Support customizable resource names in FAST stage 0

fast/stages/0-bootstrap/automation.tf

@@ -28,11 +28,13 @@ locals {
 module "automation-project" {
   source          = "../../../modules/project"
   billing_account = var.billing_account.id
-  name            = "iac-core-0"
+  name = lookup(
+    var.resource_names, "project/automation", "${local.default_environment.short_name}-iac-core-0"
+  )
   parent = coalesce(
     var.project_parent_ids.automation, "organizations/${var.organization.id}"
   )
-  prefix = local.prefix
+  prefix = var.prefix
   contacts = (
     var.bootstrap_user != null || var.essential_contacts == null
     ? {}
@@ -192,8 +194,10 @@ module "automation-project" {
 module "automation-tf-output-gcs" {
   source     = "../../../modules/gcs"
   project_id = module.automation-project.project_id
-  name       = "iac-core-outputs-0"
-  prefix     = local.prefix
+  name = lookup(
+    var.resource_names, "gcs/outputs", "${local.default_environment.short_name}-iac-core-outputs-0"
+  )
+  prefix     = var.prefix
   location   = local.locations.gcs
   versioning = true
   depends_on = [module.organization]
@@ -204,19 +208,23 @@ module "automation-tf-output-gcs" {
 module "automation-tf-bootstrap-gcs" {
   source     = "../../../modules/gcs"
   project_id = module.automation-project.project_id
-  name       = "iac-core-bootstrap-0"
-  prefix     = local.prefix
+  name = lookup(
+    var.resource_names, "gcs/bootstrap", "${local.default_environment.short_name}-iac-core-bootstrap-0"
+  )
+  prefix     = var.prefix
   location   = local.locations.gcs
   versioning = true
   depends_on = [module.organization]
 }
 
 module "automation-tf-bootstrap-sa" {
-  source       = "../../../modules/iam-service-account"
-  project_id   = module.automation-project.project_id
-  name         = "bootstrap-0"
+  source     = "../../../modules/iam-service-account"
+  project_id = module.automation-project.project_id
+  name = lookup(
+    var.resource_names, "sa/bootstrap", "${local.default_environment.short_name}-bootstrap-0"
+  )
   display_name = "Terraform organization bootstrap service account."
-  prefix       = local.prefix
+  prefix       = var.prefix
   # allow SA used by CI/CD workflow to impersonate this SA
   iam = {
     "roles/iam.serviceAccountTokenCreator" = compact([
@@ -229,11 +237,13 @@ module "automation-tf-bootstrap-sa" {
 }
 
 module "automation-tf-bootstrap-r-sa" {
-  source       = "../../../modules/iam-service-account"
-  project_id   = module.automation-project.project_id
-  name         = "bootstrap-0r"
+  source     = "../../../modules/iam-service-account"
+  project_id = module.automation-project.project_id
+  name = lookup(
+    var.resource_names, "sa/bootstrap-ro", "${local.default_environment.short_name}-bootstrap-0r"
+  )
   display_name = "Terraform organization bootstrap service account (read-only)."
-  prefix       = local.prefix
+  prefix       = var.prefix
   # allow SA used by CI/CD workflow to impersonate this SA
   iam = {
     "roles/iam.serviceAccountTokenCreator" = compact([
@@ -258,8 +268,10 @@ module "automation-tf-bootstrap-r-sa" {
 module "automation-tf-resman-gcs" {
   source     = "../../../modules/gcs"
   project_id = module.automation-project.project_id
-  name       = "iac-core-resman-0"
-  prefix     = local.prefix
+  name = lookup(
+    var.resource_names, "gcs/resman", "${local.default_environment.short_name}-iac-core-resman-0"
+  )
+  prefix     = var.prefix
   location   = local.locations.gcs
   versioning = true
   iam = {
@@ -270,11 +282,13 @@ module "automation-tf-resman-gcs" {
 }
 
 module "automation-tf-resman-sa" {
-  source       = "../../../modules/iam-service-account"
-  project_id   = module.automation-project.project_id
-  name         = "resman-0"
+  source     = "../../../modules/iam-service-account"
+  project_id = module.automation-project.project_id
+  name = lookup(
+    var.resource_names, "sa/resman", "${local.default_environment.short_name}-resman-0"
+  )
   display_name = "Terraform stage 1 resman service account."
-  prefix       = local.prefix
+  prefix       = var.prefix
   # allow SA used by CI/CD workflow to impersonate this SA
   # we use additive IAM to allow tenant CI/CD SAs to impersonate it
   iam_bindings_additive = merge(
@@ -297,11 +311,13 @@ module "automation-tf-resman-sa" {
 }
 
 module "automation-tf-resman-r-sa" {
-  source       = "../../../modules/iam-service-account"
-  project_id   = module.automation-project.project_id
-  name         = "resman-0r"
+  source     = "../../../modules/iam-service-account"
+  project_id = module.automation-project.project_id
+  name = lookup(
+    var.resource_names, "sa/resman-ro", "${local.default_environment.short_name}-resman-0r"
+  )
   display_name = "Terraform stage 1 resman service account (read-only)."
-  prefix       = local.prefix
+  prefix       = var.prefix
   # allow SA used by CI/CD workflow to impersonate this SA
   # we use additive IAM to allow tenant CI/CD SAs to impersonate it
   iam_bindings_additive = merge(
@@ -336,8 +352,10 @@ module "automation-tf-resman-r-sa" {
 module "automation-tf-vpcsc-gcs" {
   source     = "../../../modules/gcs"
   project_id = module.automation-project.project_id
-  name       = "iac-core-vpcsc-0"
-  prefix     = local.prefix
+  name = lookup(
+    var.resource_names, "gcs/vpcsc", "${local.default_environment.short_name}-iac-core-vpcsc-0"
+  )
+  prefix     = var.prefix
   location   = local.locations.gcs
   versioning = true
   iam = {
@@ -348,11 +366,13 @@ module "automation-tf-vpcsc-gcs" {
 }
 
 module "automation-tf-vpcsc-sa" {
-  source       = "../../../modules/iam-service-account"
-  project_id   = module.automation-project.project_id
-  name         = "vpcsc-0"
+  source     = "../../../modules/iam-service-account"
+  project_id = module.automation-project.project_id
+  name = lookup(
+    var.resource_names, "sa/vpcsc", "${local.default_environment.short_name}-vpcsc-0"
+  )
   display_name = "Terraform stage 1 vpcsc service account."
-  prefix       = local.prefix
+  prefix       = var.prefix
   # allow SA used by CI/CD workflow to impersonate this SA
   # we use additive IAM to allow tenant CI/CD SAs to impersonate it
   iam_bindings_additive = merge(
@@ -375,11 +395,13 @@ module "automation-tf-vpcsc-sa" {
 }
 
 module "automation-tf-vpcsc-r-sa" {
-  source       = "../../../modules/iam-service-account"
-  project_id   = module.automation-project.project_id
-  name         = "vpcsc-0r"
+  source     = "../../../modules/iam-service-account"
+  project_id = module.automation-project.project_id
+  name = lookup(
+    var.resource_names, "sa/vpcsc-ro", "${local.default_environment.short_name}-vpcsc-0r"
+  )
   display_name = "Terraform stage 1 vpcsc service account (read-only)."
-  prefix       = local.prefix
+  prefix       = var.prefix
   # allow SA used by CI/CD workflow to impersonate this SA
   # we use additive IAM to allow tenant CI/CD SAs to impersonate it
   iam_bindings_additive = local.cicd_vpcsc_r_sa == "" ? {} : {

fast/stages/0-bootstrap/billing.tf

@@ -43,11 +43,13 @@ module "billing-export-project" {
     local.billing_mode == "org" || var.billing_account.force_create.project == true ? 1 : 0
   )
   billing_account = var.billing_account.id
-  name            = "billing-exp-0"
+  name = lookup(
+    var.resource_names, "project/billing", "${local.default_environment.short_name}-billing-exp-0"
+  )
   parent = coalesce(
     var.project_parent_ids.billing, "organizations/${var.organization.id}"
   )
-  prefix = local.prefix
+  prefix = var.prefix
   contacts = (
     var.bootstrap_user != null || var.essential_contacts == null
     ? {}
@@ -73,7 +75,7 @@ module "billing-export-dataset" {
     local.billing_mode == "org" || var.billing_account.force_create.dataset == true ? 1 : 0
   )
   project_id    = module.billing-export-project[0].project_id
-  id            = "billing_export"
+  id            = lookup(var.resource_names, "bq/billing", "billing_export")
   friendly_name = "Billing export."
   location      = local.locations.bq
 }

fast/stages/0-bootstrap/cicd.tf

@@ -76,12 +76,16 @@ locals {
 # SAs used by CI/CD workflows to impersonate automation SAs
 
 module "automation-tf-cicd-sa" {
-  source       = "../../../modules/iam-service-account"
-  for_each     = local.cicd_repositories
-  project_id   = module.automation-project.project_id
-  name         = "${each.key}-1"
+  source     = "../../../modules/iam-service-account"
+  for_each   = local.cicd_repositories
+  project_id = module.automation-project.project_id
+  name = (
+    lookup(var.resource_names, "sa/cicd_template", null) == null
+    ? "${local.default_environment.short_name}-${each.key}-1"
+    : "${var.resource_names["sa/cicd_template"]}${each.key}-1"
+  )
   display_name = "Terraform CI/CD ${each.key} service account."
-  prefix       = local.prefix
+  prefix       = var.prefix
   iam = {
     "roles/iam.workloadIdentityUser" = [
       each.value.branch == null
@@ -107,12 +111,16 @@ module "automation-tf-cicd-sa" {
 }
 
 module "automation-tf-cicd-r-sa" {
-  source       = "../../../modules/iam-service-account"
-  for_each     = local.cicd_repositories
-  project_id   = module.automation-project.project_id
-  name         = "${each.key}-1r"
+  source     = "../../../modules/iam-service-account"
+  for_each   = local.cicd_repositories
+  project_id = module.automation-project.project_id
+  name = (
+    lookup(var.resource_names, "sa/cicd_template", null) == null
+    ? "${local.default_environment.short_name}-${each.key}-1r"
+    : "${var.resource_names["sa/cicd_template"]}${each.key}-1r"
+  )
   display_name = "Terraform CI/CD ${each.key} service account (read-only)."
-  prefix       = local.prefix
+  prefix       = var.prefix
   iam = {
     "roles/iam.workloadIdentityUser" = [
       format(

fast/stages/0-bootstrap/identity-providers.tf

@@ -32,10 +32,12 @@ locals {
 }
 
 resource "google_iam_workforce_pool" "default" {
-  count             = length(local.workforce_identity_providers) > 0 ? 1 : 0
-  parent            = "organizations/${var.organization.id}"
-  location          = "global"
-  workforce_pool_id = "${var.prefix}-bootstrap"
+  count    = length(local.workforce_identity_providers) > 0 ? 1 : 0
+  parent   = "organizations/${var.organization.id}"
+  location = "global"
+  workforce_pool_id = lookup(
+    var.resource_names, "wf/bootstrap", "${var.prefix}-bootstrap"
+  )
 }
 
 resource "google_iam_workforce_pool_provider" "default" {
@@ -46,18 +48,24 @@ resource "google_iam_workforce_pool_provider" "default" {
   disabled            = each.value.disabled
   display_name        = each.value.display_name
   location            = google_iam_workforce_pool.default[0].location
-  provider_id         = "${var.prefix}-bootstrap-${each.key}"
-  workforce_pool_id   = google_iam_workforce_pool.default[0].workforce_pool_id
+  provider_id = (
+    lookup(var.resource_names, "wf/provider_template", null) == null
+    ? "${var.prefix}-bootstrap-${each.key}"
+    : "${var.resource_names["wf/provider_template"]}-${each.key}"
+  )
+  workforce_pool_id = google_iam_workforce_pool.default[0].workforce_pool_id
   saml {
     idp_metadata_xml = each.value.saml.idp_metadata_xml
   }
 }
 
 resource "google_iam_workload_identity_pool" "default" {
-  provider                  = google-beta
-  count                     = length(local.workload_identity_providers) > 0 ? 1 : 0
-  project                   = module.automation-project.project_id
-  workload_identity_pool_id = "${var.prefix}-bootstrap"
+  provider = google-beta
+  count    = length(local.workload_identity_providers) > 0 ? 1 : 0
+  project  = module.automation-project.project_id
+  workload_identity_pool_id = lookup(
+    var.resource_names, "wif/bootstrap", "${var.prefix}-bootstrap"
+  )
 }
 
 resource "google_iam_workload_identity_pool_provider" "default" {
@@ -67,9 +75,13 @@ resource "google_iam_workload_identity_pool_provider" "default" {
   workload_identity_pool_id = (
     google_iam_workload_identity_pool.default[0].workload_identity_pool_id
   )
-  workload_identity_pool_provider_id = "${var.prefix}-bootstrap-${each.key}"
-  attribute_condition                = each.value.attribute_condition
-  attribute_mapping                  = each.value.attribute_mapping
+  workload_identity_pool_provider_id = (
+    lookup(var.resource_names, "wif/provider_template", null) == null
+    ? "${var.prefix}-bootstrap-${each.key}"
+    : "${var.resource_names["wif/provider_template"]}-${each.key}"
+  )
+  attribute_condition = each.value.attribute_condition
+  attribute_mapping   = each.value.attribute_mapping
   oidc {
     # Setting an empty list configures allowed_audiences to the url of the provider
     allowed_audiences = each.value.custom_settings.audiences

fast/stages/0-bootstrap/log-export.tf

@@ -38,11 +38,11 @@ locals {
 
 module "log-export-project" {
   source = "../../../modules/project"
-  name   = "audit-logs-0"
+  name   = "${local.default_environment.short_name}-audit-logs-0"
   parent = coalesce(
     var.project_parent_ids.logging, "organizations/${var.organization.id}"
   )
-  prefix          = local.prefix
+  prefix          = var.prefix
   billing_account = var.billing_account.id
   contacts = (
     var.bootstrap_user != null || var.essential_contacts == null
@@ -69,7 +69,7 @@ module "log-export-dataset" {
   source        = "../../../modules/bigquery-dataset"
   count         = contains(local.log_types, "bigquery") ? 1 : 0
   project_id    = module.log-export-project.project_id
-  id            = "logs"
+  id            = lookup(var.resource_names, "bq/logs", "logs")
   friendly_name = "Audit logs export."
   location      = local.locations.bq
 }
@@ -78,9 +78,11 @@ module "log-export-gcs" {
   source     = "../../../modules/gcs"
   count      = contains(local.log_types, "storage") ? 1 : 0
   project_id = module.log-export-project.project_id
-  name       = "logs"
-  prefix     = local.prefix
-  location   = local.locations.gcs
+  name = lookup(
+    var.resource_names, "gcs/logs", "${local.default_environment.short_name}-logs"
+  )
+  prefix   = var.prefix
+  location = local.locations.gcs
 }
 
 module "log-export-logbucket" {
@@ -100,6 +102,10 @@ module "log-export-pubsub" {
   source     = "../../../modules/pubsub"
   for_each   = toset([for k, v in var.log_sinks : k if v.type == "pubsub"])
   project_id = module.log-export-project.project_id
-  name       = each.key
-  regions    = local.locations.pubsub
+  name = (
+    lookup(var.resource_names, "pubsub/logs_template", null) == null
+    ? each.key
+    : "${var.resource_names["pubsub/logs_template"]}-${each.key}"
+  )
+  regions = local.locations.pubsub
 }

fast/stages/0-bootstrap/main.tf

@@ -15,7 +15,18 @@
  */
 
 locals {
-  env_default = [for k, v in var.environments : k if v.is_default][0]
+  default_environment = [
+    for k, v in local.environments : v if v.is_default
+  ][0]
+  environments = {
+    for k, v in var.environments : k => {
+      is_default = v.is_default
+      key        = k
+      name       = v.name
+      short_name = v.short_name != null ? v.short_name : k
+      tag_name   = v.tag_name != null ? v.tag_name : lower(v.name)
+    }
+  }
   principals = {
     for k, v in var.groups : k => (
       can(regex("^[a-zA-Z]+:", v))
@@ -29,6 +40,4 @@ locals {
     logging = var.locations.logging
     pubsub  = var.locations.pubsub
   }
-  # naming: environment used in most resource names
-  prefix = join("-", compact([var.prefix, local.env_default]))
 }