Skip to content

Commit

Permalink
Widen scope for prod project factory SA to dev (#1263)
Browse files Browse the repository at this point in the history 
* restrict storage role on outputs bucket for stage SAs

* grant prod project factory SA authority over prod and dev org policies

* network stages delegated grants on dev to prod pf SA

* security grants to prod pf SA on dev

* tfdoc

* tests
  • Loading branch information
@ludoo
ludoo authored Mar 17, 2023
1 parent 367f4b6 commit 5fb17cb
Show file tree
Hide file tree
Showing 17 changed files with 54 additions and 41 deletions.
4 changes: 2 additions & 2 deletions fast/stages/1-resman/branch-data-platform.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ module "branch-dp-dev-sa" {
])
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand All @@ -106,7 +106,7 @@ module "branch-dp-prod-sa" {
])
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand Down
4 changes: 2 additions & 2 deletions fast/stages/1-resman/branch-gke.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ module "branch-gke-dev-sa" {
)
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand All @@ -112,7 +112,7 @@ module "branch-gke-prod-sa" {
)
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand Down
2 changes: 1 addition & 1 deletion fast/stages/1-resman/branch-networking.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ module "branch-network-sa" {
])
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand Down
35 changes: 23 additions & 12 deletions fast/stages/1-resman/branch-project-factory.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ module "branch-pf-dev-sa" {
])
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand All @@ -48,7 +48,7 @@ module "branch-pf-prod-sa" {
])
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand Down Expand Up @@ -80,21 +80,32 @@ module "branch-pf-prod-gcs" {
}
}

resource "google_organization_iam_member" "org_policy_admin_pf" {
for_each = !var.fast_features.project_factory ? {} : {
pf-dev = ["teams", "development", module.branch-pf-dev-sa.0.iam_email]
pf-prod = ["teams", "production", module.branch-pf-prod-sa.0.iam_email]
}
resource "google_organization_iam_member" "org_policy_admin_pf_dev" {
count = var.fast_features.project_factory ? 1 : 0
org_id = var.organization.id
role = "roles/orgpolicy.policyAdmin"
member = each.value.2
member = module.branch-pf-dev-sa.0.iam_email
condition {
title = "org_policy_tag_pf_scoped"
description = "Org policy tag scoped grant for ${each.value.0}/${each.value.1}."
title = "org_policy_tag_pf_scoped_dev"
description = "Org policy tag scoped grant for project factory dev."
expression = <<-END
resource.matchTag('${var.organization.id}/${var.tag_names.context}', '${each.value.0}')
resource.matchTag('${var.organization.id}/${var.tag_names.context}', 'teams')
&&
resource.matchTag('${var.organization.id}/${var.tag_names.environment}', '${each.value.1}')
resource.matchTag('${var.organization.id}/${var.tag_names.environment}', 'development')
END
}
}

resource "google_organization_iam_member" "org_policy_admin_pf_prod" {
count = var.fast_features.project_factory ? 1 : 0
org_id = var.organization.id
role = "roles/orgpolicy.policyAdmin"
member = module.branch-pf-prod-sa.0.iam_email
condition {
title = "org_policy_tag_pf_scoped_prod"
description = "Org policy tag scoped grant for project factory prod."
expression = <<-END
resource.matchTag('${var.organization.id}/${var.tag_names.context}', 'teams')
END
}
}
15 changes: 0 additions & 15 deletions fast/stages/1-resman/branch-sandbox.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,6 @@

# tfdoc:file:description Sandbox stage resources.

moved {
from = module.branch-sandbox-folder
to = module.branch-sandbox-folder.0
}

module "branch-sandbox-folder" {
source = "../../../modules/folder"
count = var.fast_features.sandbox ? 1 : 0
Expand All @@ -43,11 +38,6 @@ module "branch-sandbox-folder" {
}
}

moved {
from = module.branch-sandbox-gcs
to = module.branch-sandbox-gcs.0
}

module "branch-sandbox-gcs" {
source = "../../../modules/gcs"
count = var.fast_features.sandbox ? 1 : 0
Expand All @@ -62,11 +52,6 @@ module "branch-sandbox-gcs" {
}
}

moved {
from = module.branch-sandbox-sa
to = module.branch-sandbox-sa.0
}

module "branch-sandbox-sa" {
source = "../../../modules/iam-service-account"
count = var.fast_features.sandbox ? 1 : 0
Expand Down
2 changes: 1 addition & 1 deletion fast/stages/1-resman/branch-security.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ module "branch-security-sa" {
])
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand Down
2 changes: 1 addition & 1 deletion fast/stages/1-resman/branch-teams.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ module "branch-teams-sa" {
display_name = "Terraform resman teams service account."
prefix = var.prefix
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand Down
2 changes: 2 additions & 0 deletions fast/stages/2-networking-a-peering/spoke-dev.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ module "dev-spoke-project" {
"roles/dns.admin" = compact([
try(local.service_accounts.gke-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
])
}
}
Expand Down Expand Up @@ -97,6 +98,7 @@ resource "google_project_iam_binding" "dev_spoke_project_iam_delegated" {
members = compact([
try(local.service_accounts.data-platform-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
try(local.service_accounts.gke-dev, null),
])
condition {
Expand Down
2 changes: 2 additions & 0 deletions fast/stages/2-networking-b-vpn/spoke-dev.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ module "dev-spoke-project" {
"roles/dns.admin" = compact([
try(local.service_accounts.gke-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
])
}
}
Expand Down Expand Up @@ -97,6 +98,7 @@ resource "google_project_iam_binding" "dev_spoke_project_iam_delegated" {
members = compact([
try(local.service_accounts.data-platform-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
try(local.service_accounts.gke-dev, null),
])
condition {
Expand Down
2 changes: 2 additions & 0 deletions fast/stages/2-networking-c-nva/spoke-dev.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ module "dev-spoke-project" {
"roles/dns.admin" = compact([
try(local.service_accounts.gke-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
])
}
}
Expand Down Expand Up @@ -122,6 +123,7 @@ resource "google_project_iam_binding" "dev_spoke_project_iam_delegated" {
members = compact([
try(local.service_accounts.data-platform-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
try(local.service_accounts.gke-dev, null),
])
condition {
Expand Down
6 changes: 3 additions & 3 deletions fast/stages/2-networking-d-separate-envs/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -356,9 +356,9 @@ Regions are defined via the `regions` variable which sets up a mapping between t
| [outputs_location](variables.tf#L96) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | <code>string</code> | | <code>null</code> | |
| [psa_ranges](variables.tf#L113) | IP ranges used for Private Service Access (e.g. CloudSQL). | <code title="object&#40;&#123;&#10; dev &#61; object&#40;&#123;&#10; ranges &#61; map&#40;string&#41;&#10; routes &#61; object&#40;&#123;&#10; export &#61; bool&#10; import &#61; bool&#10; &#125;&#41;&#10; &#125;&#41;&#10; prod &#61; object&#40;&#123;&#10; ranges &#61; map&#40;string&#41;&#10; routes &#61; object&#40;&#123;&#10; export &#61; bool&#10; import &#61; bool&#10; &#125;&#41;&#10; &#125;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | |
| [regions](variables.tf#L134) | Region definitions. | <code title="object&#40;&#123;&#10; primary &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code title="&#123;&#10; primary &#61; &#34;europe-west1&#34;&#10;&#125;">&#123;&#8230;&#125;</code> | |
| [service_accounts](variables.tf#L144) | Automation service accounts in name => email format. | <code title="object&#40;&#123;&#10; data-platform-dev &#61; string&#10; data-platform-prod &#61; string&#10; project-factory-dev &#61; string&#10; project-factory-prod &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | <code>1-resman</code> |
| [vpn_onprem_dev_primary_config](variables.tf#L156) | VPN gateway configuration for onprem interconnection from dev in the primary region. | <code title="object&#40;&#123;&#10; peer_external_gateways &#61; map&#40;object&#40;&#123;&#10; redundancy_type &#61; string&#10; interfaces &#61; list&#40;string&#41;&#10; &#125;&#41;&#41;&#10; router_config &#61; object&#40;&#123;&#10; create &#61; optional&#40;bool, true&#41;&#10; asn &#61; number&#10; name &#61; optional&#40;string&#41;&#10; keepalive &#61; optional&#40;number&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; tunnels &#61; map&#40;object&#40;&#123;&#10; bgp_peer &#61; object&#40;&#123;&#10; address &#61; string&#10; asn &#61; number&#10; route_priority &#61; optional&#40;number, 1000&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; all_vpc_subnets &#61; bool&#10; all_peer_vpc_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; bgp_session_range &#61; string&#10; ike_version &#61; optional&#40;number, 2&#41;&#10; peer_external_gateway_interface &#61; optional&#40;number&#41;&#10; peer_gateway &#61; optional&#40;string, &#34;default&#34;&#41;&#10; router &#61; optional&#40;string&#41;&#10; shared_secret &#61; optional&#40;string&#41;&#10; vpn_gateway_interface &#61; number&#10; &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | |
| [vpn_onprem_prod_primary_config](variables.tf#L199) | VPN gateway configuration for onprem interconnection from prod in the primary region. | <code title="object&#40;&#123;&#10; peer_external_gateways &#61; map&#40;object&#40;&#123;&#10; redundancy_type &#61; string&#10; interfaces &#61; list&#40;string&#41;&#10; &#125;&#41;&#41;&#10; router_config &#61; object&#40;&#123;&#10; create &#61; optional&#40;bool, true&#41;&#10; asn &#61; number&#10; name &#61; optional&#40;string&#41;&#10; keepalive &#61; optional&#40;number&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; tunnels &#61; map&#40;object&#40;&#123;&#10; bgp_peer &#61; object&#40;&#123;&#10; address &#61; string&#10; asn &#61; number&#10; route_priority &#61; optional&#40;number, 1000&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; all_vpc_subnets &#61; bool&#10; all_peer_vpc_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; bgp_session_range &#61; string&#10; ike_version &#61; optional&#40;number, 2&#41;&#10; peer_external_gateway_interface &#61; optional&#40;number&#41;&#10; peer_gateway &#61; optional&#40;string, &#34;default&#34;&#41;&#10; router &#61; optional&#40;string&#41;&#10; shared_secret &#61; optional&#40;string&#41;&#10; vpn_gateway_interface &#61; number&#10; &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | |
| [service_accounts](variables.tf#L144) | Automation service accounts in name => email format. | <code title="object&#40;&#123;&#10; data-platform-dev &#61; string&#10; data-platform-prod &#61; string&#10; gke-dev &#61; string&#10; gke-prod &#61; string&#10; project-factory-dev &#61; string&#10; project-factory-prod &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | <code>1-resman</code> |
| [vpn_onprem_dev_primary_config](variables.tf#L158) | VPN gateway configuration for onprem interconnection from dev in the primary region. | <code title="object&#40;&#123;&#10; peer_external_gateways &#61; map&#40;object&#40;&#123;&#10; redundancy_type &#61; string&#10; interfaces &#61; list&#40;string&#41;&#10; &#125;&#41;&#41;&#10; router_config &#61; object&#40;&#123;&#10; create &#61; optional&#40;bool, true&#41;&#10; asn &#61; number&#10; name &#61; optional&#40;string&#41;&#10; keepalive &#61; optional&#40;number&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; tunnels &#61; map&#40;object&#40;&#123;&#10; bgp_peer &#61; object&#40;&#123;&#10; address &#61; string&#10; asn &#61; number&#10; route_priority &#61; optional&#40;number, 1000&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; all_vpc_subnets &#61; bool&#10; all_peer_vpc_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; bgp_session_range &#61; string&#10; ike_version &#61; optional&#40;number, 2&#41;&#10; peer_external_gateway_interface &#61; optional&#40;number&#41;&#10; peer_gateway &#61; optional&#40;string, &#34;default&#34;&#41;&#10; router &#61; optional&#40;string&#41;&#10; shared_secret &#61; optional&#40;string&#41;&#10; vpn_gateway_interface &#61; number&#10; &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | |
| [vpn_onprem_prod_primary_config](variables.tf#L201) | VPN gateway configuration for onprem interconnection from prod in the primary region. | <code title="object&#40;&#123;&#10; peer_external_gateways &#61; map&#40;object&#40;&#123;&#10; redundancy_type &#61; string&#10; interfaces &#61; list&#40;string&#41;&#10; &#125;&#41;&#41;&#10; router_config &#61; object&#40;&#123;&#10; create &#61; optional&#40;bool, true&#41;&#10; asn &#61; number&#10; name &#61; optional&#40;string&#41;&#10; keepalive &#61; optional&#40;number&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; tunnels &#61; map&#40;object&#40;&#123;&#10; bgp_peer &#61; object&#40;&#123;&#10; address &#61; string&#10; asn &#61; number&#10; route_priority &#61; optional&#40;number, 1000&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; all_vpc_subnets &#61; bool&#10; all_peer_vpc_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; bgp_session_range &#61; string&#10; ike_version &#61; optional&#40;number, 2&#41;&#10; peer_external_gateway_interface &#61; optional&#40;number&#41;&#10; peer_gateway &#61; optional&#40;string, &#34;default&#34;&#41;&#10; router &#61; optional&#40;string&#41;&#10; shared_secret &#61; optional&#40;string&#41;&#10; vpn_gateway_interface &#61; number&#10; &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | |

## Outputs

Expand Down
6 changes: 5 additions & 1 deletion fast/stages/2-networking-d-separate-envs/spoke-dev.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,9 @@ module "dev-spoke-project" {
}
iam = {
"roles/dns.admin" = compact([
try(local.service_accounts.project-factory-dev, null)
try(local.service_accounts.gke-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
])
}
}
Expand Down Expand Up @@ -95,7 +97,9 @@ resource "google_project_iam_binding" "dev_spoke_project_iam_delegated" {
role = "roles/resourcemanager.projectIamAdmin"
members = compact([
try(local.service_accounts.data-platform-dev, null),
try(local.service_accounts.gke-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
])
condition {
title = "dev_stage3_sa_delegated_grants"
Expand Down
2 changes: 2 additions & 0 deletions fast/stages/2-networking-d-separate-envs/spoke-prod.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ module "prod-spoke-project" {
}
iam = {
"roles/dns.admin" = compact([
try(local.service_accounts.gke-prod, null),
try(local.service_accounts.project-factory-prod, null)
])
}
Expand Down Expand Up @@ -95,6 +96,7 @@ resource "google_project_iam_binding" "prod_spoke_project_iam_delegated" {
role = "roles/resourcemanager.projectIamAdmin"
members = compact([
try(local.service_accounts.data-platform-prod, null),
try(local.service_accounts.gke-platform-prod, null),
try(local.service_accounts.project-factory-prod, null),
])
condition {
Expand Down
2 changes: 2 additions & 0 deletions fast/stages/2-networking-d-separate-envs/variables.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,8 @@ variable "service_accounts" {
type = object({
data-platform-dev = string
data-platform-prod = string
gke-dev = string
gke-prod = string
project-factory-dev = string
project-factory-prod = string
})
Expand Down
3 changes: 2 additions & 1 deletion fast/stages/2-security/core-dev.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,9 @@
locals {
dev_kms_restricted_admins = [
for sa in compact([
var.service_accounts.data-platform-dev,
var.service_accounts.project-factory-dev,
var.service_accounts.data-platform-dev
var.service_accounts.project-factory-prod
]) : "serviceAccount:${sa}"
]
}
Expand Down
4 changes: 2 additions & 2 deletions fast/stages/2-security/core-prod.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,8 @@
locals {
prod_kms_restricted_admins = [
for sa in compact([
var.service_accounts.project-factory-prod,
var.service_accounts.data-platform-prod
var.service_accounts.data-platform-prod,
var.service_accounts.project-factory-prod
]) : "serviceAccount:${sa}"
]
}
Expand Down
2 changes: 2 additions & 0 deletions tests/fast/stages/s2_networking_d_separate_envs/common.tfvars
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ folder_ids = {
service_accounts = {
data-platform-dev = "string"
data-platform-prod = "string"
gke-dev = "string"
gke-prod = "string"
project-factory-dev = "string"
project-factory-prod = "string"
}
Expand Down

0 comments on commit 5fb17cb

Please sign in to comment.