forked from GoogleCloudPlatform/cloud-foundation-fabric
-
Notifications
You must be signed in to change notification settings - Fork 0
/
variables-logging.tf
78 lines (74 loc) · 2.64 KB
/
variables-logging.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
/**
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
variable "logging_data_access" {
description = "Control activation of data access logs. Format is service => { log type => [exempted members]}. The special 'allServices' key denotes configuration for all services."
type = map(map(list(string)))
nullable = false
default = {}
validation {
condition = alltrue(flatten([
for k, v in var.logging_data_access : [
for kk, vv in v : contains(["DATA_READ", "DATA_WRITE", "ADMIN_READ"], kk)
]
]))
error_message = "Log type keys for each service can only be one of 'DATA_READ', 'DATA_WRITE', 'ADMIN_READ'."
}
}
variable "logging_exclusions" {
description = "Logging exclusions for this organization in the form {NAME -> FILTER}."
type = map(string)
default = {}
nullable = false
}
variable "logging_settings" {
description = "Default settings for logging resources."
type = object({
# TODO: add support for CMEK
disable_default_sink = optional(bool)
storage_location = optional(string)
})
default = null
}
variable "logging_sinks" {
description = "Logging sinks to create for the organization."
type = map(object({
bq_partitioned_table = optional(bool, false)
description = optional(string)
destination = string
disabled = optional(bool, false)
exclusions = optional(map(string), {})
filter = optional(string)
iam = optional(bool, true)
include_children = optional(bool, true)
type = string
}))
default = {}
nullable = false
validation {
condition = alltrue([
for k, v in var.logging_sinks :
contains(["bigquery", "logging", "project", "pubsub", "storage"], v.type)
])
error_message = "Type must be one of 'bigquery', 'logging', 'project', 'pubsub', 'storage'."
}
validation {
condition = alltrue([
for k, v in var.logging_sinks :
v.bq_partitioned_table != true || v.type == "bigquery"
])
error_message = "Can only set bq_partitioned_table when type is `bigquery`."
}
}