[GPII-3326]: Apply audit config in gcp-project module

common/modules/gcp-project/audit.tf

@@ -0,0 +1,36 @@
+variable "nonce" {}
+
+resource "null_resource" "add_audit_config" {
+  triggers = {
+    nonce = "${var.nonce}"
+  }
+
+  depends_on = [
+    "google_project_iam_policy.project",
+  ]
+
+  provisioner "local-exec" {
+    command = <<EOF
+      set -e
+
+      auditConfigs=$(cat ${path.module}/resources/auditConfigs.json | jq -c -r -S .)
+      policy=$(gcloud projects get-iam-policy ${google_project.project.project_id} --format json)
+      policy_bindings=$(echo $policy | jq -c -r .bindings)
+      policy_auditConfigs=$(echo $policy | jq -c -r -S .auditConfigs)
+
+      if [ "$(echo $auditConfigs | md5sum)" != "$(echo $policy_auditConfigs | md5sum)" ]; then
+        jq -n -r \
+          --argjson auditConfigs "$auditConfigs" \
+          --argjson bindings "$policy_bindings" \
+          '{"auditConfigs":$auditConfigs,"bindings":$bindings}' > ${path.module}/${google_project.project.project_id}.iam.policy.json
+
+        echo "Applying audit configs..."
+        gcloud -q projects set-iam-policy ${google_project.project.project_id} ${path.module}/${google_project.project.project_id}.iam.policy.json
+
+        rm ${path.module}/${google_project.project.project_id}.iam.policy.json
+      else
+        echo "Audit configs are up-to-date..."
+      fi
+    EOF
+  }
+}

common/modules/gcp-project/resources/auditConfigs.json

@@ -0,0 +1,112 @@
+[
+  {
+    "auditLogConfigs": [
+      {
+        "logType": "DATA_READ"
+      },
+      {
+        "logType": "DATA_WRITE"
+      }
+    ],
+    "service": "cloudkms.googleapis.com"
+  },
+  {
+    "auditLogConfigs": [
+      {
+        "logType": "DATA_READ"
+      },
+      {
+        "logType": "DATA_WRITE"
+      }
+    ],
+    "service": "compute.googleapis.com"
+  },
+  {
+    "auditLogConfigs": [
+      {
+        "logType": "DATA_READ"
+      },
+      {
+        "logType": "DATA_WRITE"
+      }
+    ],
+    "service": "dns.googleapis.com"
+  },
+  {
+    "auditLogConfigs": [
+      {
+        "logType": "DATA_READ"
+      },
+      {
+        "logType": "DATA_WRITE"
+      }
+    ],
+    "service": "storage.googleapis.com"
+  },
+  {
+    "auditLogConfigs": [
+      {
+        "logType": "DATA_READ"
+      },
+      {
+        "logType": "DATA_WRITE"
+      }
+    ],
+    "service": "iam.googleapis.com"
+  },
+  {
+    "auditLogConfigs": [
+      {
+        "logType": "DATA_READ"
+      },
+      {
+        "logType": "DATA_WRITE"
+      }
+    ],
+    "service": "container.googleapis.com"
+  },
+  {
+    "auditLogConfigs": [
+      {
+        "logType": "DATA_READ"
+      },
+      {
+        "logType": "DATA_WRITE"
+      }
+    ],
+    "service": "serviceusage.googleapis.com"
+  },
+  {
+    "auditLogConfigs": [
+      {
+        "logType": "DATA_READ"
+      },
+      {
+        "logType": "DATA_WRITE"
+      }
+    ],
+    "service": "logging.googleapis.com"
+  },
+  {
+    "auditLogConfigs": [
+      {
+        "logType": "DATA_READ"
+      },
+      {
+        "logType": "DATA_WRITE"
+      }
+    ],
+    "service": "monitoring.googleapis.com"
+  },
+  {
+    "auditLogConfigs": [
+      {
+        "logType": "DATA_READ"
+      },
+      {
+        "logType": "DATA_WRITE"
+      }
+    ],
+    "service": "cloudtrace.googleapis.com"
+  }
+]

gcp/modules/gcp-secret-mgmt/main.tf

@@ -22,6 +22,7 @@ module "gcp-secret-mgmt" {
   encryption_keys    = "${var.encryption_keys}"
   storage_location   = "${var.storage_location}"
   keyring_name       = "${var.keyring_name}"
+  apply_audit_config = false
 }
 
 # Re-export variable. See https://www.terraform.io/docs/providers/terraform/d/remote_state.html#root-outputs-only