Secret manager e2etests

modules/secret-manager/README.md

@@ -15,15 +15,15 @@ The secret replication policy is automatically managed if no location is set, or
 ```hcl
 module "secret-manager" {
   source     = "./fabric/modules/secret-manager"
-  project_id = "my-project"
+  project_id = var.project_id
   secrets = {
     test-auto = {}
     test-manual = {
-      locations = ["europe-west1", "europe-west4"]
+      locations = [var.region, var.region_1]
     }
   }
 }
-# tftest modules=1 resources=2
+# tftest modules=1 resources=2 inventory=secret.yaml e2e
 ```
 
 ### Secret IAM bindings
@@ -33,23 +33,23 @@ IAM bindings can be set per secret in the same way as for most other modules sup
 ```hcl
 module "secret-manager" {
   source     = "./fabric/modules/secret-manager"
-  project_id = "my-project"
+  project_id = var.project_id
   secrets = {
     test-auto = {}
     test-manual = {
-      locations = ["europe-west1", "europe-west4"]
+      locations = [var.region, var.region_1]
     }
   }
   iam = {
     test-auto = {
-      "roles/secretmanager.secretAccessor" = ["group:[email protected]"]
+      "roles/secretmanager.secretAccessor" = ["group:${var.group_email}"]
     }
     test-manual = {
-      "roles/secretmanager.secretAccessor" = ["group:[email protected]"]
+      "roles/secretmanager.secretAccessor" = ["group:${var.group_email}"]
     }
   }
 }
-# tftest modules=1 resources=4 inventory=iam.yaml
+# tftest modules=1 resources=4 inventory=iam.yaml e2e
 ```
 
 ### Secret versions
@@ -59,11 +59,11 @@ As mentioned above, please be aware that **version data will be stored in state
 ```hcl
 module "secret-manager" {
   source     = "./fabric/modules/secret-manager"
-  project_id = "my-project"
+  project_id = var.project_id
   secrets = {
     test-auto = {}
     test-manual = {
-      locations = ["europe-west1", "europe-west4"]
+      locations = [var.region, var.region_1]
     }
   }
   versions = {
@@ -76,7 +76,7 @@ module "secret-manager" {
     }
   }
 }
-# tftest modules=1 resources=5 inventory=versions.yaml
+# tftest modules=1 resources=5 inventory=versions.yaml e2e
 ```
 
 ### Secret with customer managed encryption key
@@ -86,24 +86,24 @@ CMEK will be used if an encryption key is set in the `keys` field of `secrets` o
 ```hcl
 module "secret-manager" {
   source     = "./fabric/modules/secret-manager"
-  project_id = "my-project"
+  project_id = var.project_id
   secrets = {
     test-auto = {
       keys = {
-        global = "projects/PROJECT_ID/locations/global/keyRings/KEYRING/cryptoKeys/KEY"
+        global = google_kms_crypto_key.key_gl.id
       }
     }
     test-auto-nokeys = {}
     test-manual = {
-      locations = ["europe-west1", "europe-west4"]
+      locations = [var.region, var.region_1]
       keys = {
-        europe-west1 = "projects/PROJECT_ID/locations/europe-west1/keyRings/KEYRING/cryptoKeys/KEY"
-        europe-west4 = "projects/PROJECT_ID/locations/europe-west4/keyRings/KEYRING/cryptoKeys/KEY"
+        "${var.region}"   = "${var.kms_key.id}"
+        "${var.region_1}" = google_kms_crypto_key.key_1.id
       }
     }
   }
 }
-# tftest modules=1 resources=3
+# tftest modules=1 resources=8 fixtures=fixtures/secret.tf inventory=secret-cmek.yaml e2e
 ```
 <!-- BEGIN TFDOC -->
 ## Variables
@@ -125,6 +125,10 @@ module "secret-manager" {
 | [version_ids](outputs.tf#L29) | Version ids keyed by secret name : version name. |  |
 | [version_versions](outputs.tf#L36) | Version versions keyed by secret name : version name. |  |
 | [versions](outputs.tf#L43) | Secret versions. | ✓ |
+
+## Fixtures
+
+- [secret.tf](../../tests/fixtures/secret.tf)
 <!-- END TFDOC -->
 ## Requirements
 

tests/examples/variables.tf

@@ -62,6 +62,10 @@ variable "region" {
   default = "europe-west8"
 }
 
+variable "region_1" {
+  default = "europe-west4"
+}
+
 variable "service_account" {
   default = {
     id        = "service_account_id"
@@ -70,6 +74,13 @@ variable "service_account" {
   }
 }
 
+variable "service_identities" {
+  default = {
+    secret_identity  = "secret_identity_email"
+    storage_identity = "storage_identity_email"
+  }
+}
+
 variable "subnet" {
   default = {
     name      = "subnet_name"

tests/examples_e2e/setup_module/e2e_tests.tfvars.tftpl

@@ -31,6 +31,9 @@ service_account = {
     email     = "${service_account.email}"
     iam_email = "${service_account.iam_email}"
   }
+service_identities = {
+    secret_identity = "${service_identities.secret.email}"
+}
 subnet = {
     name      = "${subnet.name}"
     region    = "${subnet.region}"

tests/examples_e2e/setup_module/main.tf

@@ -15,8 +15,9 @@
 locals {
   prefix = "${var.prefix}-${var.timestamp}${var.suffix}"
   jit_services = [
-    "storage.googleapis.com",  # no permissions granted by default
-    "sqladmin.googleapis.com", # roles/cloudsql.serviceAgent
+    "storage.googleapis.com",       # no permissions granted by default
+    "sqladmin.googleapis.com",      # roles/cloudsql.serviceAgent
+    "secretmanager.googleapis.com", # roles/cloudkms.cryptoKeyEncrypterDecrypter
   ]
   services = [
     # trimmed down list of services, to be extended as needed
@@ -187,10 +188,10 @@ resource "local_file" "terraform_tfvars" {
     billing_account_id = var.billing_account
     folder_id          = google_folder.folder.folder_id
     group_email        = var.group_email
-    kms_key_id         = google_kms_crypto_key.key.id
     keyring = {
       name = google_kms_key_ring.keyring.name
     }
+    kms_key_id      = google_kms_crypto_key.key.id
     organization_id = var.organization_id
     project_id      = google_project.project.project_id
     project_number  = google_project.project.number
@@ -200,6 +201,11 @@ resource "local_file" "terraform_tfvars" {
       email     = google_service_account.service_account.email
       iam_email = "serviceAccount:${google_service_account.service_account.email}"
     }
+    service_identities = {
+      secret = {
+        email = resource.google_project_service_identity.jit_si["secretmanager.googleapis.com"].email
+      }
+    }
     subnet = {
       name          = google_compute_subnetwork.subnetwork.name
       region        = google_compute_subnetwork.subnetwork.region

tests/fixtures/secret.tf

@@ -0,0 +1,45 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+resource "google_project_iam_binding" "bindings" {
+  project = var.project_id
+  role    = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  members = ["serviceAccount:${var.service_identities.secret_identity}"]
+}
+
+resource "google_kms_key_ring" "keyring_1" {
+  name     = "keyring-1"
+  project  = var.project_id
+  location = var.region_1
+}
+
+resource "google_kms_crypto_key" "key_1" {
+  name            = "crypto-key-example-1"
+  key_ring        = google_kms_key_ring.keyring_1.id
+  rotation_period = "100000s"
+  depends_on      = [google_project_iam_binding.bindings]
+}
+
+resource "google_kms_key_ring" "keyring_gl" {
+  name     = "keyring-gl"
+  project  = var.project_id
+  location = "global"
+}
+
+resource "google_kms_crypto_key" "key_gl" {
+  name            = "crypto-key-example-gl"
+  key_ring        = google_kms_key_ring.keyring_gl.id
+  rotation_period = "100000s"
+  depends_on      = [google_project_iam_binding.bindings]
+}

tests/modules/secret_manager/examples/iam.yaml

@@ -14,34 +14,36 @@
 
 values:
   module.secret-manager.google_secret_manager_secret.default["test-auto"]:
-    project: my-project
+    project: project-id
     replication:
     - auto:
       - customer_managed_encryption: []
       user_managed: []
     secret_id: test-auto
   module.secret-manager.google_secret_manager_secret.default["test-manual"]:
-    project: my-project
+    project: project-id
     replication:
     - auto: []
       user_managed:
       - replicas:
         - customer_managed_encryption: []
-          location: europe-west1
+          location: europe-west8
         - customer_managed_encryption: []
           location: europe-west4
     secret_id: test-manual
   module.secret-manager.google_secret_manager_secret_iam_binding.default["test-auto.roles/secretmanager.secretAccessor"]:
     condition: []
     members:
-    - group:auto-readers@example.com
+    - group:organization-admins@example.org
     role: roles/secretmanager.secretAccessor
   module.secret-manager.google_secret_manager_secret_iam_binding.default["test-manual.roles/secretmanager.secretAccessor"]:
     condition: []
     members:
-    - group:manual-readers@example.com
+    - group:organization-admins@example.org
     role: roles/secretmanager.secretAccessor
 
 counts:
   google_secret_manager_secret: 2
   google_secret_manager_secret_iam_binding: 2
+
+outputs: {}

tests/modules/secret_manager/examples/secret-cmek.yaml

@@ -0,0 +1,74 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+values:
+  module.secret-manager.google_secret_manager_secret.default["test-auto"]:
+    annotations: null
+    labels: null
+    project: project-id
+    replication:
+    - auto:
+      - {}
+      user_managed: []
+    rotation: []
+    secret_id: test-auto
+    timeouts: null
+    topics: []
+    ttl: null
+    version_aliases: null
+    version_destroy_ttl: null
+  module.secret-manager.google_secret_manager_secret.default["test-auto-nokeys"]:
+    annotations: null
+    labels: null
+    project: project-id
+    replication:
+    - auto:
+      - customer_managed_encryption: []
+      user_managed: []
+    rotation: []
+    secret_id: test-auto-nokeys
+    timeouts: null
+    topics: []
+    ttl: null
+    version_aliases: null
+    version_destroy_ttl: null
+  module.secret-manager.google_secret_manager_secret.default["test-manual"]:
+    annotations: null
+    labels: null
+    project: project-id
+    replication:
+    - auto: []
+      user_managed:
+      - replicas:
+        - customer_managed_encryption:
+          - kms_key_name: kms_key_self_link
+          location: europe-west8
+        - location: europe-west4
+    rotation: []
+    secret_id: test-manual
+    timeouts: null
+    topics: []
+    ttl: null
+    version_aliases: null
+    version_destroy_ttl: null
+
+counts:
+  google_kms_crypto_key: 2
+  google_kms_key_ring: 2
+  google_project_iam_binding: 1
+  google_secret_manager_secret: 3
+  modules: 1
+  resources: 8
+
+outputs: {}