Skip to content

Latest commit

 

History

History
 
 

cmek-via-centralized-kms

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
OWNERS
OWNERS
 
 
README.md
README.md
 
 
backend.tf.sample
backend.tf.sample
 
 
diagram.png
diagram.png
 
 
main.tf
main.tf
 
 
outputs.tf
outputs.tf
 
 
variables.tf
variables.tf
 
 

README.md

GCE and GCS CMEK via centralized Cloud KMS

This example creates a sample centralized Cloud KMS configuration, and uses it to implement CMEK for Cloud Storage and Compute Engine in a service project.

The example is designed to match real-world use cases with a minimum amount of resources, and be used as a starting point for scenarios where application projects implement CMEK using keys managed by a central team. It also includes the IAM wiring needed to make such scenarios work. Regional resources are used in this example, but the same logic will apply for 'dual regional', 'multi regional' or 'global' resources.

This is the high level diagram:

High-level diagram

Managed resources and services

This sample creates several distinct groups of resources:

  • projects
    • Cloud KMS project
    • Service Project configured for GCE instances and GCS buckets
  • networking
    • VPC network
    • One subnet
    • Firewall rules for SSH access via IAP and open communication within the VPC
  • IAM
    • One service account for the GGE instance
  • KMS
    • One key ring
    • One crypto key (Protection level: software) for Cloud Engine
    • One crypto key (Protection level: software) for Cloud Storage
  • GCE
    • One instance encrypted with a CMEK Cryptokey hosted in Cloud KMS
  • GCS
    • One bucket encrypted with a CMEK Cryptokey hosted in Cloud KMS

Variables

name description type required default
prefix Optional prefix used to generate resources names. string ✓
project_config Provide 'billing_account_id' and 'parent' values if project creation is needed, uses existing 'projects_id' if null. Parent is in 'folders/nnn' or 'organizations/nnn' format. object({…}) ✓
deletion_protection Prevent Terraform from destroying data storage resources (storage buckets, GKE clusters, CloudSQL instances) in this blueprint. When this field is set in Terraform state, a terraform destroy or terraform apply that would delete data storage resources will fail. bool false
location The location where resources will be deployed. string "europe"
region The region where resources will be deployed. string "europe-west1"
vpc_ip_cidr_range Ip range used in the subnet deployef in the Service Project. string "10.0.0.0/20"
vpc_name Name of the VPC created in the Service Project. string "local"
vpc_subnet_name Name of the subnet created in the Service Project. string "subnet"

Outputs

name description sensitive
bucket GCS Bucket URL.
bucket_keys GCS Bucket Cloud KMS crypto keys.
projects Project ids.
vm GCE VM.
vm_keys GCE VM Cloud KMS crypto keys.

Test

module "test" {
  source = "./fabric/blueprints/data-solutions/cmek-via-centralized-kms/"
  project_config = {
    billing_account_id = "123456-123456-123456"
    parent             = "folders/12345678"
  }
  prefix = "prefix"
}
# tftest modules=8 resources=32