[GPII-3326]: Apply audit config in gcp-project module

common/modules/gcp-project/audit.tf

@@ -0,0 +1,50 @@
+variable "nonce" {}
+
+variable "gcloud_timeout" {
+  default = 30
+}
+
+resource "null_resource" "add_audit_config" {
+  triggers = {
+    nonce = "${var.nonce}"
+  }
+
+  depends_on = [
+    "google_project_iam_policy.project",
+  ]
+
+  provisioner "local-exec" {
+    command = <<EOF
+      set -e
+
+      auditConfigs=$(echo '[${join(
+        ",",
+        formatlist(
+          "{\"auditLogConfigs\":[{\"logType\":\"DATA_READ\"},{\"logType\":\"DATA_WRITE\"}],\"service\":\"%s\"}",
+          concat(
+            var.audited_project_apis,
+            var.audited_apis
+          )
+        )
+      )}]' | jq -c -r -S .)
+
+      policy=$(timeout -t ${var.gcloud_timeout} gcloud projects get-iam-policy ${google_project.project.project_id} --format json)
+      policy_bindings=$(echo $policy | jq -c -r .bindings)
+      policy_auditConfigs=$(echo $policy | jq -c -r -S .auditConfigs)
+
+      if [ "$(echo $auditConfigs | md5sum)" != "$(echo $policy_auditConfigs | md5sum)" ]; then
+        jq -n -r \
+          --argjson auditConfigs "$auditConfigs" \
+          --argjson bindings "$policy_bindings" \
+          '{"auditConfigs":$auditConfigs,"bindings":$bindings}' > ${path.module}/${google_project.project.project_id}.iam.policy.json
+
+        echo "Applying audit configs..."
+        timeout -t ${var.gcloud_timeout} gcloud -q projects set-iam-policy ${google_project.project.project_id} ${path.module}/${google_project.project.project_id}.iam.policy.json
+
+        rm ${path.module}/${google_project.project.project_id}.iam.policy.json
+      else
+        echo "Audit configs are up-to-date..."
+      fi
+    EOF
+  }
+}

common/modules/gcp-project/main.tf

@@ -23,7 +23,49 @@ variable "organization_id" {}
 
 variable "serviceaccount_key" {}
 
-variable "project_id" {} # id of the project which owns the credentials used by the provider
+# Id of the project which owns the credentials used by the provider
+variable "project_id" {}
+
+# List of APIs in use by the project without audit configuration
+variable "project_apis" {
+  default = [
+    "bigquery-json.googleapis.com",
+    "cloudbilling.googleapis.com",
+    "cloudresourcemanager.googleapis.com",
+    "containerregistry.googleapis.com",
+    "deploymentmanager.googleapis.com",
+    "iamcredentials.googleapis.com",
+    "oslogin.googleapis.com",
+    "pubsub.googleapis.com",
+    "replicapool.googleapis.com",
+    "replicapoolupdater.googleapis.com",
+    "resourceviews.googleapis.com",
+    "stackdriver.googleapis.com",
+    "storage-api.googleapis.com",
+  ]
+}
+
+# List of APIs in use by the project with audit configuration
+variable "audited_project_apis" {
+  default = [
+    "cloudkms.googleapis.com",
+    "cloudtrace.googleapis.com",
+    "compute.googleapis.com",
+    "container.googleapis.com",
+    "dns.googleapis.com",
+    "iam.googleapis.com",
+    "logging.googleapis.com",
+    "monitoring.googleapis.com",
+    "serviceusage.googleapis.com",
+  ]
+}
+
+# List of APIs solely for audit configuration
+variable "audited_apis" {
+  default = [
+    "storage.googleapis.com",
+  ]
+}
 
 data "google_iam_policy" "admin" {
   binding {
@@ -196,30 +238,7 @@ resource "google_project" "project" {
 resource "google_project_services" "project" {
   project = "${google_project.project.project_id}"
 
-  services = [
-    "bigquery-json.googleapis.com",
-    "cloudbilling.googleapis.com",
-    "cloudkms.googleapis.com",
-    "cloudresourcemanager.googleapis.com",
-    "cloudtrace.googleapis.com",
-    "compute.googleapis.com",
-    "container.googleapis.com",
-    "containerregistry.googleapis.com",
-    "deploymentmanager.googleapis.com",
-    "dns.googleapis.com",
-    "iam.googleapis.com",
-    "iamcredentials.googleapis.com",
-    "logging.googleapis.com",
-    "monitoring.googleapis.com",
-    "oslogin.googleapis.com",
-    "pubsub.googleapis.com",
-    "replicapool.googleapis.com",
-    "replicapoolupdater.googleapis.com",
-    "resourceviews.googleapis.com",
-    "serviceusage.googleapis.com",
-    "stackdriver.googleapis.com",
-    "storage-api.googleapis.com",
-  ]
+  services = "${concat(var.project_apis, var.audited_project_apis)}"
 }
 
 resource "google_project_iam_policy" "project" {

gcp/modules/gcp-secret-mgmt/main.tf

@@ -22,6 +22,7 @@ module "gcp-secret-mgmt" {
   encryption_keys    = "${var.encryption_keys}"
   storage_location   = "${var.storage_location}"
   keyring_name       = "${var.keyring_name}"
+  apply_audit_config = false
 }
 
 # Re-export variable. See https://www.terraform.io/docs/providers/terraform/d/remote_state.html#root-outputs-only