Initial Commit

.gitignore

@@ -0,0 +1,34 @@
+# Local .terraform Directories
+**/.terraform/*
+
+# .tfstate Files
+*.tfstate
+*.tfstate.*
+
+# Crash Log Files
+crash.log
+crash.*.log
+
+# Exclude All .tfvars Files, which are likely to contain Sensitive Data, such as
+# Passwords, Private Keys, and other secrets. These should not be part of Version
+# Control as they are Data Points which are potentially sensitive and subject
+# to change, depending on the Environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore Override Files as they are usually used to override resources locally and so
+# are not checked in.
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include Override Files you do wish to add to Version Control using Negated Pattern.
+# !example_override.tf
+
+# Include tfplan Files to ignore the Plan Output of Command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI Configuration Files
+.terraformrc
+terraform.rc

README.md

@@ -0,0 +1,3 @@
+# terraform-google-pubsub
+
+Terraform Google Pub/Sub

main.tf

@@ -0,0 +1,103 @@
+locals {
+  push_list = var.push != "" ? [var.push] : []
+
+  dead_letter_list = length(var.dead_letter) != 0 ? [var.dead_letter] : []
+
+  all_subscriptions = concat(
+    [
+      {
+        "name"                       = coalesce(var.name_subscription, var.name)
+        "roles"                      = var.roles_subscription
+        "message_retention_duration" = var.message_retention_duration
+        "ack_deadline_seconds"       = var.ack_deadline_seconds
+        "retain_acked_messages"      = var.retain_acked_messages
+        "ttl_list"                   = [var.ttl]
+        "push_list"                  = var.push != "" ? [var.push] : []
+        "dead_letter_list"           = length(var.dead_letter) != 0 ? [var.dead_letter] : []
+      }
+    ],
+    var.extra_subscriptions
+  )
+}
+
+
+resource "google_pubsub_topic" "topic" {
+  project = var.project
+
+  name = var.name
+
+  labels = var.labels
+}
+
+resource "google_pubsub_subscription" "subscription" {
+  count = var.topic_only ? "0" : length(local.all_subscriptions)
+
+  project = var.project
+
+  name = local.all_subscriptions[count.index].name
+
+  topic = google_pubsub_topic.topic.name
+
+  message_retention_duration = try(local.all_subscriptions[count.index].message_retention_duration, var.message_retention_duration)
+  ack_deadline_seconds       = try(local.all_subscriptions[count.index].ack_deadline_seconds, var.ack_deadline_seconds)
+  retain_acked_messages      = try(local.all_subscriptions[count.index].retain_acked_messages, var.retain_acked_messages)
+
+  dynamic "expiration_policy" {
+    for_each = try(local.all_subscriptions[count.index].ttl_list, [var.ttl])
+
+    content {
+      ttl = expiration_policy.value
+    }
+  }
+
+  dynamic "retry_policy" {
+    for_each = var.retry_policy != null ? [1] : []
+
+    content {
+      minimum_backoff = var.retry_policy.minimum_backoff
+      maximum_backoff = var.retry_policy.maximum_backoff
+    }
+  }
+
+  dynamic "push_config" {
+    for_each = try(local.all_subscriptions[count.index].push_list, local.push_list)
+
+    content {
+      push_endpoint = push_config.value
+    }
+  }
+
+  dynamic "dead_letter_policy" {
+    for_each = [for s in try(local.all_subscriptions[count.index].dead_letter_list, local.dead_letter_list) : {
+      dead_letter_topic     = s.dead_letter_topic
+      max_delivery_attempts = s.max_delivery_attempts
+    }]
+
+    content {
+      dead_letter_topic     = dead_letter_policy.value.dead_letter_topic
+      max_delivery_attempts = dead_letter_policy.value.max_delivery_attempts
+    }
+  }
+
+  labels = var.labels
+}
+
+resource "google_pubsub_topic_iam_binding" "pubsub_topic_role" {
+  count = length(keys(var.roles_topic))
+
+  topic = google_pubsub_topic.topic.id
+
+  role = "roles/pubsub.${element(keys(var.roles_topic), count.index)}"
+
+  members = formatlist("serviceAccount:%s", lookup(var.roles_topic, element(keys(var.roles_topic), count.index)))
+}
+
+resource "google_pubsub_subscription_iam_binding" "pubsub_subscription_role" {
+  count = length(keys(var.roles_subscription))
+
+  subscription = google_pubsub_subscription.subscription[0].id
+
+  role = "roles/pubsub.${element(keys(var.roles_subscription), count.index)}"
+
+  members = formatlist("serviceAccount:%s", lookup(var.roles_subscription, element(keys(var.roles_subscription), count.index)))
+}

variables.tf

@@ -0,0 +1,103 @@
+variable "name" {
+  type        = string
+  description = "the name of the topic/subscription"
+}
+
+variable "name_subscription" {
+  type        = string
+  description = "the name of the subscription (specified only for backwards compatibility to imported resources)"
+
+  default = ""
+}
+
+variable "extra_subscriptions" {
+  type        = list(any)
+  description = "the other subscriptions (map containing name and settings, NO ROLES)"
+
+  default = []
+}
+
+variable "project" {
+  type        = string
+  description = "the project in GCP"
+}
+
+variable "topic_only" {
+  type        = bool
+  description = "whether we only want a topic or also a subscription"
+
+  default = false
+}
+
+variable "roles_topic" {
+  type        = map(any)
+  description = "the roles of the SA for the topic: specify 'roleName: [account1, account2]'"
+
+  default = {}
+}
+
+variable "roles_subscription" {
+  type        = map(any)
+  description = "the roles of the SA for the subscription: specify 'roleName: [account1, account2]'"
+
+  default = {}
+}
+
+variable "labels" {
+  type        = map(any)
+  description = "the labels of the pubsub topic/subscription"
+
+  default = {}
+}
+
+variable "ttl" {
+  type        = string
+  description = "the ttl (contains an array with ONE string. If null, google sets 2678400s; if present BUT empty, google sets to never expire)"
+
+  default = "2678400s"
+}
+
+variable "push" {
+  type        = string
+  description = "the push_config (contains an array with ONE string, or empty)"
+
+  default = ""
+}
+
+variable "message_retention_duration" {
+  type        = string
+  description = "message_retention_duration"
+
+  default = "604800s"
+}
+
+variable "ack_deadline_seconds" {
+  type        = string
+  description = "ack_deadline_seconds"
+
+  default = "600"
+}
+
+variable "retain_acked_messages" {
+  type        = bool
+  description = "retain_acked_messages"
+
+  default = true
+}
+
+variable "dead_letter" {
+  type        = map(any)
+  description = "dead letter policy"
+
+  default = {}
+}
+
+variable "retry_policy" {
+  type = object({
+    minimum_backoff = string
+    maximum_backoff = string
+  })
+  description = "(Optional) A policy that specifies how Pub/Sub retries message delivery for this subscription."
+
+  default = null
+}

versions.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = "~> v1.6.2"
+
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 5.4.0"
+    }
+    google-beta = {
+      source  = "hashicorp/google-beta"
+      version = "~> 5.4.0"
+    }
+  }
+}