-
Notifications
You must be signed in to change notification settings - Fork 910
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add views and tags to logging bucket
- Loading branch information
Showing
6 changed files
with
257 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,9 +6,20 @@ Note that some logging buckets are automatically created for a given folder, pro | |
|
|
||
| See also the `logging_sinks` argument within the [project](../project/), [folder](../folder/) and [organization](../organization) modules. | ||
|
|
||
| ## Examples | ||
| ## TOC | ||
|
|
||
| ### Create custom logging bucket in a project | ||
| <!-- BEGIN TOC --> | ||
| - [TOC](#toc) | ||
| - [Custom logging bucket in a project](#custom-logging-bucket-in-a-project) | ||
| - [Custom logging bucket in a project with Log Analytics](#custom-logging-bucket-in-a-project-with-log-analytics) | ||
| - [Change retention period of a folder's _Default bucket](#change-retention-period-of-a-folders-_default-bucket) | ||
| - [Organization and billing account buckets](#organization-and-billing-account-buckets) | ||
| - [Custom bucket with views](#custom-bucket-with-views) | ||
| - [Variables](#variables) | ||
| - [Outputs](#outputs) | ||
| <!-- END TOC --> | ||
|
|
||
| ## Custom logging bucket in a project | ||
|
|
||
| ```hcl | ||
| module "bucket" { | ||
|
|
@@ -20,7 +31,7 @@ module "bucket" { | |
| # tftest modules=1 resources=1 inventory=project.yaml | ||
| ``` | ||
|
|
||
| ### Create custom logging bucket in a project enabling Log Analytics and dataset link | ||
| ## Custom logging bucket in a project with Log Analytics | ||
|
|
||
| ```hcl | ||
| module "bucket" { | ||
|
|
@@ -36,7 +47,7 @@ module "bucket" { | |
| # tftest modules=1 resources=2 inventory=log_analytics.yaml | ||
| ``` | ||
|
|
||
| ### Change retention period of a folder's _Default bucket | ||
| ## Change retention period of a folder's _Default bucket | ||
|
|
||
| ```hcl | ||
| module "folder" { | ||
|
|
@@ -55,7 +66,7 @@ module "bucket-default" { | |
| # tftest modules=2 resources=2 inventory=retention.yaml | ||
| ``` | ||
|
|
||
| ### Organization and billing account buckets | ||
| ## Organization and billing account buckets | ||
|
|
||
| ```hcl | ||
| module "bucket-organization" { | ||
|
|
@@ -73,6 +84,26 @@ module "bucket-billing-account" { | |
| } | ||
| # tftest modules=2 resources=2 inventory=org-ba.yaml | ||
| ``` | ||
|
|
||
| ## Custom bucket with views | ||
|
|
||
| ```hcl | ||
| module "bucket" { | ||
| source = "./fabric/modules/logging-bucket" | ||
| parent_type = "project" | ||
| parent = var.project_id | ||
| id = "mybucket" | ||
| views = { | ||
| myview = { | ||
| filter = "LOG_ID(\"stdout\")" | ||
| iam = { | ||
| "roles/logging.viewAccessor" = ["user:[email protected]"] | ||
| } | ||
| } | ||
| } | ||
| } | ||
| # tftest modules=1 resources=3 inventory=views.yaml | ||
| ``` | ||
| <!-- BEGIN TFDOC --> | ||
| ## Variables | ||
|
|
||
|
|
@@ -86,10 +117,13 @@ module "bucket-billing-account" { | |
| | [location](variables.tf#L34) | Location of the bucket. | <code>string</code> | | <code>"global"</code> | | ||
| | [log_analytics](variables.tf#L40) | Enable and configure Analytics Log. | <code title="object({ enable = optional(bool, false) dataset_link_id = optional(string) description = optional(string, "Log Analytics Dataset") })">object({…})</code> | | <code>{}</code> | | ||
| | [retention](variables.tf#L61) | Retention time in days for the logging bucket. | <code>number</code> | | <code>30</code> | | ||
| | [tag_bindings](variables.tf#L67) | Tag bindings for this bucket, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> | | ||
| | [views](variables.tf#L74) | Log views for this bucket. | <code title="map(object({ filter = string location = optional(string) description = optional(string) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">map(object({…}))</code> | | <code>{}</code> | | ||
|
|
||
| ## Outputs | ||
|
|
||
| | name | description | sensitive | | ||
| |---|---|:---:| | ||
| | [id](outputs.tf#L17) | Fully qualified logging bucket id. | | | ||
| | [view_ids](outputs.tf#L22) | The automatic and user-created views in this bucket. | | | ||
| <!-- END TFDOC --> | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| /** | ||
| * Copyright 2024 Google LLC | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| locals { | ||
| view_iam = flatten([ | ||
| for k, v in var.views : [ | ||
| for role, members in v.iam : { | ||
| view = k | ||
| role = role | ||
| members = members | ||
| } | ||
| ] | ||
| ]) | ||
| view_iam_bindings = merge([ | ||
| for k, v in var.views : { | ||
| for binding_key, data in v.iam_bindings : | ||
| binding_key => { | ||
| view = k | ||
| role = data.role | ||
| members = data.members | ||
| condition = data.condition | ||
| } | ||
| } | ||
| ]...) | ||
| view_iam_bindings_additive = merge([ | ||
| for k, v in var.views : { | ||
| for binding_key, data in v.iam_bindings_additive : | ||
| binding_key => { | ||
| view = k | ||
| role = data.role | ||
| member = data.member | ||
| condition = data.condition | ||
| } | ||
| } | ||
| ]...) | ||
| } | ||
|
|
||
| resource "google_logging_log_view_iam_binding" "authoritative" { | ||
| for_each = { | ||
| for binding in local.view_iam : | ||
| "${binding.view}.${binding.role}" => binding | ||
| } | ||
| role = each.value.role | ||
| members = each.value.members | ||
| parent = google_logging_log_view.views[each.value.view].parent | ||
| location = google_logging_log_view.views[each.value.view].location | ||
| bucket = google_logging_log_view.views[each.value.view].bucket | ||
| name = google_logging_log_view.views[each.value.view].name | ||
| } | ||
|
|
||
| resource "google_logging_log_view_iam_binding" "bindings" { | ||
| for_each = local.view_iam_bindings | ||
| role = each.value.role | ||
| members = each.value.members | ||
| parent = google_logging_log_view.views[each.value.view].parent | ||
| location = google_logging_log_view.views[each.value.view].location | ||
| bucket = google_logging_log_view.views[each.value.view].bucket | ||
| name = google_logging_log_view.views[each.value.view].name | ||
|
|
||
| dynamic "condition" { | ||
| for_each = each.value.condition == null ? [] : [""] | ||
| content { | ||
| expression = each.value.condition.expression | ||
| title = each.value.condition.title | ||
| description = each.value.condition.description | ||
| } | ||
| } | ||
| } | ||
|
|
||
| resource "google_logging_log_view_iam_member" "members" { | ||
| for_each = local.view_iam_bindings_additive | ||
| role = each.value.role | ||
| member = each.value.member | ||
| parent = google_logging_log_view.views[each.value.view].parent | ||
| location = google_logging_log_view.views[each.value.view].location | ||
| bucket = google_logging_log_view.views[each.value.view].bucket | ||
| name = google_logging_log_view.views[each.value.view].name | ||
|
|
||
| dynamic "condition" { | ||
| for_each = each.value.condition == null ? [] : [""] | ||
| content { | ||
| expression = each.value.condition.expression | ||
| title = each.value.condition.title | ||
| description = each.value.condition.description | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| # Copyright 2024 Google LLC | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
|
|
||
| values: | ||
| module.bucket.google_logging_log_view.views["myview"]: | ||
| description: null | ||
| filter: LOG_ID("stdout") | ||
| location: global | ||
| name: myview | ||
| timeouts: null | ||
| module.bucket.google_logging_log_view_iam_binding.authoritative["myview.roles/logging.viewAccessor"]: | ||
| condition: [] | ||
| location: global | ||
| members: | ||
| - user:[email protected] | ||
| name: myview | ||
| role: roles/logging.viewAccessor | ||
| module.bucket.google_logging_project_bucket_config.bucket[0]: | ||
| bucket_id: mybucket | ||
| cmek_settings: [] | ||
| enable_analytics: false | ||
| index_configs: [] | ||
| location: global | ||
| locked: null | ||
| project: project-id | ||
| retention_days: 30 | ||
|
|
||
| counts: | ||
| google_logging_log_view: 1 | ||
| google_logging_log_view_iam_binding: 1 | ||
| google_logging_project_bucket_config: 1 |