organization module factory schemas (#2491)

GoogleCloudPlatform · Aug 9, 2024 · 4a61dba · 4a61dba
1 parent 70bd037
commit 4a61dba
Show file tree

Hide file tree

Showing 21 changed files with 251 additions and 36 deletions.
diff --git a/.vscode/settings.json b/.vscode/settings.json
@@ -8,6 +8,15 @@
     }
   ],
   "yaml.schemas": {
+    "modules/organization/schemas/custom-role.schema.json": [
+      "data/**/custom-roles/**/*yaml"
+    ],
+    "modules/organization/schemas/org-policies.schema.json": [
+      "data/**/org-policies/**/*yaml"
+    ],
+    "modules/organization/schemas/org-policy-custom-constraints.schema.json": [
+      "data/**/org-policy-custom-constraints/**/*yaml"
+    ],
     "modules/project-factory/schemas/budget.schema.json": [
       "data/**/budgets/**/*yaml"
     ],
@@ -28,4 +37,4 @@
       "data/**/ingress-policies/**/*yaml"
     ],
   }
-}
+}
diff --git a/fast/stages/0-bootstrap/data/custom-roles/gcve_network_admin.yaml b/fast/stages/0-bootstrap/data/custom-roles/gcve_network_admin.yaml
@@ -12,6 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# yaml-language-server: $schema=../../../../../modules/organization/schemas/custom-role.schema.json
+
 name: gcveNetworkAdmin
 includedPermissions:
   - vmwareengine.networkPeerings.create

diff --git a/fast/stages/0-bootstrap/data/custom-roles/network_firewall_policies_admin.yaml b/fast/stages/0-bootstrap/data/custom-roles/network_firewall_policies_admin.yaml
@@ -12,6 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# yaml-language-server: $schema=../../../../../modules/organization/schemas/custom-role.schema.json
+
 name: networkFirewallPoliciesAdmin
 includedPermissions:
   - compute.networks.setFirewallPolicy

diff --git a/fast/stages/0-bootstrap/data/custom-roles/ngfw_enterprise_admin.yaml b/fast/stages/0-bootstrap/data/custom-roles/ngfw_enterprise_admin.yaml
@@ -12,6 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# yaml-language-server: $schema=../../../../../modules/organization/schemas/custom-role.schema.json
+
 name: ngfwEnterpriseAdmin
 includedPermissions:
   - networksecurity.firewallEndpoints.create

diff --git a/fast/stages/0-bootstrap/data/custom-roles/organization_admin_viewer.yaml b/fast/stages/0-bootstrap/data/custom-roles/organization_admin_viewer.yaml
@@ -12,7 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# yaml-language-server: $schema=../../../../../modules/organization/schemas/custom-role.schema.json
 # this is used by the plan-only admin SA
+
 name: organizationAdminViewer
 includedPermissions:
   - essentialcontacts.contacts.get

diff --git a/fast/stages/0-bootstrap/data/custom-roles/organization_iam_admin.yaml b/fast/stages/0-bootstrap/data/custom-roles/organization_iam_admin.yaml
@@ -12,7 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# yaml-language-server: $schema=../../../../../modules/organization/schemas/custom-role.schema.json
 # this is needed for use in additive IAM bindings, to avoid conflicts
+
 name: organizationIamAdmin
 includedPermissions:
   - resourcemanager.organizations.get

diff --git a/fast/stages/0-bootstrap/data/custom-roles/service_project_network_admin.yaml b/fast/stages/0-bootstrap/data/custom-roles/service_project_network_admin.yaml
@@ -12,6 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# yaml-language-server: $schema=../../../../../modules/organization/schemas/custom-role.schema.json
+
 name: serviceProjectNetworkAdmin
 includedPermissions:
   - compute.globalOperations.get

diff --git a/fast/stages/0-bootstrap/data/custom-roles/storage_viewer.yaml b/fast/stages/0-bootstrap/data/custom-roles/storage_viewer.yaml
@@ -12,7 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# yaml-language-server: $schema=../../../../../modules/organization/schemas/custom-role.schema.json
 # the following permissions are a descoped version of storage.admin
+
 name: storageViewer
 includedPermissions:
   - storage.buckets.get

diff --git a/fast/stages/0-bootstrap/data/custom-roles/tag_viewer.yaml b/fast/stages/0-bootstrap/data/custom-roles/tag_viewer.yaml
@@ -12,7 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# yaml-language-server: $schema=../../../../../modules/organization/schemas/custom-role.schema.json
 # the following permissions are a descoped version of tagAdm
+
 name: tagViewer
 includedPermissions:
   - resourcemanager.tagHolds.list

diff --git a/fast/stages/0-bootstrap/data/custom-roles/tenant_network_admin.yaml b/fast/stages/0-bootstrap/data/custom-roles/tenant_network_admin.yaml
@@ -12,6 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# yaml-language-server: $schema=../../../../../modules/organization/schemas/custom-role.schema.json
+
 name: tenantNetworkAdmin
 includedPermissions:
   - compute.globalOperations.get
diff --git a/fast/stages/0-bootstrap/data/org-policies/compute.yaml b/fast/stages/0-bootstrap/data/org-policies/compute.yaml
@@ -1,10 +1,22 @@
-# skip boilerplate check
+# Copyright 2024 Google LLC
 #
-# sample subset of useful organization policies, edit to suit requirements
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 ---
-# Terraform will be unable to decode this file if it does not contain valid YAML
-# You can retain `---` (start of the document) to indicate an empty document.
+# sample subset of useful organization policies, edit to suit requirements
+# start of document (---) avoids errors if the file only contains comments
+
+# yaml-language-server: $schema=../../../../../modules/organization/schemas/org-policies.schema.json
 
 compute.disableGuestAttributesAccess:
   rules:

diff --git a/fast/stages/0-bootstrap/data/org-policies/gcp.yaml b/fast/stages/0-bootstrap/data/org-policies/gcp.yaml
@@ -13,8 +13,10 @@
 # limitations under the License.
 
 ---
-# Terraform will be unable to decode this file if it does not contain valid YAML
-# You can retain `---` (start of the document) to indicate an empty document.
+# sample subset of useful organization policies, edit to suit requirements
+# start of document (---) avoids errors if the file only contains comments
+
+# yaml-language-server: $schema=../../../../../modules/organization/schemas/org-policies.schema.json
 
 # gcp.resourceLocations:
 #   rules:

diff --git a/fast/stages/0-bootstrap/data/org-policies/iam.yaml b/fast/stages/0-bootstrap/data/org-policies/iam.yaml
@@ -1,10 +1,22 @@
-# skip boilerplate check
+# Copyright 2024 Google LLC
 #
-# sample subset of useful organization policies, edit to suit requirements
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 ---
-# Terraform will be unable to decode this file if it does not contain valid YAML
-# You can retain `---` (start of the document) to indicate an empty document.
+# sample subset of useful organization policies, edit to suit requirements
+# start of document (---) avoids errors if the file only contains comments
+
+# yaml-language-server: $schema=../../../../../modules/organization/schemas/org-policies.schema.json
 
 iam.automaticIamGrantsForDefaultServiceAccounts:
   rules:

diff --git a/fast/stages/0-bootstrap/data/org-policies/serverless.yaml b/fast/stages/0-bootstrap/data/org-policies/serverless.yaml
@@ -1,10 +1,22 @@
-# skip boilerplate check
+# Copyright 2024 Google LLC
 #
-# sample subset of useful organization policies, edit to suit requirements
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 ---
-# Terraform will be unable to decode this file if it does not contain valid YAML
-# You can retain `---` (start of the document) to indicate an empty document.
+# sample subset of useful organization policies, edit to suit requirements
+# start of document (---) avoids errors if the file only contains comments
+
+# yaml-language-server: $schema=../../../../../modules/organization/schemas/org-policies.schema.json
 
 run.allowedIngress:
   rules:

diff --git a/fast/stages/0-bootstrap/data/org-policies/sql.yaml b/fast/stages/0-bootstrap/data/org-policies/sql.yaml
@@ -1,10 +1,22 @@
-# skip boilerplate check
+# Copyright 2024 Google LLC
 #
-# sample subset of useful organization policies, edit to suit requirements
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 ---
-# Terraform will be unable to decode this file if it does not contain valid YAML
-# You can retain `---` (start of the document) to indicate an empty document.
+# sample subset of useful organization policies, edit to suit requirements
+# start of document (---) avoids errors if the file only contains comments
+
+# yaml-language-server: $schema=../../../../../modules/organization/schemas/org-policies.schema.json
 
 sql.restrictAuthorizedNetworks:
   rules:

diff --git a/fast/stages/0-bootstrap/data/org-policies/storage.yaml b/fast/stages/0-bootstrap/data/org-policies/storage.yaml
@@ -1,10 +1,22 @@
-# skip boilerplate check
+# Copyright 2024 Google LLC
 #
-# sample subset of useful organization policies, edit to suit requirements
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 ---
-# Terraform will be unable to decode this file if it does not contain valid YAML
-# You can retain `---` (start of the document) to indicate an empty document.
+# sample subset of useful organization policies, edit to suit requirements
+# start of document (---) avoids errors if the file only contains comments
+
+# yaml-language-server: $schema=../../../../../modules/organization/schemas/org-policies.schema.json
 
 storage.uniformBucketLevelAccess:
   rules:

diff --git a/modules/organization/README.md b/modules/organization/README.md
@@ -190,12 +190,6 @@ module "org" {
 ```
 
 ```yaml
-# tftest-file id=gke path=configs/custom-constraints/gke.yaml
-
----
-# Terraform will be unable to decode this file if it does not contain valid YAML
-# You can retain `---` (start of the document) to indicate an empty document.
-
 custom.gkeEnableLogging:
   resource_types:
   - container.googleapis.com/Cluster
@@ -214,15 +208,11 @@ custom.gkeEnableAutoUpgrade:
   action_type: ALLOW
   display_name: Enable node auto-upgrade
   description: All node pools must have node auto-upgrade enabled.
+
+# tftest-file id=gke path=configs/custom-constraints/gke.yaml
 ```
 
 ```yaml
-# tftest-file id=dataproc path=configs/custom-constraints/dataproc.yaml
-
----
-# Terraform will be unable to decode this file if it does not contain valid YAML
-# You can retain `---` (start of the document) to indicate an empty document.
-
 custom.dataprocNoMoreThan10Workers:
   resource_types:
   - dataproc.googleapis.com/Cluster
@@ -233,6 +223,8 @@ custom.dataprocNoMoreThan10Workers:
   action_type: DENY
   display_name: Total number of worker instances cannot be larger than 10
   description: Cluster cannot have more than 10 workers, including primary and secondary workers.
+
+# tftest-file id=dataproc path=configs/custom-constraints/dataproc.yaml
 ```
 
 ## Hierarchical Firewall Policy Attachments

diff --git a/modules/organization/schemas/custom-role.schema.json b/modules/organization/schemas/custom-role.schema.json
@@ -0,0 +1,18 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Custom Role",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "name": {
+      "type": "string"
+    },
+    "includedPermissions": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "pattern": "^[a-zA-Z-]+\\.[a-zA-Z-]+\\.[a-zA-Z-]+$"
+      }
+    }
+  }
+}
diff --git a/modules/organization/schemas/org-policies.schema.json b/modules/organization/schemas/org-policies.schema.json
@@ -0,0 +1,73 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Organization Policies",
+  "type": "object",
+  "additionalProperties": false,
+  "patternProperties": {
+    "^[a-z-]+\\.[a-zA-Z]+$": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "inherit_from_parent": {
+          "type": "boolean"
+        },
+        "reset": {
+          "type": "boolean"
+        },
+        "rules": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "allow": {
+                "$ref": "#/$defs/allow-deny"
+              },
+              "deny": {
+                "$ref": "#/$defs/allow-deny"
+              },
+              "enforce": {
+                "type": "boolean"
+              },
+              "condition": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                  "description": {
+                    "type": "string"
+                  },
+                  "expression": {
+                    "type": "string"
+                  },
+                  "location": {
+                    "type": "string"
+                  },
+                  "title": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "$defs": {
+    "allow-deny": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "all": {
+          "type": "boolean"
+        },
+        "values": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    }
+  }
+}