access_levels](variables.tf#L17) | Access level definitions. | map(object({…})) | | {} | +| [access_policy_create](variables.tf#L61) | Access Policy configuration, fill in to create. Parent is in 'organizations/123456' format. | object({…}) | | null | +| [egress_policies](variables.tf#L70) | Egress policy definitions that can be referenced in perimeters. | map(object({…})) | | {} | +| [ingress_policies](variables.tf#L99) | Ingress policy definitions that can be referenced in perimeters. | map(object({…})) | | {} | +| [service_perimeters_bridge](variables.tf#L130) | Bridge service perimeters. | map(object({…})) | | {} | +| [service_perimeters_regular](variables.tf#L140) | Regular service perimeters. | map(object({…})) | | {} | ## Outputs diff --git a/modules/vpc-sc/access-levels.tf b/modules/vpc-sc/access-levels.tf index 9aeb232b..1eb85343 100644 --- a/modules/vpc-sc/access-levels.tf +++ b/modules/vpc-sc/access-levels.tf @@ -14,66 +14,66 @@ * limitations under the License. */ -# TODO(ludomagno): add a second variable and resource for custom access levels +# tfdoc:file:description Access level resources. # this code implements "additive" access levels, if "authoritative" # access levels are needed, switch to the # google_access_context_manager_access_levels resource resource "google_access_context_manager_access_level" "basic" { - for_each = var.access_levels == null ? {} : var.access_levels - parent = "accessPolicies/${local.access_policy}" - name = "accessPolicies/${local.access_policy}/accessLevels/${each.key}" - title = each.key + for_each = var.access_levels + parent = "accessPolicies/${local.access_policy}" + name = "accessPolicies/${local.access_policy}/accessLevels/${each.key}" + title = each.key + description = each.value.description + basic { combining_function = each.value.combining_function + dynamic "conditions" { - for_each = toset( - each.value.conditions == null ? [] : each.value.conditions - ) - iterator = condition + for_each = toset(each.value.conditions) + iterator = c content { - # uncomment here and in the variable type to enable - # dynamic "device_policy" { - # for_each = toset( - # condition.key.device_policy == null ? [] : [condition.key.device_policy] - # ) - # iterator = device_policy - # content { - # dynamic "os_constraints" { - # for_each = toset( - # device_policy.key.os_constraints == null ? [] : device_policy.key.os_constraints - # ) - # iterator = os_constraint - # content { - # minimum_version = os_constraint.key.minimum_version - # os_type = os_constraint.key.os_type - # require_verified_chrome_os = os_constraint.key.require_verified_chrome_os - # } - # } - # allowed_encryption_statuses = device_policy.key.allowed_encryption_statuses - # allowed_device_management_levels = device_policy.key.allowed_device_management_levels - # require_admin_approval = device_policy.key.require_admin_approval - # require_corp_owned = device_policy.key.require_corp_owned - # require_screen_lock = device_policy.key.require_screen_lock - # } - # } - ip_subnetworks = ( - condition.key.ip_subnetworks == null ? [] : condition.key.ip_subnetworks - ) - members = ( - condition.key.members == null ? [] : condition.key.members - ) - negate = condition.key.negate - regions = ( - condition.key.regions == null ? [] : condition.key.regions - ) - required_access_levels = ( - condition.key.required_access_levels == null - ? [] - : condition.key.required_access_levels - ) + ip_subnetworks = c.value.ip_subnetworks + members = c.value.members + negate = c.value.negate + regions = c.value.regions + required_access_levels = coalesce(c.value.required_access_levels, []) + + dynamic "device_policy" { + for_each = c.value.device_policy == null ? [] : [c.value.device_policy] + iterator = dp + content { + + allowed_device_management_levels = ( + dp.value.allowed_device_management_levels + ) + allowed_encryption_statuses = ( + dp.value.allowed_encryption_statuses + ) + require_admin_approval = dp.value.key.require_admin_approval + require_corp_owned = dp.value.require_corp_owned + require_screen_lock = dp.value.require_screen_lock + + dynamic "os_constraints" { + for_each = toset( + dp.value.os_constraints == null + ? [] + : dp.value.os_constraints + ) + iterator = oc + content { + minimum_version = oc.value.minimum_version + os_type = oc.value.os_type + require_verified_chrome_os = oc.value.require_verified_chrome_os + } + } + + } + } + } } + } } diff --git a/modules/vpc-sc/service-perimeters-bridge.tf b/modules/vpc-sc/service-perimeters-bridge.tf index f50d6d57..e3233082 100644 --- a/modules/vpc-sc/service-perimeters-bridge.tf +++ b/modules/vpc-sc/service-perimeters-bridge.tf @@ -14,6 +14,8 @@ * limitations under the License. */ +# tfdoc:file:description Bridge service perimeter resources. + # this code implements "additive" service perimeters, if "authoritative" # service perimeters are needed, switch to the # google_access_context_manager_service_perimeters resource diff --git a/modules/vpc-sc/service-perimeters-regular.tf b/modules/vpc-sc/service-perimeters-regular.tf index a834ce75..5ef41c32 100644 --- a/modules/vpc-sc/service-perimeters-regular.tf +++ b/modules/vpc-sc/service-perimeters-regular.tf @@ -14,6 +14,8 @@ * limitations under the License. */ +# tfdoc:file:description Regular service perimeter resources. + # this code implements "additive" service perimeters, if "authoritative" # service perimeters are needed, switch to the # google_access_context_manager_service_perimeters resource @@ -26,7 +28,7 @@ resource "google_access_context_manager_service_perimeter" "regular" { perimeter_type = "PERIMETER_TYPE_REGULAR" use_explicit_dry_run_spec = each.value.use_explicit_dry_run_spec dynamic "spec" { - for_each = each.value.spec == null ? {} : { 1 = 1 } + for_each = each.value.spec == null ? [] : [""] content { access_levels = ( each.value.spec.access_levels == null ? null : [ @@ -36,43 +38,33 @@ resource "google_access_context_manager_service_perimeter" "regular" { ) resources = each.value.spec.resources restricted_services = each.value.spec.restricted_services - # begin egress_policies + dynamic "egress_policies" { - for_each = toset( - each.value.spec.egress_policies == null - ? [] - : each.value.spec.egress_policies - ) + for_each = each.value.spec.egress_policies == null ? {} : { + for k in each.value.spec.egress_policies : + k => lookup(var.egress_policies, k, null) + if contains(keys(var.egress_policies), k) + } iterator = policy content { - # begin egress_from dynamic "egress_from" { - for_each = policy.key.egress_from == null ? {} : { 1 = 1 } + for_each = policy.value.from == null ? [] : [""] content { - identity_type = policy.key.egress_from.identity_type - identities = policy.key.egress_from.identities + identity_type = policy.value.from.identity_type + identities = policy.value.from.identities } } - # end egress_from - # begin egress_to dynamic "egress_to" { - for_each = policy.key.egress_to == null ? {} : { 1 = 1 } + for_each = policy.value.to == null ? [] : [""] content { - resources = policy.key.egress_to.resources + resources = policy.value.to.resources dynamic "operations" { - for_each = toset( - policy.key.egress_to.operations == null - ? [] - : policy.key.egress_to.operations - ) + for_each = toset(policy.value.to.operations) + iterator = o content { - service_name = operations.key.service_name + service_name = o.value.service_name dynamic "method_selectors" { - for_each = toset( - operations.key.method_selectors == null - ? [] - : operations.key.method_selectors - ) + for_each = toset(coalesce(o.value.method_selectors, [])) content { method = method_selectors.key } @@ -81,82 +73,61 @@ resource "google_access_context_manager_service_perimeter" "regular" { } } } - # end egress_to } } - # end egress_policies - # begin ingress_policies + dynamic "ingress_policies" { - for_each = toset( - each.value.spec.ingress_policies == null - ? [] - : each.value.spec.ingress_policies - ) + for_each = each.value.spec.ingress_policies == null ? {} : { + for k in each.value.spec.ingress_policies : + k => lookup(var.ingress_policies, k, null) + if contains(keys(var.ingress_policies), k) + } iterator = policy content { - # begin ingress_from dynamic "ingress_from" { - for_each = policy.key.ingress_from == null ? {} : { 1 = 1 } + for_each = policy.value.from == null ? [] : [""] content { - identity_type = policy.key.ingress_from.identity_type - identities = policy.key.ingress_from.identities - # begin sources + identity_type = policy.value.from.identity_type + identities = policy.value.from.identities dynamic "sources" { - for_each = toset( - policy.key.ingress_from.source_access_levels == null - ? [] - : policy.key.ingress_from.source_access_levels - ) + for_each = toset(policy.value.from.access_levels) + iterator = s content { - access_level = sources.key + access_level = try( + google_access_context_manager_access_level.basic[s.value].id, s.value + ) } } dynamic "sources" { - for_each = toset( - policy.key.ingress_from.source_resources == null - ? [] - : policy.key.ingress_from.source_resources - ) + for_each = toset(policy.value.from.resources) content { resource = sources.key } } - # end sources } } - # end ingress_from - # begin ingress_to dynamic "ingress_to" { - for_each = policy.key.ingress_to == null ? {} : { 1 = 1 } + for_each = policy.value.to == null ? [] : [""] content { - resources = policy.key.ingress_to.resources + resources = policy.value.to.resources dynamic "operations" { - for_each = toset( - policy.key.ingress_to.operations == null - ? [] - : policy.key.ingress_to.operations - ) + for_each = toset(policy.value.to.operations) + iterator = o content { - service_name = operations.key.service_name + service_name = o.value.service_name dynamic "method_selectors" { - for_each = toset( - operations.key.method_selectors == null - ? [] - : operations.key.method_selectors - ) + for_each = toset(coalesce(o.value.method_selectors, [])) content { - method = method_selectors.key + method = method_selectors.value } } } } } } - # end ingress_to } } - # end ingress_policies - # begin vpc_accessible_services + dynamic "vpc_accessible_services" { for_each = each.value.spec.vpc_accessible_services == null ? {} : { 1 = 1 } content { @@ -164,7 +135,7 @@ resource "google_access_context_manager_service_perimeter" "regular" { enable_restriction = each.value.spec.vpc_accessible_services.enable_restriction } } - # end vpc_accessible_services + } } dynamic "status" { @@ -178,43 +149,33 @@ resource "google_access_context_manager_service_perimeter" "regular" { ) resources = each.value.status.resources restricted_services = each.value.status.restricted_services - # begin egress_policies + dynamic "egress_policies" { - for_each = toset( - each.value.status.egress_policies == null - ? [] - : each.value.status.egress_policies - ) + for_each = each.value.spec.egress_policies == null ? {} : { + for k in each.value.spec.egress_policies : + k => lookup(var.egress_policies, k, null) + if contains(keys(var.egress_policies), k) + } iterator = policy content { - # begin egress_from dynamic "egress_from" { - for_each = policy.key.egress_from == null ? {} : { 1 = 1 } + for_each = policy.value.from == null ? [] : [""] content { - identity_type = policy.key.egress_from.identity_type - identities = policy.key.egress_from.identities + identity_type = policy.value.from.identity_type + identities = policy.value.from.identities } } - # end egress_from - # begin egress_to dynamic "egress_to" { - for_each = policy.key.egress_to == null ? {} : { 1 = 1 } + for_each = policy.value.to == null ? [] : [""] content { - resources = policy.key.egress_to.resources + resources = policy.value.to.resources dynamic "operations" { - for_each = toset( - policy.key.egress_to.operations == null - ? [] - : policy.key.egress_to.operations - ) + for_each = toset(policy.value.to.operations) + iterator = o content { - service_name = operations.key.service_name + service_name = o.value.service_name dynamic "method_selectors" { - for_each = toset( - operations.key.method_selectors == null - ? [] - : operations.key.method_selectors - ) + for_each = toset(coalesce(o.value.method_selectors, [])) content { method = method_selectors.key } @@ -223,82 +184,61 @@ resource "google_access_context_manager_service_perimeter" "regular" { } } } - # end egress_to } } - # end egress_policies - # begin ingress_policies + dynamic "ingress_policies" { - for_each = toset( - each.value.status.ingress_policies == null - ? [] - : each.value.status.ingress_policies - ) + for_each = each.value.spec.ingress_policies == null ? {} : { + for k in each.value.spec.ingress_policies : + k => lookup(var.ingress_policies, k, null) + if contains(keys(var.ingress_policies), k) + } iterator = policy content { - # begin ingress_from dynamic "ingress_from" { - for_each = policy.key.ingress_from == null ? {} : { 1 = 1 } + for_each = policy.value.from == null ? [] : [""] content { - identity_type = policy.key.ingress_from.identity_type - identities = policy.key.ingress_from.identities - # begin sources + identity_type = policy.value.from.identity_type + identities = policy.value.from.identities dynamic "sources" { - for_each = toset( - policy.key.ingress_from.source_access_levels == null - ? [] - : policy.key.ingress_from.source_access_levels - ) + for_each = toset(policy.value.from.access_levels) + iterator = s content { - access_level = sources.key + access_level = try( + google_access_context_manager_access_level.basic[s.value].id, s.value + ) } } dynamic "sources" { - for_each = toset( - policy.key.ingress_from.source_resources == null - ? [] - : policy.key.ingress_from.source_resources - ) + for_each = toset(policy.value.from.resources) content { resource = sources.key } } - # end sources } } - # end ingress_from - # begin ingress_to dynamic "ingress_to" { - for_each = policy.key.ingress_to == null ? {} : { 1 = 1 } + for_each = policy.value.to == null ? [] : [""] content { - resources = policy.key.ingress_to.resources + resources = policy.value.to.resources dynamic "operations" { - for_each = toset( - policy.key.ingress_to.operations == null - ? [] - : policy.key.ingress_to.operations - ) + for_each = toset(policy.value.to.operations) + iterator = o content { - service_name = operations.key.service_name + service_name = o.value.service_name dynamic "method_selectors" { - for_each = toset( - operations.key.method_selectors == null - ? [] - : operations.key.method_selectors - ) + for_each = toset(coalesce(o.value.method_selectors, [])) content { - method = method_selectors.key + method = method_selectors.value } } } } } } - # end ingress_to } } - # end ingress_policies - # begin vpc_accessible_services + dynamic "vpc_accessible_services" { for_each = each.value.status.vpc_accessible_services == null ? {} : { 1 = 1 } content { @@ -306,7 +246,7 @@ resource "google_access_context_manager_service_perimeter" "regular" { enable_restriction = each.value.status.vpc_accessible_services.enable_restriction } } - # end vpc_accessible_services + } } # lifecycle { diff --git a/modules/vpc-sc/variables.tf b/modules/vpc-sc/variables.tf index e7318de7..1be23ae3 100644 --- a/modules/vpc-sc/variables.tf +++ b/modules/vpc-sc/variables.tf @@ -15,31 +15,32 @@ */ variable "access_levels" { - description = "Map of access levels in name => [conditions] format." + description = "Access level definitions." type = map(object({ - combining_function = string - conditions = list(object({ - # disabled to reduce var surface, uncomment here and in resource to enable - # device_policy = object({ - # require_screen_lock = bool - # allowed_encryption_statuses = list(string) - # allowed_device_management_levels = list(string) - # os_constraints = list(object({ - # minimum_version = string - # os_type = string - # require_verified_chrome_os = bool - # })) - # require_admin_approval = bool - # require_corp_owned = bool - # }) - ip_subnetworks = list(string) - members = list(string) - negate = bool - regions = list(string) - required_access_levels = list(string) - })) + combining_function = optional(string) + conditions = optional(list(object({ + device_policy = optional(object({ + allowed_device_management_levels = optional(list(string)) + allowed_encryption_statuses = optional(list(string)) + require_admin_approval = bool + require_corp_owned = bool + require_screen_lock = optional(bool) + os_constraints = optional(list(object({ + os_type = string + minimum_version = optional(string) + require_verified_chrome_os = optional(bool) + }))) + })) + ip_subnetworks = optional(list(string), []) + members = optional(list(string), []) + negate = optional(bool) + regions = optional(list(string), []) + required_access_levels = optional(list(string), []) + })), []) + description = optional(string) })) - default = {} + default = {} + nullable = false validation { condition = alltrue([ for k, v in var.access_levels : ( @@ -53,7 +54,7 @@ variable "access_levels" { } variable "access_policy" { - description = "Access Policy name, leave null to use auto-created one." + description = "Access Policy name, set to null if creating one." type = string } @@ -66,12 +67,72 @@ variable "access_policy_create" { default = null } +variable "egress_policies" { + description = "Egress policy definitions that can be referenced in perimeters." + type = map(object({ + from = object({ + identity_type = optional(string, "ANY_IDENTITY") + identities = optional(list(string)) + }) + to = object({ + operations = optional(list(object({ + method_selectors = optional(list(string)) + service_name = string + })), []) + resources = optional(list(string)) + resource_type_external = optional(bool, false) + }) + })) + default = {} + nullable = false + validation { + condition = alltrue([ + for k, v in var.egress_policies : contains([ + "IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", + "ANY_USER", "ANY_SERVICE_ACCOUNT" + ], v.from.identity_type) + ]) + error_message = "Invalid `from.identity_type` value in eress policy." + } +} + +variable "ingress_policies" { + description = "Ingress policy definitions that can be referenced in perimeters." + type = map(object({ + from = object({ + access_levels = optional(list(string), []) + identity_type = optional(string) + identities = optional(list(string)) + resources = optional(list(string), []) + }) + to = object({ + operations = optional(list(object({ + method_selectors = optional(list(string)) + service_name = string + })), []) + resources = optional(list(string)) + }) + })) + default = {} + nullable = false + validation { + condition = alltrue([ + for k, v in var.ingress_policies : + v.from.identity_type == null || contains([ + "IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", + "ANY_USER", "ANY_SERVICE_ACCOUNT" + ], coalesce(v.from.identity_type, "-")) + ]) + error_message = "Invalid `from.identity_type` value in eress policy." + } +} + variable "service_perimeters_bridge" { description = "Bridge service perimeters." type = map(object({ - spec_resources = list(string) - status_resources = list(string) - use_explicit_dry_run_spec = bool + spec_resources = optional(list(string)) + status_resources = optional(list(string)) + use_explicit_dry_run_spec = optional(bool, false) })) default = {} } @@ -79,81 +140,30 @@ variable "service_perimeters_bridge" { variable "service_perimeters_regular" { description = "Regular service perimeters." type = map(object({ - spec = object({ - access_levels = list(string) - resources = list(string) - restricted_services = list(string) - egress_policies = list(object({ - egress_from = object({ - identity_type = string - identities = list(string) - }) - egress_to = object({ - operations = list(object({ - method_selectors = list(string) - service_name = string - })) - resources = list(string) - }) - })) - ingress_policies = list(object({ - ingress_from = object({ - identity_type = string - identities = list(string) - source_access_levels = list(string) - source_resources = list(string) - }) - ingress_to = object({ - operations = list(object({ - method_selectors = list(string) - service_name = string - })) - resources = list(string) - }) - })) - vpc_accessible_services = object({ + spec = optional(object({ + access_levels = optional(list(string)) + resources = optional(list(string)) + restricted_services = optional(list(string)) + egress_policies = optional(list(string)) + ingress_policies = optional(list(string)) + vpc_accessible_services = optional(object({ allowed_services = list(string) enable_restriction = bool - }) - }) - status = object({ - access_levels = list(string) - resources = list(string) - restricted_services = list(string) - egress_policies = list(object({ - egress_from = object({ - identity_type = string - identities = list(string) - }) - egress_to = object({ - operations = list(object({ - method_selectors = list(string) - service_name = string - })) - resources = list(string) - }) })) - ingress_policies = list(object({ - ingress_from = object({ - identity_type = string - identities = list(string) - source_access_levels = list(string) - source_resources = list(string) - }) - ingress_to = object({ - operations = list(object({ - method_selectors = list(string) - service_name = string - })) - resources = list(string) - }) - })) - vpc_accessible_services = object({ + }), {}) + status = optional(object({ + access_levels = optional(list(string)) + resources = optional(list(string)) + restricted_services = optional(list(string)) + egress_policies = optional(list(string)) + ingress_policies = optional(list(string)) + vpc_accessible_services = optional(object({ allowed_services = list(string) enable_restriction = bool - }) - }) - use_explicit_dry_run_spec = bool + })) + }), {}) + use_explicit_dry_run_spec = optional(bool, false) })) - default = {} + default = {} + nullable = false } diff --git a/tests/fast/stages/s02_security/fixture/main.tf b/tests/fast/stages/s02_security/fixture/main.tf index 67173eb8..d65805f9 100644 --- a/tests/fast/stages/s02_security/fixture/main.tf +++ b/tests/fast/stages/s02_security/fixture/main.tf @@ -49,68 +49,59 @@ module "stage" { project-factory-dev = "foobar@iam.gserviceaccount.com" project-factory-prod = "foobar@iam.gserviceaccount.com" } + vpc_sc_access_levels = { + onprem = { + conditions = [{ + ip_subnetworks = ["101.101.101.0/24"] + }] + } + } + vpc_sc_egress_policies = { + iac-gcs = { + from = { + identities = [ + "serviceAccount:xxx-prod-resman-security-0@xxx-prod-iac-core-0.iam.gserviceaccount.com" + ] + } + to = { + operations = [{ + method_selectors = ["*"] + service_name = "storage.googleapis.com" + }] + resources = ["projects/123456782"] + } + } + } vpc_sc_ingress_policies = { iac = { - ingress_from = { + from = { identities = [ - "serviceAccount:fast-prod-resman-security-0@fast-prod-iac-core-0.iam.gserviceaccount.com" - ], - source_access_levels = ["*"], identity_type = null, source_resources = null + "serviceAccount:xxx-prod-resman-security-0@xxx-prod-iac-core-0.iam.gserviceaccount.com" + ] + access_levels = ["*"] } - ingress_to = { + to = { operations = [{ method_selectors = [], service_name = "*" }] resources = ["*"] } } } - vpc_sc_perimeter_ingress_policies = { - dev = ["iac"] - landing = null - prod = ["iac"] - } - vpc_sc_perimeter_projects = { - dev = [ - "projects/345678912", # ludo-dev-sec-core-0 - ] - landing = [] - prod = [ - "projects/234567891", # ludo-prod-sec-core-0 - ] - } - - vpc_sc_access_levels = { - all = { - combining_function = null - conditions = [{ - members = [ - "serviceAccount:quota-monitor@foobar.iam.gserviceaccount.com", - ], - ip_subnetworks = null, negate = null, regions = null, - required_access_levels = null - }] + vpc_sc_perimeters = { + dev = { + egress_policies = ["iac-gcs"] + ingress_policies = ["iac"] + resources = ["projects/1111111111"] } - } - - vpc_sc_perimeter_access_levels = { - dev = ["all"] - landing = null - prod = ["all"] - } - - vpc_sc_egress_policies = { - iac-gcs = { - egress_from = { - identity_type = null - identities = [ - "serviceAccount:fast-prod-resman-security-0@fast-prod-iac-core-0.iam.gserviceaccount.com" - ] - } - egress_to = { - operations = [{ - method_selectors = ["*"], service_name = "storage.googleapis.com" - }] - resources = ["projects/123456789"] - } + dev = { + egress_policies = ["iac-gcs"] + ingress_policies = ["iac"] + resources = ["projects/0000000000"] + } + dev = { + access_levels = ["onprem"] + egress_policies = ["iac-gcs"] + ingress_policies = ["iac"] + resources = ["projects/2222222222"] } } } diff --git a/tests/modules/vpc_sc/fixture/main.tf b/tests/modules/vpc_sc/fixture/main.tf index 29cc672b..b6a951e5 100644 --- a/tests/modules/vpc_sc/fixture/main.tf +++ b/tests/modules/vpc_sc/fixture/main.tf @@ -14,133 +14,13 @@ * limitations under the License. */ -variable "access_policy" { - description = "Access Policy name, leave null to use auto-created one." - type = string - default = null -} - -variable "access_policy_create" { - description = "Access Policy configuration, fill in to create. Parent is in 'organizations/123456' format." - type = object({ - parent = string - title = string - }) - default = { - parent = "organizations/123456" - title = "vpcsc-policy" - } -} - module "test" { - source = "../../../../modules/vpc-sc" - access_policy = var.access_policy - access_policy_create = var.access_policy_create - access_levels = { - a1 = { - combining_function = null - conditions = [ - { - device_policy = null - ip_subnetworks = null - members = ["user:ludomagno@google.com"] - negate = null - regions = null - required_access_levels = null - } - ] - } - a2 = { - combining_function = "OR" - conditions = [ - { - device_policy = null - ip_subnetworks = null - members = null - negate = null - regions = ["IT", "FR"] - required_access_levels = null - }, - { - device_policy = null - ip_subnetworks = null - members = null - negate = null - regions = ["US"] - required_access_levels = null - } - ] - } - } - service_perimeters_bridge = { - b1 = { - status_resources = ["projects/111110", "projects/111111"] - spec_resources = null - use_explicit_dry_run_spec = false - } - b2 = { - status_resources = ["projects/111110", "projects/222220"] - spec_resources = ["projects/111110", "projects/222220"] - use_explicit_dry_run_spec = true - } - } - service_perimeters_regular = { - r1 = { - spec = null - status = { - access_levels = [module.test.access_level_names["a1"]] - resources = ["projects/11111", "projects/111111"] - restricted_services = ["storage.googleapis.com"] - egress_policies = null - ingress_policies = null - vpc_accessible_services = { - allowed_services = ["compute.googleapis.com"] - enable_restriction = true - } - } - use_explicit_dry_run_spec = false - } - r2 = { - spec = null - status = { - access_levels = [module.test.access_level_names["a1"], "a2"] - resources = ["projects/222220", "projects/222221"] - restricted_services = ["storage.googleapis.com"] - egress_policies = [ - { - egress_from = { - identity_type = null - identities = ["user:foo@example.com"] - } - egress_to = { - operations = null - resources = ["projects/333330"] - } - } - ] - ingress_policies = [ - { - ingress_from = { - identity_type = null - identities = null - source_access_levels = [module.test.access_level_names["a2"]] - source_resources = ["projects/333330"] - } - ingress_to = { - operations = [{ - method_selectors = null - service_name = "compute.googleapis.com" - }] - resources = ["projects/222220"] - } - } - ] - vpc_accessible_services = { - allowed_services = ["compute.googleapis.com"] - enable_restriction = true - } - } - use_explicit_dry_run_spec = false - } - } + source = "../../../../modules/vpc-sc" + access_policy = var.access_policy + access_policy_create = var.access_policy_create + access_levels = var.access_levels + egress_policies = var.egress_policies + ingress_policies = var.ingress_policies + service_perimeters_bridge = var.service_perimeters_bridge + service_perimeters_regular = var.service_perimeters_regular } diff --git a/tests/modules/vpc_sc/fixture/test.regular.tfvars b/tests/modules/vpc_sc/fixture/test.regular.tfvars new file mode 100644 index 00000000..012e16fb --- /dev/null +++ b/tests/modules/vpc_sc/fixture/test.regular.tfvars @@ -0,0 +1,96 @@ +access_levels = { + a1 = { + combining_function = null + conditions = [ + { + device_policy = null + ip_subnetworks = null + members = ["user:ludomagno@google.com"] + negate = null + regions = null + required_access_levels = null + } + ] + } + a2 = { + combining_function = "OR" + conditions = [ + { + device_policy = null + ip_subnetworks = null + members = null + negate = null + regions = ["IT", "FR"] + required_access_levels = null + }, + { + device_policy = null + ip_subnetworks = null + members = null + negate = null + regions = ["US"] + required_access_levels = null + } + ] + } +} +egress_policies = { + foo = { + from = { + identities = ["user:foo@example.com"] + } + to = { + resources = ["projects/333330"] + } + } +} +ingress_policies = { + foo = { + from = { + source_access_levels = ["a2"] + source_resources = ["projects/333330"] + } + to = { + operations = [{ + service_name = "compute.googleapis.com" + }] + resources = ["projects/222220"] + } + } +} +service_perimeters_bridge = { + b1 = { + status_resources = ["projects/111110", "projects/111111"] + } + b2 = { + status_resources = ["projects/111110", "projects/222220"] + spec_resources = ["projects/111110", "projects/222220"] + use_explicit_dry_run_spec = true + } +} +service_perimeters_regular = { + r1 = { + status = { + access_levels = ["a1"] + resources = ["projects/11111", "projects/111111"] + restricted_services = ["storage.googleapis.com"] + vpc_accessible_services = { + allowed_services = ["compute.googleapis.com"] + enable_restriction = true + } + } + } + r2 = { + status = { + access_levels = ["a1", "a2"] + resources = ["projects/222220", "projects/222221"] + restricted_services = ["storage.googleapis.com"] + egress_policies = ["foo"] + ingress_policies = ["foo"] + vpc_accessible_services = { + allowed_services = ["compute.googleapis.com"] + enable_restriction = true + } + } + } +} diff --git a/tests/modules/vpc_sc/fixture/variables.tf b/tests/modules/vpc_sc/fixture/variables.tf new file mode 100644 index 00000000..1b7457f4 --- /dev/null +++ b/tests/modules/vpc_sc/fixture/variables.tf @@ -0,0 +1,53 @@ +/** + * Copyright 2022 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +variable "access_levels" { + type = any + default = {} + nullable = false +} + +variable "access_policy" { + type = string +} + +variable "access_policy_create" { + type = any + default = null +} + +variable "egress_policies" { + type = any + default = {} + nullable = false +} + +variable "ingress_policies" { + type = any + default = {} + nullable = false +} + +variable "service_perimeters_bridge" { + type = any + default = {} +} + +variable "service_perimeters_regular" { + type = any + default = {} + nullable = false +} diff --git a/tests/modules/vpc_sc/test_plan.py b/tests/modules/vpc_sc/test_plan.py index d8cae72e..e4f108e7 100644 --- a/tests/modules/vpc_sc/test_plan.py +++ b/tests/modules/vpc_sc/test_plan.py @@ -12,13 +12,19 @@ # See the License for the specific language governing permissions and # limitations under the License. +import collections + + def test_create_policy(plan_runner): "Test with auto-created policy." - _, resources = plan_runner() - counts = {} - for r in resources: - n = f'{r["type"]}.{r["name"]}' - counts[n] = counts.get(n, 0) + 1 + access_policy_create = '''{ + parent = "organizations/123456" + title = "vpcsc-policy" + }''' + _, resources = plan_runner(tf_var_file='test.regular.tfvars', + access_policy='null', + access_policy_create=access_policy_create) + counts = collections.Counter(f'{r["type"]}.{r["name"]}' for r in resources) assert counts == { 'google_access_context_manager_access_level.basic': 2, 'google_access_context_manager_access_policy.default': 1, @@ -29,12 +35,9 @@ def test_create_policy(plan_runner): def test_use_policy(plan_runner): "Test with existing policy." - _, resources = plan_runner(access_policy_create="null", + _, resources = plan_runner(tf_var_file='test.regular.tfvars', access_policy="accessPolicies/foobar") - counts = {} - for r in resources: - n = f'{r["type"]}.{r["name"]}' - counts[n] = counts.get(n, 0) + 1 + counts = collections.Counter(f'{r["type"]}.{r["name"]}' for r in resources) assert counts == { 'google_access_context_manager_access_level.basic': 2, 'google_access_context_manager_service_perimeter.bridge': 2,