Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow manage existing SSM instance #2595

Merged
merged 7 commits into from
Sep 27, 2024
Merged

Allow manage existing SSM instance #2595

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
dd2555d
added option to manage an existing SSM instance
lnesteroff Sep 25, 2024
c8a56e2
switched depends on to try for instance iam
lnesteroff Sep 26, 2024
2dab2bd
added resource instance keys
lnesteroff Sep 26, 2024
34db29e
add instance keys to tests
lnesteroff Sep 26, 2024
0ba8977
changed label default to null
lnesteroff Sep 26, 2024
5f774a2
updated readme
lnesteroff Sep 27, 2024
f88a8f9
replaced try functions with conditional expressions for IAM
lnesteroff Sep 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 9 additions & 15 deletions modules/secure-source-manager-instance/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,9 +41,7 @@ module "ssm_instance" {
location = var.region
kms_key = "projects/another-project-id/locations/${var.region}/keyRings/my-key-ring/cryptoKeys/my-key"
repositories = {
my-repository = {
location = var.region
}
my-repository = {}
}
}
# tftest modules=1 resources=2 inventory=public-instance-with-cmek.yaml
Expand All @@ -59,9 +57,7 @@ module "ssm_instance" {
location = var.region
ca_pool = "projects/another-project/locations/${var.region}/caPools/my-ca-pool"
repositories = {
my-repository = {
location = var.region
}
my-repository = {}
}
}
# tftest modules=1 resources=2 inventory=private-instance.yaml
Expand All @@ -82,7 +78,6 @@ module "ssm_instance" {
}
repositories = {
my-repository = {
location = var.region
iam = {
"roles/securesourcemanager.repoAdmin" = [
"group:[email protected]"
Expand All @@ -109,7 +104,6 @@ module "ssm_instance" {
}
repositories = {
my-repository = {
location = var.region
iam_bindings_additive = {
my-repository-admin = {
role = "roles/securesourcemanager.repoAdmin"
Expand Down Expand Up @@ -138,7 +132,6 @@ module "ssm_instance" {
}
repositories = {
my-repository = {
location = var.region
iam_bindings = {
my-repository-admin = {
role = "roles/securesourcemanager.repoAdmin"
Expand All @@ -157,16 +150,17 @@ module "ssm_instance" {

| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
| [instance_id](variables.tf#L23) | Instance ID. | <code>string</code> | ✓ | |
| [location](variables.tf#L40) | Location. | <code>string</code> | ✓ | |
| [project_id](variables.tf#L45) | Project ID. | <code>string</code> | ✓ | |
| [repositories](variables.tf#L50) | Repositories. | <code title="map&#40;object&#40;&#123;&#10; description &#61; optional&#40;string&#41;&#10; iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10; role &#61; string&#10; members &#61; list&#40;string&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10; role &#61; string&#10; member &#61; string&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10; initial_config &#61; optional&#40;object&#40;&#123;&#10; default_branch &#61; optional&#40;string&#41;&#10; gitignores &#61; optional&#40;string&#41;&#10; license &#61; optional&#40;string&#41;&#10; readme &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; location &#61; string&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | ✓ | |
| [instance_id](variables.tf#L29) | Instance ID. | <code>string</code> | ✓ | |
| [location](variables.tf#L46) | Location. | <code>string</code> | ✓ | |
| [project_id](variables.tf#L51) | Project ID. | <code>string</code> | ✓ | |
| [repositories](variables.tf#L56) | Repositories. | <code title="map&#40;object&#40;&#123;&#10; description &#61; optional&#40;string&#41;&#10; iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10; role &#61; string&#10; members &#61; list&#40;string&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10; role &#61; string&#10; member &#61; string&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10; initial_config &#61; optional&#40;object&#40;&#123;&#10; default_branch &#61; optional&#40;string&#41;&#10; gitignores &#61; optional&#40;string&#41;&#10; license &#61; optional&#40;string&#41;&#10; readme &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | ✓ | |
| [ca_pool](variables.tf#L17) | CA pool. | <code>string</code> | | <code>null</code> |
| [iam](variables-iam.tf#L17) | IAM bindings. | <code>map&#40;list&#40;string&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [iam_bindings](variables-iam.tf#L23) | IAM bindings. | <code title="map&#40;object&#40;&#123;&#10; role &#61; string&#10; members &#61; list&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [iam_bindings_additive](variables-iam.tf#L32) | IAM bindings. | <code title="map&#40;object&#40;&#123;&#10; role &#61; string&#10; member &#61; string&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [kms_key](variables.tf#L28) | KMS key. | <code>string</code> | | <code>null</code> |
| [labels](variables.tf#L34) | Instance labels. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> |
| [instance_create](variables.tf#L23) | Create SSM Instance. When set to false, uses instance_id to reference existing SSM instance. | <code>bool</code> | | <code>true</code> |
| [kms_key](variables.tf#L34) | KMS key. | <code>string</code> | | <code>null</code> |
| [labels](variables.tf#L40) | Instance labels. | <code>map&#40;string&#41;</code> | | <code>null</code> |

## Outputs

Expand Down
20 changes: 11 additions & 9 deletions modules/secure-source-manager-instance/iam.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,29 +33,31 @@ locals {

resource "google_secure_source_manager_instance_iam_binding" "authoritative" {
for_each = var.iam
project = google_secure_source_manager_instance.instance.project
location = google_secure_source_manager_instance.instance.location
instance_id = google_secure_source_manager_instance.instance.instance_id
project = try(google_secure_source_manager_instance.instance[0].project, var.project_id)
location = try(google_secure_source_manager_instance.instance[0].location, var.location)
instance_id = try(google_secure_source_manager_instance.instance[0].instance_id, var.instance_id)
juliocc marked this conversation as resolved.
Show resolved Hide resolved
role = each.key
members = each.value
}

resource "google_secure_source_manager_instance_iam_binding" "bindings" {
for_each = var.iam_bindings
project = google_secure_source_manager_instance.instance.project
location = google_secure_source_manager_instance.instance.location
instance_id = google_secure_source_manager_instance.instance.instance_id
project = try(google_secure_source_manager_instance.instance[0].project, var.project_id)
location = try(google_secure_source_manager_instance.instance[0].location, var.location)
instance_id = try(google_secure_source_manager_instance.instance[0].instance_id, var.instance_id)
role = each.value.role
members = each.value.members
depends_on = [google_secure_source_manager_instance.instance]
}

resource "google_secure_source_manager_instance_iam_member" "bindings" {
for_each = var.iam_bindings_additive
project = google_secure_source_manager_instance.instance.project
location = google_secure_source_manager_instance.instance.location
instance_id = google_secure_source_manager_instance.instance.instance_id
project = try(google_secure_source_manager_instance.instance[0].project, var.project_id)
location = try(google_secure_source_manager_instance.instance[0].location, var.location)
instance_id = try(google_secure_source_manager_instance.instance[0].instance_id, var.instance_id)
role = each.value.role
member = each.value.member
depends_on = [google_secure_source_manager_instance.instance]
}

resource "google_secure_source_manager_repository_iam_binding" "authoritative" {
Expand Down
6 changes: 4 additions & 2 deletions modules/secure-source-manager-instance/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
*/

resource "google_secure_source_manager_instance" "instance" {
count = var.instance_create ? 1 : 0
instance_id = var.instance_id
project = var.project_id
location = var.location
Expand All @@ -32,9 +33,10 @@ resource "google_secure_source_manager_instance" "instance" {
resource "google_secure_source_manager_repository" "repositories" {
for_each = var.repositories
repository_id = each.key
instance = google_secure_source_manager_instance.instance.name
instance = try(google_secure_source_manager_instance.instance[0].name, "projects/${var.project_id}/locations/${var.location}/instances/${var.instance_id}")
project = var.project_id
location = each.value.location
location = var.location
description = each.value.description
dynamic "initial_config" {
for_each = each.value.initial_config == null ? [] : [""]
content {
Expand Down
4 changes: 2 additions & 2 deletions modules/secure-source-manager-instance/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,12 @@

output "instance" {
description = "Instance."
value = google_secure_source_manager_instance.instance
value = try(google_secure_source_manager_instance.instance[0], null)
}

output "instance_id" {
description = "Instance id."
value = google_secure_source_manager_instance.instance.id
value = try(google_secure_source_manager_instance.instance[0].id, null)
}

output "repositories" {
Expand Down
9 changes: 7 additions & 2 deletions modules/secure-source-manager-instance/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,12 @@ variable "ca_pool" {
default = null
}

variable "instance_create" {
description = "Create SSM Instance. When set to false, uses instance_id to reference existing SSM instance."
type = bool
default = true
}

variable "instance_id" {
description = "Instance ID."
type = string
Expand All @@ -34,7 +40,7 @@ variable "kms_key" {
variable "labels" {
description = "Instance labels."
type = map(string)
default = {}
default = null
}

variable "location" {
Expand Down Expand Up @@ -66,6 +72,5 @@ variable "repositories" {
license = optional(string)
readme = optional(string)
}))
location = string
}))
}
2 changes: 1 addition & 1 deletion tests/modules/secure_source_manager_instance/examples/iam-bindings-additive.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
# limitations under the License.

values:
module.ssm_instance.google_secure_source_manager_instance.instance:
module.ssm_instance.google_secure_source_manager_instance.instance[0]:
effective_labels:
goog-terraform-provisioned: 'true'
instance_id: my-instance
Expand Down
2 changes: 1 addition & 1 deletion tests/modules/secure_source_manager_instance/examples/iam-bindings.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
# limitations under the License.

values:
module.ssm_instance.google_secure_source_manager_instance.instance:
module.ssm_instance.google_secure_source_manager_instance.instance[0]:
effective_labels:
goog-terraform-provisioned: 'true'
instance_id: my-instance
Expand Down
2 changes: 1 addition & 1 deletion tests/modules/secure_source_manager_instance/examples/iam.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
# limitations under the License.

values:
module.ssm_instance.google_secure_source_manager_instance.instance:
module.ssm_instance.google_secure_source_manager_instance.instance[0]:
effective_labels:
goog-terraform-provisioned: 'true'
instance_id: my-instance
Expand Down
2 changes: 1 addition & 1 deletion tests/modules/secure_source_manager_instance/examples/private-instance.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
# limitations under the License.

values:
module.ssm_instance.google_secure_source_manager_instance.instance:
module.ssm_instance.google_secure_source_manager_instance.instance[0]:
effective_labels:
goog-terraform-provisioned: 'true'
instance_id: my-instance
Expand Down
2 changes: 1 addition & 1 deletion tests/modules/secure_source_manager_instance/examples/public-instance-with-cmek.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
# limitations under the License.

values:
module.ssm_instance.google_secure_source_manager_instance.instance:
module.ssm_instance.google_secure_source_manager_instance.instance[0]:
effective_labels:
goog-terraform-provisioned: 'true'
instance_id: my-instance
Expand Down
2 changes: 1 addition & 1 deletion tests/modules/secure_source_manager_instance/examples/public-instance.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
# limitations under the License.

values:
module.ssm_instance.google_secure_source_manager_instance.instance:
module.ssm_instance.google_secure_source_manager_instance.instance[0]:
effective_labels:
goog-terraform-provisioned: 'true'
instance_id: my-instance
Expand Down