Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Widen scope for prod project factory SA to dev #1263

Merged
merged 6 commits into from
Mar 17, 2023
Merged

Widen scope for prod project factory SA to dev #1263

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
9f253c7
restrict storage role on outputs bucket for stage SAs
ludoo Mar 17, 2023
ba7728e
grant prod project factory SA authority over prod and dev org policies
ludoo Mar 17, 2023
5ed9832
network stages delegated grants on dev to prod pf SA
ludoo Mar 17, 2023
bccd281
security grants to prod pf SA on dev
ludoo Mar 17, 2023
3be5ddb
tfdoc
ludoo Mar 17, 2023
b60a998
tests
ludoo Mar 17, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions fast/stages/1-resman/branch-data-platform.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ module "branch-dp-dev-sa" {
])
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand All @@ -106,7 +106,7 @@ module "branch-dp-prod-sa" {
])
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand Down
4 changes: 2 additions & 2 deletions fast/stages/1-resman/branch-gke.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ module "branch-gke-dev-sa" {
)
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand All @@ -112,7 +112,7 @@ module "branch-gke-prod-sa" {
)
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand Down
2 changes: 1 addition & 1 deletion fast/stages/1-resman/branch-networking.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ module "branch-network-sa" {
])
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand Down
35 changes: 23 additions & 12 deletions fast/stages/1-resman/branch-project-factory.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ module "branch-pf-dev-sa" {
])
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand All @@ -48,7 +48,7 @@ module "branch-pf-prod-sa" {
])
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand Down Expand Up @@ -80,21 +80,32 @@ module "branch-pf-prod-gcs" {
}
}

resource "google_organization_iam_member" "org_policy_admin_pf" {
for_each = !var.fast_features.project_factory ? {} : {
pf-dev = ["teams", "development", module.branch-pf-dev-sa.0.iam_email]
pf-prod = ["teams", "production", module.branch-pf-prod-sa.0.iam_email]
}
resource "google_organization_iam_member" "org_policy_admin_pf_dev" {
count = var.fast_features.project_factory ? 1 : 0
org_id = var.organization.id
role = "roles/orgpolicy.policyAdmin"
member = each.value.2
member = module.branch-pf-dev-sa.0.iam_email
condition {
title = "org_policy_tag_pf_scoped"
description = "Org policy tag scoped grant for ${each.value.0}/${each.value.1}."
title = "org_policy_tag_pf_scoped_dev"
description = "Org policy tag scoped grant for project factory dev."
expression = <<-END
resource.matchTag('${var.organization.id}/${var.tag_names.context}', '${each.value.0}')
resource.matchTag('${var.organization.id}/${var.tag_names.context}', 'teams')
&&
resource.matchTag('${var.organization.id}/${var.tag_names.environment}', '${each.value.1}')
resource.matchTag('${var.organization.id}/${var.tag_names.environment}', 'development')
END
}
}

resource "google_organization_iam_member" "org_policy_admin_pf_prod" {
count = var.fast_features.project_factory ? 1 : 0
org_id = var.organization.id
role = "roles/orgpolicy.policyAdmin"
member = module.branch-pf-prod-sa.0.iam_email
condition {
title = "org_policy_tag_pf_scoped_prod"
description = "Org policy tag scoped grant for project factory prod."
expression = <<-END
resource.matchTag('${var.organization.id}/${var.tag_names.context}', 'teams')
END
}
}
15 changes: 0 additions & 15 deletions fast/stages/1-resman/branch-sandbox.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,6 @@

# tfdoc:file:description Sandbox stage resources.

moved {
from = module.branch-sandbox-folder
to = module.branch-sandbox-folder.0
}

module "branch-sandbox-folder" {
source = "../../../modules/folder"
count = var.fast_features.sandbox ? 1 : 0
Expand All @@ -43,11 +38,6 @@ module "branch-sandbox-folder" {
}
}

moved {
from = module.branch-sandbox-gcs
to = module.branch-sandbox-gcs.0
}

module "branch-sandbox-gcs" {
source = "../../../modules/gcs"
count = var.fast_features.sandbox ? 1 : 0
Expand All @@ -62,11 +52,6 @@ module "branch-sandbox-gcs" {
}
}

moved {
from = module.branch-sandbox-sa
to = module.branch-sandbox-sa.0
}

module "branch-sandbox-sa" {
source = "../../../modules/iam-service-account"
count = var.fast_features.sandbox ? 1 : 0
Expand Down
2 changes: 1 addition & 1 deletion fast/stages/1-resman/branch-security.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ module "branch-security-sa" {
])
}
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand Down
2 changes: 1 addition & 1 deletion fast/stages/1-resman/branch-teams.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ module "branch-teams-sa" {
display_name = "Terraform resman teams service account."
prefix = var.prefix
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
}
}

Expand Down
2 changes: 2 additions & 0 deletions fast/stages/2-networking-a-peering/spoke-dev.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ module "dev-spoke-project" {
"roles/dns.admin" = compact([
try(local.service_accounts.gke-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
])
}
}
Expand Down Expand Up @@ -97,6 +98,7 @@ resource "google_project_iam_binding" "dev_spoke_project_iam_delegated" {
members = compact([
try(local.service_accounts.data-platform-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
try(local.service_accounts.gke-dev, null),
])
condition {
Expand Down
2 changes: 2 additions & 0 deletions fast/stages/2-networking-b-vpn/spoke-dev.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ module "dev-spoke-project" {
"roles/dns.admin" = compact([
try(local.service_accounts.gke-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
])
}
}
Expand Down Expand Up @@ -97,6 +98,7 @@ resource "google_project_iam_binding" "dev_spoke_project_iam_delegated" {
members = compact([
try(local.service_accounts.data-platform-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
try(local.service_accounts.gke-dev, null),
])
condition {
Expand Down
2 changes: 2 additions & 0 deletions fast/stages/2-networking-c-nva/spoke-dev.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ module "dev-spoke-project" {
"roles/dns.admin" = compact([
try(local.service_accounts.gke-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
])
}
}
Expand Down Expand Up @@ -122,6 +123,7 @@ resource "google_project_iam_binding" "dev_spoke_project_iam_delegated" {
members = compact([
try(local.service_accounts.data-platform-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
try(local.service_accounts.gke-dev, null),
])
condition {
Expand Down
6 changes: 3 additions & 3 deletions fast/stages/2-networking-d-separate-envs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -356,9 +356,9 @@ Regions are defined via the `regions` variable which sets up a mapping between t
| [outputs_location](variables.tf#L96) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | <code>string</code> | | <code>null</code> | |
| [psa_ranges](variables.tf#L113) | IP ranges used for Private Service Access (e.g. CloudSQL). | <code title="object&#40;&#123;&#10; dev &#61; object&#40;&#123;&#10; ranges &#61; map&#40;string&#41;&#10; routes &#61; object&#40;&#123;&#10; export &#61; bool&#10; import &#61; bool&#10; &#125;&#41;&#10; &#125;&#41;&#10; prod &#61; object&#40;&#123;&#10; ranges &#61; map&#40;string&#41;&#10; routes &#61; object&#40;&#123;&#10; export &#61; bool&#10; import &#61; bool&#10; &#125;&#41;&#10; &#125;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | |
| [regions](variables.tf#L134) | Region definitions. | <code title="object&#40;&#123;&#10; primary &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code title="&#123;&#10; primary &#61; &#34;europe-west1&#34;&#10;&#125;">&#123;&#8230;&#125;</code> | |
| [service_accounts](variables.tf#L144) | Automation service accounts in name => email format. | <code title="object&#40;&#123;&#10; data-platform-dev &#61; string&#10; data-platform-prod &#61; string&#10; project-factory-dev &#61; string&#10; project-factory-prod &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | <code>1-resman</code> |
| [vpn_onprem_dev_primary_config](variables.tf#L156) | VPN gateway configuration for onprem interconnection from dev in the primary region. | <code title="object&#40;&#123;&#10; peer_external_gateways &#61; map&#40;object&#40;&#123;&#10; redundancy_type &#61; string&#10; interfaces &#61; list&#40;string&#41;&#10; &#125;&#41;&#41;&#10; router_config &#61; object&#40;&#123;&#10; create &#61; optional&#40;bool, true&#41;&#10; asn &#61; number&#10; name &#61; optional&#40;string&#41;&#10; keepalive &#61; optional&#40;number&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; tunnels &#61; map&#40;object&#40;&#123;&#10; bgp_peer &#61; object&#40;&#123;&#10; address &#61; string&#10; asn &#61; number&#10; route_priority &#61; optional&#40;number, 1000&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; all_vpc_subnets &#61; bool&#10; all_peer_vpc_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; bgp_session_range &#61; string&#10; ike_version &#61; optional&#40;number, 2&#41;&#10; peer_external_gateway_interface &#61; optional&#40;number&#41;&#10; peer_gateway &#61; optional&#40;string, &#34;default&#34;&#41;&#10; router &#61; optional&#40;string&#41;&#10; shared_secret &#61; optional&#40;string&#41;&#10; vpn_gateway_interface &#61; number&#10; &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | |
| [vpn_onprem_prod_primary_config](variables.tf#L199) | VPN gateway configuration for onprem interconnection from prod in the primary region. | <code title="object&#40;&#123;&#10; peer_external_gateways &#61; map&#40;object&#40;&#123;&#10; redundancy_type &#61; string&#10; interfaces &#61; list&#40;string&#41;&#10; &#125;&#41;&#41;&#10; router_config &#61; object&#40;&#123;&#10; create &#61; optional&#40;bool, true&#41;&#10; asn &#61; number&#10; name &#61; optional&#40;string&#41;&#10; keepalive &#61; optional&#40;number&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; tunnels &#61; map&#40;object&#40;&#123;&#10; bgp_peer &#61; object&#40;&#123;&#10; address &#61; string&#10; asn &#61; number&#10; route_priority &#61; optional&#40;number, 1000&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; all_vpc_subnets &#61; bool&#10; all_peer_vpc_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; bgp_session_range &#61; string&#10; ike_version &#61; optional&#40;number, 2&#41;&#10; peer_external_gateway_interface &#61; optional&#40;number&#41;&#10; peer_gateway &#61; optional&#40;string, &#34;default&#34;&#41;&#10; router &#61; optional&#40;string&#41;&#10; shared_secret &#61; optional&#40;string&#41;&#10; vpn_gateway_interface &#61; number&#10; &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | |
| [service_accounts](variables.tf#L144) | Automation service accounts in name => email format. | <code title="object&#40;&#123;&#10; data-platform-dev &#61; string&#10; data-platform-prod &#61; string&#10; gke-dev &#61; string&#10; gke-prod &#61; string&#10; project-factory-dev &#61; string&#10; project-factory-prod &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | <code>1-resman</code> |
| [vpn_onprem_dev_primary_config](variables.tf#L158) | VPN gateway configuration for onprem interconnection from dev in the primary region. | <code title="object&#40;&#123;&#10; peer_external_gateways &#61; map&#40;object&#40;&#123;&#10; redundancy_type &#61; string&#10; interfaces &#61; list&#40;string&#41;&#10; &#125;&#41;&#41;&#10; router_config &#61; object&#40;&#123;&#10; create &#61; optional&#40;bool, true&#41;&#10; asn &#61; number&#10; name &#61; optional&#40;string&#41;&#10; keepalive &#61; optional&#40;number&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; tunnels &#61; map&#40;object&#40;&#123;&#10; bgp_peer &#61; object&#40;&#123;&#10; address &#61; string&#10; asn &#61; number&#10; route_priority &#61; optional&#40;number, 1000&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; all_vpc_subnets &#61; bool&#10; all_peer_vpc_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; bgp_session_range &#61; string&#10; ike_version &#61; optional&#40;number, 2&#41;&#10; peer_external_gateway_interface &#61; optional&#40;number&#41;&#10; peer_gateway &#61; optional&#40;string, &#34;default&#34;&#41;&#10; router &#61; optional&#40;string&#41;&#10; shared_secret &#61; optional&#40;string&#41;&#10; vpn_gateway_interface &#61; number&#10; &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | |
| [vpn_onprem_prod_primary_config](variables.tf#L201) | VPN gateway configuration for onprem interconnection from prod in the primary region. | <code title="object&#40;&#123;&#10; peer_external_gateways &#61; map&#40;object&#40;&#123;&#10; redundancy_type &#61; string&#10; interfaces &#61; list&#40;string&#41;&#10; &#125;&#41;&#41;&#10; router_config &#61; object&#40;&#123;&#10; create &#61; optional&#40;bool, true&#41;&#10; asn &#61; number&#10; name &#61; optional&#40;string&#41;&#10; keepalive &#61; optional&#40;number&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; tunnels &#61; map&#40;object&#40;&#123;&#10; bgp_peer &#61; object&#40;&#123;&#10; address &#61; string&#10; asn &#61; number&#10; route_priority &#61; optional&#40;number, 1000&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; all_vpc_subnets &#61; bool&#10; all_peer_vpc_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; bgp_session_range &#61; string&#10; ike_version &#61; optional&#40;number, 2&#41;&#10; peer_external_gateway_interface &#61; optional&#40;number&#41;&#10; peer_gateway &#61; optional&#40;string, &#34;default&#34;&#41;&#10; router &#61; optional&#40;string&#41;&#10; shared_secret &#61; optional&#40;string&#41;&#10; vpn_gateway_interface &#61; number&#10; &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | |

## Outputs

Expand Down
6 changes: 5 additions & 1 deletion fast/stages/2-networking-d-separate-envs/spoke-dev.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,9 @@ module "dev-spoke-project" {
}
iam = {
"roles/dns.admin" = compact([
try(local.service_accounts.project-factory-dev, null)
try(local.service_accounts.gke-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
])
}
}
Expand Down Expand Up @@ -95,7 +97,9 @@ resource "google_project_iam_binding" "dev_spoke_project_iam_delegated" {
role = "roles/resourcemanager.projectIamAdmin"
members = compact([
try(local.service_accounts.data-platform-dev, null),
try(local.service_accounts.gke-dev, null),
try(local.service_accounts.project-factory-dev, null),
try(local.service_accounts.project-factory-prod, null),
])
condition {
title = "dev_stage3_sa_delegated_grants"
Expand Down
2 changes: 2 additions & 0 deletions fast/stages/2-networking-d-separate-envs/spoke-prod.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ module "prod-spoke-project" {
}
iam = {
"roles/dns.admin" = compact([
try(local.service_accounts.gke-prod, null),
try(local.service_accounts.project-factory-prod, null)
])
}
Expand Down Expand Up @@ -95,6 +96,7 @@ resource "google_project_iam_binding" "prod_spoke_project_iam_delegated" {
role = "roles/resourcemanager.projectIamAdmin"
members = compact([
try(local.service_accounts.data-platform-prod, null),
try(local.service_accounts.gke-platform-prod, null),
try(local.service_accounts.project-factory-prod, null),
])
condition {
Expand Down
2 changes: 2 additions & 0 deletions fast/stages/2-networking-d-separate-envs/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,8 @@ variable "service_accounts" {
type = object({
data-platform-dev = string
data-platform-prod = string
gke-dev = string
gke-prod = string
project-factory-dev = string
project-factory-prod = string
})
Expand Down
3 changes: 2 additions & 1 deletion fast/stages/2-security/core-dev.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,9 @@
locals {
dev_kms_restricted_admins = [
for sa in compact([
var.service_accounts.data-platform-dev,
var.service_accounts.project-factory-dev,
var.service_accounts.data-platform-dev
var.service_accounts.project-factory-prod
]) : "serviceAccount:${sa}"
]
}
Expand Down
4 changes: 2 additions & 2 deletions fast/stages/2-security/core-prod.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,8 @@
locals {
prod_kms_restricted_admins = [
for sa in compact([
var.service_accounts.project-factory-prod,
var.service_accounts.data-platform-prod
var.service_accounts.data-platform-prod,
var.service_accounts.project-factory-prod
]) : "serviceAccount:${sa}"
]
}
Expand Down
2 changes: 2 additions & 0 deletions tests/fast/stages/s2_networking_d_separate_envs/common.tfvars
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ folder_ids = {
service_accounts = {
data-platform-dev = "string"
data-platform-prod = "string"
gke-dev = "string"
gke-prod = "string"
project-factory-dev = "string"
project-factory-prod = "string"
}
Expand Down