Merge pull request #1684 from GoogleCloudPlatform/jccb/more-iam

Update resource-level IAM interface for kms and pubsub modules
GoogleCloudPlatform · Sep 17, 2023 · 0c578c0 · 0c578c0
2 parents 1c5aabb + 3618c9e
commit 0c578c0
Show file tree

Hide file tree

Showing 30 changed files with 628 additions and 589 deletions.
diff --git a/blueprints/cloud-operations/asset-inventory-feed-remediation/main.tf b/blueprints/cloud-operations/asset-inventory-feed-remediation/main.tf
@@ -55,10 +55,12 @@ module "vpc" {
 }
 
 module "pubsub" {
-  source        = "../../../modules/pubsub"
-  project_id    = module.project.project_id
-  name          = var.name
-  subscriptions = { "${var.name}-default" = null }
+  source     = "../../../modules/pubsub"
+  project_id = module.project.project_id
+  name       = var.name
+  subscriptions = {
+    "${var.name}-default" = {}
+  }
   iam = {
     "roles/pubsub.publisher" = [
       "serviceAccount:${module.project.service_accounts.robots.cloudasset}"

diff --git a/blueprints/cloud-operations/quota-monitoring/main.tf b/blueprints/cloud-operations/quota-monitoring/main.tf
@@ -39,7 +39,7 @@ module "pubsub" {
   project_id = module.project.project_id
   name       = var.name
   subscriptions = {
-    "${var.name}-default" = null
+    "${var.name}-default" = {}
   }
   # the Cloud Scheduler robot service account already has pubsub.topics.publish
   # at the project level via roles/cloudscheduler.serviceAgent

diff --git a/blueprints/cloud-operations/scheduled-asset-inventory-export-bq/main.tf b/blueprints/cloud-operations/scheduled-asset-inventory-export-bq/main.tf
@@ -63,7 +63,7 @@ module "pubsub" {
   project_id = module.project.project_id
   name       = var.name
   subscriptions = {
-    "${var.name}-default" = null
+    "${var.name}-default" = {}
   }
   # the Cloud Scheduler robot service account already has pubsub.topics.publish
   # at the project level via roles/cloudscheduler.serviceAgent
@@ -74,7 +74,7 @@ module "pubsub_file" {
   project_id = module.project.project_id
   name       = var.name_cffile
   subscriptions = {
-    "${var.name_cffile}-default" = null
+    "${var.name_cffile}-default" = {}
   }
   # the Cloud Scheduler robot service account already has pubsub.topics.publish
   # at the project level via roles/cloudscheduler.serviceAgent

diff --git a/blueprints/data-solutions/cmek-via-centralized-kms/main.tf b/blueprints/data-solutions/cmek-via-centralized-kms/main.tf
@@ -1,4 +1,4 @@
-# Copyright 2022 Google LLC
+# Copyright 2023 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -106,7 +106,10 @@ module "kms" {
     name     = "${var.prefix}-${var.region}",
     location = var.region
   }
-  keys = { key-gce = null, key-gcs = null }
+  keys = {
+    key-gce = {}
+    key-gcs = {}
+  }
 }
 
 ###############################################################################

diff --git a/blueprints/data-solutions/gcs-to-bq-with-least-privileges/kms.tf b/blueprints/data-solutions/gcs-to-bq-with-least-privileges/kms.tf
@@ -1,4 +1,4 @@
-# Copyright 2022 Google LLC
+# Copyright 2023 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -21,26 +21,27 @@ module "kms" {
     location = var.region
   }
   keys = {
-    key-df  = null
-    key-gcs = null
-    key-bq  = null
-  }
-  key_iam = {
+    key-df = {
+      iam = {
+        "roles/cloudkms.cryptoKeyEncrypterDecrypter" = [
+          "serviceAccount:${module.project.service_accounts.robots.dataflow}",
+          "serviceAccount:${module.project.service_accounts.robots.compute}",
+        ]
+      }
+    }
     key-gcs = {
-      "roles/cloudkms.cryptoKeyEncrypterDecrypter" = [
-        "serviceAccount:${module.project.service_accounts.robots.storage}"
-      ]
-    },
+      iam = {
+        "roles/cloudkms.cryptoKeyEncrypterDecrypter" = [
+          "serviceAccount:${module.project.service_accounts.robots.storage}"
+        ]
+      }
+    }
     key-bq = {
-      "roles/cloudkms.cryptoKeyEncrypterDecrypter" = [
-        "serviceAccount:${module.project.service_accounts.robots.bq}"
-      ]
-    },
-    key-df = {
-      "roles/cloudkms.cryptoKeyEncrypterDecrypter" = [
-        "serviceAccount:${module.project.service_accounts.robots.dataflow}",
-        "serviceAccount:${module.project.service_accounts.robots.compute}",
-      ]
+      iam = {
+        "roles/cloudkms.cryptoKeyEncrypterDecrypter" = [
+          "serviceAccount:${module.project.service_accounts.robots.bq}"
+        ]
+      }
     }
   }
 }
diff --git a/blueprints/data-solutions/shielded-folder/README.md b/blueprints/data-solutions/shielded-folder/README.md
diff --git a/blueprints/data-solutions/shielded-folder/kms.tf b/blueprints/data-solutions/shielded-folder/kms.tf
@@ -17,30 +17,32 @@
 # tfdoc:file:description Security project, Cloud KMS and Secret Manager resources.
 
 locals {
+  # list of locations with keys
   kms_locations = distinct(flatten([
     for k, v in var.kms_keys : v.locations
   ]))
+  # map { location -> { key_name -> key_details } }
   kms_locations_keys = {
-    for loc in local.kms_locations : loc => {
-      for k, v in var.kms_keys : k => v if contains(v.locations, loc)
+    for loc in local.kms_locations :
+    loc => {
+      for k, v in var.kms_keys :
+      k => v
+      if contains(v.locations, loc)
     }
   }
   kms_log_locations = distinct(flatten([
     for k, v in local.kms_log_sink_keys : compact(v.locations)
   ]))
   kms_log_sink_keys = {
     "storage" = {
-      labels          = {}
       locations       = [var.log_locations.storage]
       rotation_period = "7776000s"
     }
     "bq" = {
-      labels          = {}
       locations       = [var.log_locations.bq]
       rotation_period = "7776000s"
     }
     "pubsub" = {
-      labels          = {}
       locations       = [var.log_locations.pubsub]
       rotation_period = "7776000s"
     }
@@ -88,12 +90,6 @@ module "sec-kms" {
     location = each.key
     name     = "sec-${each.key}"
   }
-  key_iam = {
-    for k, v in local.kms_locations_keys[each.key] : k => v.iam
-  }
-  key_iam_bindings_additive = {
-    for k, v in local.kms_locations_keys[each.key] : k => v.iam_bindings_additive
-  }
   keys = local.kms_locations_keys[each.key]
 }
 

diff --git a/blueprints/data-solutions/shielded-folder/variables.tf b/blueprints/data-solutions/shielded-folder/variables.tf
@@ -75,11 +75,35 @@ variable "groups" {
 variable "kms_keys" {
   description = "KMS keys to create, keyed by name."
   type = map(object({
-    iam                   = optional(map(list(string)), {})
-    iam_bindings_additive = optional(map(map(any)), {})
-    labels                = optional(map(string), {})
-    locations             = optional(list(string), ["global", "europe", "europe-west1"])
-    rotation_period       = optional(string, "7776000s")
+    labels                        = optional(map(string))
+    locations                     = optional(list(string), ["global", "europe", "europe-west1"])
+    rotation_period               = optional(string, "7776000s")
+    purpose                       = optional(string, "ENCRYPT_DECRYPT")
+    skip_initial_version_creation = optional(bool, false)
+    version_template = optional(object({
+      algorithm        = string
+      protection_level = optional(string, "SOFTWARE")
+    }))
+
+    iam = optional(map(list(string)), {})
+    iam_bindings = optional(map(object({
+      members = list(string)
+      condition = optional(object({
+        expression  = string
+        title       = string
+        description = optional(string)
+      }))
+    })), {})
+    iam_bindings_additive = optional(map(object({
+      member = string
+      role   = string
+      condition = optional(object({
+        expression  = string
+        title       = string
+        description = optional(string)
+      }))
+    })), {})
+
   }))
   default = {}
 }
@@ -92,12 +116,7 @@ variable "log_locations" {
     logging = optional(string, "global")
     pubsub  = optional(string, "global")
   })
-  default = {
-    bq      = "europe"
-    storage = "europe"
-    logging = "global"
-    pubsub  = null
-  }
+  default  = {}
   nullable = false
 }
 

diff --git a/blueprints/gke/binauthz/main.tf b/blueprints/gke/binauthz/main.tf
@@ -1,5 +1,5 @@
 /**
- * Copyright 2022 Google LLC
+ * Copyright 2023 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -115,20 +115,16 @@ module "kms" {
   project_id     = module.project.project_id
   keyring        = { location = var.region, name = "test-keyring" }
   keyring_create = true
-  keys           = { test-key = null }
-  key_purpose = {
+  keys = {
     test-key = {
       purpose = "ASYMMETRIC_SIGN"
       version_template = {
-        algorithm        = "RSA_SIGN_PKCS1_4096_SHA512"
-        protection_level = null
+        algorithm = "RSA_SIGN_PKCS1_4096_SHA512"
+      }
+      iam = {
+        "roles/cloudkms.publicKeyViewer" = [module.image_cb_sa.iam_email]
+        "roles/cloudkms.signer"          = [module.image_cb_sa.iam_email]
       }
-    }
-  }
-  key_iam = {
-    test-key = {
-      "roles/cloudkms.publicKeyViewer" = [module.image_cb_sa.iam_email]
-      "roles/cloudkms.signer"          = [module.image_cb_sa.iam_email]
     }
   }
 }