diff --git a/README.md b/README.md index 748a935..b6856dc 100644 --- a/README.md +++ b/README.md @@ -14,28 +14,25 @@ This blueprint was automatically generated by GCP Cloud Setup. The specific res - Creates a hierarchical structure under your organization for logical grouping of projects (e.g., "Production," "Non-Production," "Development"). [Learn more](https://cloud.google.com/resource-manager/docs/creating-managing-folders). - **`projects`:** - Provisions projects within the defined folders for isolating resources and applying specific policies. [Learn more](https://cloud.google.com/resource-manager/docs/creating-managing-projects). +- **`service-projects`:** + - Creates projects for Prod and Non Prod environments. [Learn more](https://cloud.google.com/docs/enterprise/best-practices/establish-projects). - **`network`:** - Configures VPC networks and subnets, including firewall rules for secure communication. [Learn more](https://cloud.google.com/vpc/docs/using-vpc). - Configures Shared VPC for centralized network management and efficient resource utilization across projects. [Learn more](https://cloud.google.com/vpc/docs/shared-vpc). +- **`vpn`:** + - Creates hybrid connectivity to your on premises networks using a optional highly available VPN. [Learn more](https://cloud.google.com/network-connectivity/docs/vpn/concepts/best-practices) - **`iam`:** - Defines Identity and Access Management roles and bindings at the organization, folder, and project levels to control access to resources. [Learn more](https://cloud.google.com/iam/docs/overview). - **`groups`:** - Leverages Google Groups to simplify IAM management by assigning permissions to groups instead of individual users. [Learn more](https://support.google.com/a/answer/2405986). -- **`service-projects`:** - - Creates projects for Prod and Non Prod environments. [Learn more](https://cloud.google.com/docs/enterprise/best-practices/establish-projects). -- **`vpn`:** - - Creates hybrid connectivity to your on premises networks using a optional highly available VPN. [Learn more](https://cloud.google.com/network-connectivity/docs/vpn/concepts/best-practices) -- **`log-export`:** - - Deploys a centralized project for collecting and analyzing logs and metrics from other projects, enhancing visibility and troubleshooting capabilities. [Learn more about logging](https://cloud.google.com/logging/docs/overview) and [Learn more about monitoring](https://cloud.google.com/monitoring/docs/overview). + - Groups who will be able to use the service projects. [Learn more](https://cloud.google.com/identity/docs/groups). - **`org-policy`:** - Configures security using Org Policies for centralized control and Security Command Center for threat detection and response. [Org Policies](https://cloud.google.com/resource-manager/docs/organization-policy/overview) [Security Command Center](https://cloud.google.com/security-command-center/docs/optimize-security-command-center) - **`monitoring`:** - Centralizes metrics scope so that metrics from all of your projects can be viewed through a single scoping project. [Learn more](https://cloud.google.com/monitoring/settings). - -- **`groups`:** - - Groups who will be able to use the service projects. [Learn more](https://cloud.google.com/identity/docs/groups). - - +- **`log-export`:** + - Deploys a centralized project for collecting and analyzing logs and metrics from other projects, enhancing visibility and troubleshooting capabilities. [Learn more about logging](https://cloud.google.com/logging/docs/overview) and [Learn more about monitoring](https://cloud.google.com/monitoring/docs/overview). + ## Prerequisites Before deploying this blueprint, ensure you have the following: - **Google Cloud Account:** A Google Cloud Platform account with billing enabled. @@ -65,6 +62,7 @@ To run this Terraform code, you'll need to use either a service account or a use 2. **Grant Necessary IAM Permissions:** - Grant permission for your user to impersonate the newly created service account. Your will need the `roles/iam.serviceAccountUser` permission to run this command. [Learn More](https://cloud.google.com/iam/docs/service-account-permissions) +

``` gcloud iam service-accounts add-iam-policy-binding "serviceAccount:terraform-deployer@PROJECT_ID.iam.gserviceaccount.com" \ --member="user:" \ @@ -88,8 +86,9 @@ To run this Terraform code, you'll need to use either a service account or a use - `roles/secretmanager.secretAccessor` - `roles/iam.serviceAccountUser` - `roles/storage.objectUser` +

- ``` + ```bash gcloud organizations add-iam-policy-binding ORGANIZATION_ID \ --member="serviceAccount:terraform-deployer@PROJECT_ID.iam.gserviceaccount.com" \ --role="ROLE_NAME"   @@ -239,8 +238,8 @@ Service account to access deploy terraform ``` 5. **Clone the Repository (optional):** Verify by cloning the repository to your local machine. - ```bash - git clone - cd - ``` + ```bash + git clone + cd + ```