add support for cmek in gcs module notification topic

wiktorn · Nov 4, 2024 · ffa2602 · ffa2602
1 parent 64cb097
commit ffa2602
Show file tree

Hide file tree

Showing 4 changed files with 52 additions and 34 deletions.
diff --git a/modules/gcs/README.md b/modules/gcs/README.md
@@ -311,7 +311,7 @@ module "bucket" {
 |---|---|:---:|:---:|:---:|
 | [location](variables.tf#L156) | Bucket location. | <code>string</code> | ✓ |  |
 | [name](variables.tf#L199) | Bucket name suffix. | <code>string</code> | ✓ |  |
-| [project_id](variables.tf#L255) | Bucket project id. | <code>string</code> | ✓ |  |
+| [project_id](variables.tf#L257) | Bucket project id. | <code>string</code> | ✓ |  |
 | [autoclass](variables.tf#L17) | Enable autoclass to automatically transition objects to appropriate storage classes based on their access pattern. If set to true, storage_class must be set to STANDARD. Defaults to false. | <code>bool</code> |  | <code>null</code> |
 | [cors](variables.tf#L23) | CORS configuration for the bucket. Defaults to null. | <code title="object&#40;&#123;&#10;  origin          &#61; optional&#40;list&#40;string&#41;&#41;&#10;  method          &#61; optional&#40;list&#40;string&#41;&#41;&#10;  response_header &#61; optional&#40;list&#40;string&#41;&#41;&#10;  max_age_seconds &#61; optional&#40;number&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
 | [custom_placement_config](variables.tf#L34) | The bucket's custom location configuration, which specifies the individual regions that comprise a dual-region bucket. If the bucket is designated as REGIONAL or MULTI_REGIONAL, the parameters are empty. | <code>list&#40;string&#41;</code> |  | <code>null</code> |
@@ -326,19 +326,19 @@ module "bucket" {
 | [lifecycle_rules](variables.tf#L107) | Bucket lifecycle rule. | <code title="map&#40;object&#40;&#123;&#10;  action &#61; object&#40;&#123;&#10;    type          &#61; string&#10;    storage_class &#61; optional&#40;string&#41;&#10;  &#125;&#41;&#10;  condition &#61; object&#40;&#123;&#10;    age                        &#61; optional&#40;number&#41;&#10;    created_before             &#61; optional&#40;string&#41;&#10;    custom_time_before         &#61; optional&#40;string&#41;&#10;    days_since_custom_time     &#61; optional&#40;number&#41;&#10;    days_since_noncurrent_time &#61; optional&#40;number&#41;&#10;    matches_prefix             &#61; optional&#40;list&#40;string&#41;&#41;&#10;    matches_storage_class      &#61; optional&#40;list&#40;string&#41;&#41; &#35; STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE, DURABLE_REDUCED_AVAILABILITY&#10;    matches_suffix             &#61; optional&#40;list&#40;string&#41;&#41;&#10;    noncurrent_time_before     &#61; optional&#40;string&#41;&#10;    num_newer_versions         &#61; optional&#40;number&#41;&#10;    with_state                 &#61; optional&#40;string&#41; &#35; &#34;LIVE&#34;, &#34;ARCHIVED&#34;, &#34;ANY&#34;&#10;  &#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [logging_config](variables.tf#L162) | Bucket logging configuration. | <code title="object&#40;&#123;&#10;  log_bucket        &#61; string&#10;  log_object_prefix &#61; optional&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
 | [managed_folders](variables.tf#L171) | Managed folders to create within the bucket in {PATH => CONFIG} format. | <code title="map&#40;object&#40;&#123;&#10;  force_destroy &#61; optional&#40;bool, false&#41;&#10;  iam           &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10;    members &#61; list&#40;string&#41;&#10;    role    &#61; string&#10;    condition &#61; optional&#40;object&#40;&#123;&#10;      expression  &#61; string&#10;      title       &#61; string&#10;      description &#61; optional&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10;    member &#61; string&#10;    role   &#61; string&#10;    condition &#61; optional&#40;object&#40;&#123;&#10;      expression  &#61; string&#10;      title       &#61; string&#10;      description &#61; optional&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [notification_config](variables.tf#L204) | GCS Notification configuration. | <code title="object&#40;&#123;&#10;  enabled            &#61; bool&#10;  payload_format     &#61; string&#10;  topic_name         &#61; string&#10;  sa_email           &#61; string&#10;  create_topic       &#61; optional&#40;bool, true&#41;&#10;  event_types        &#61; optional&#40;list&#40;string&#41;&#41;&#10;  custom_attributes  &#61; optional&#40;map&#40;string&#41;&#41;&#10;  object_name_prefix &#61; optional&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
-| [objects_to_upload](variables.tf#L219) | Objects to be uploaded to bucket. | <code title="map&#40;object&#40;&#123;&#10;  name                &#61; string&#10;  metadata            &#61; optional&#40;map&#40;string&#41;&#41;&#10;  content             &#61; optional&#40;string&#41;&#10;  source              &#61; optional&#40;string&#41;&#10;  cache_control       &#61; optional&#40;string&#41;&#10;  content_disposition &#61; optional&#40;string&#41;&#10;  content_encoding    &#61; optional&#40;string&#41;&#10;  content_language    &#61; optional&#40;string&#41;&#10;  content_type        &#61; optional&#40;string&#41;&#10;  event_based_hold    &#61; optional&#40;bool&#41;&#10;  temporary_hold      &#61; optional&#40;bool&#41;&#10;  detect_md5hash      &#61; optional&#40;string&#41;&#10;  storage_class       &#61; optional&#40;string&#41;&#10;  kms_key_name        &#61; optional&#40;string&#41;&#10;  customer_encryption &#61; optional&#40;object&#40;&#123;&#10;    encryption_algorithm &#61; optional&#40;string&#41;&#10;    encryption_key       &#61; string&#10;  &#125;&#41;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [prefix](variables.tf#L245) | Optional prefix used to generate the bucket name. | <code>string</code> |  | <code>null</code> |
-| [public_access_prevention](variables.tf#L260) | Prevents public access to the bucket. | <code>string</code> |  | <code>null</code> |
-| [requester_pays](variables.tf#L270) | Enables Requester Pays on a storage bucket. | <code>bool</code> |  | <code>null</code> |
-| [retention_policy](variables.tf#L276) | Bucket retention policy. | <code title="object&#40;&#123;&#10;  retention_period &#61; number&#10;  is_locked        &#61; optional&#40;bool&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
-| [rpo](variables.tf#L285) | Bucket recovery point objective. | <code>string</code> |  | <code>null</code> |
-| [soft_delete_retention](variables.tf#L295) | The duration in seconds that soft-deleted objects in the bucket will be retained and cannot be permanently deleted. Set to 0 to override the default and disable. | <code>number</code> |  | <code>null</code> |
-| [storage_class](variables.tf#L301) | Bucket storage class. | <code>string</code> |  | <code>&#34;STANDARD&#34;</code> |
-| [tag_bindings](variables.tf#L311) | Tag bindings for this folder, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
-| [uniform_bucket_level_access](variables.tf#L318) | Allow using object ACLs (false) or not (true, this is the recommended behavior) , defaults to true (which is the recommended practice, but not the behavior of storage API). | <code>bool</code> |  | <code>true</code> |
-| [versioning](variables.tf#L324) | Enable versioning, defaults to false. | <code>bool</code> |  | <code>null</code> |
-| [website](variables.tf#L330) | Bucket website. | <code title="object&#40;&#123;&#10;  main_page_suffix &#61; optional&#40;string&#41;&#10;  not_found_page   &#61; optional&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
+| [notification_config](variables.tf#L204) | GCS Notification configuration. | <code title="object&#40;&#123;&#10;  enabled        &#61; bool&#10;  payload_format &#61; string&#10;  sa_email       &#61; string&#10;  topic_name     &#61; string&#10;  create_topic &#61; optional&#40;object&#40;&#123;&#10;    kms_key_id &#61; optional&#40;string&#41;&#10;  &#125;&#41;&#41;&#10;  event_types        &#61; optional&#40;list&#40;string&#41;&#41;&#10;  custom_attributes  &#61; optional&#40;map&#40;string&#41;&#41;&#10;  object_name_prefix &#61; optional&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
+| [objects_to_upload](variables.tf#L221) | Objects to be uploaded to bucket. | <code title="map&#40;object&#40;&#123;&#10;  name                &#61; string&#10;  metadata            &#61; optional&#40;map&#40;string&#41;&#41;&#10;  content             &#61; optional&#40;string&#41;&#10;  source              &#61; optional&#40;string&#41;&#10;  cache_control       &#61; optional&#40;string&#41;&#10;  content_disposition &#61; optional&#40;string&#41;&#10;  content_encoding    &#61; optional&#40;string&#41;&#10;  content_language    &#61; optional&#40;string&#41;&#10;  content_type        &#61; optional&#40;string&#41;&#10;  event_based_hold    &#61; optional&#40;bool&#41;&#10;  temporary_hold      &#61; optional&#40;bool&#41;&#10;  detect_md5hash      &#61; optional&#40;string&#41;&#10;  storage_class       &#61; optional&#40;string&#41;&#10;  kms_key_name        &#61; optional&#40;string&#41;&#10;  customer_encryption &#61; optional&#40;object&#40;&#123;&#10;    encryption_algorithm &#61; optional&#40;string&#41;&#10;    encryption_key       &#61; string&#10;  &#125;&#41;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [prefix](variables.tf#L247) | Optional prefix used to generate the bucket name. | <code>string</code> |  | <code>null</code> |
+| [public_access_prevention](variables.tf#L262) | Prevents public access to the bucket. | <code>string</code> |  | <code>null</code> |
+| [requester_pays](variables.tf#L272) | Enables Requester Pays on a storage bucket. | <code>bool</code> |  | <code>null</code> |
+| [retention_policy](variables.tf#L278) | Bucket retention policy. | <code title="object&#40;&#123;&#10;  retention_period &#61; number&#10;  is_locked        &#61; optional&#40;bool&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
+| [rpo](variables.tf#L287) | Bucket recovery point objective. | <code>string</code> |  | <code>null</code> |
+| [soft_delete_retention](variables.tf#L297) | The duration in seconds that soft-deleted objects in the bucket will be retained and cannot be permanently deleted. Set to 0 to override the default and disable. | <code>number</code> |  | <code>null</code> |
+| [storage_class](variables.tf#L303) | Bucket storage class. | <code>string</code> |  | <code>&#34;STANDARD&#34;</code> |
+| [tag_bindings](variables.tf#L313) | Tag bindings for this folder, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
+| [uniform_bucket_level_access](variables.tf#L320) | Allow using object ACLs (false) or not (true, this is the recommended behavior) , defaults to true (which is the recommended practice, but not the behavior of storage API). | <code>bool</code> |  | <code>true</code> |
+| [versioning](variables.tf#L326) | Enable versioning, defaults to false. | <code>bool</code> |  | <code>null</code> |
+| [website](variables.tf#L332) | Bucket website. | <code title="object&#40;&#123;&#10;  main_page_suffix &#61; optional&#40;string&#41;&#10;  not_found_page   &#61; optional&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
 
 ## Outputs
 

diff --git a/modules/gcs/main.tf b/modules/gcs/main.tf
@@ -17,6 +17,7 @@
 locals {
   prefix       = var.prefix == null ? "" : "${var.prefix}-"
   notification = try(var.notification_config.enabled, false)
+  topic_create = try(var.notification_config.topic_create, null) != null
 }
 
 resource "google_storage_bucket" "bucket" {
@@ -172,14 +173,15 @@ resource "google_storage_notification" "notification" {
 }
 
 resource "google_pubsub_topic_iam_binding" "binding" {
-  count   = try(var.notification_config.create_topic, null) == true ? 1 : 0
+  count   = local.topic_create ? 1 : 0
   topic   = google_pubsub_topic.topic[0].id
   role    = "roles/pubsub.publisher"
   members = ["serviceAccount:${var.notification_config.sa_email}"]
 }
 
 resource "google_pubsub_topic" "topic" {
-  count   = try(var.notification_config.create_topic, null) == true ? 1 : 0
-  project = var.project_id
-  name    = var.notification_config.topic_name
+  count        = local.topic_create ? 1 : 0
+  project      = var.project_id
+  name         = var.notification_config.topic_name
+  kms_key_name = try(var.notification_config.topic_create.kms_key_id, null)
 }
diff --git a/modules/gcs/variables.tf b/modules/gcs/variables.tf
@@ -204,11 +204,13 @@ variable "name" {
 variable "notification_config" {
   description = "GCS Notification configuration."
   type = object({
-    enabled            = bool
-    payload_format     = string
-    topic_name         = string
-    sa_email           = string
-    create_topic       = optional(bool, true)
+    enabled        = bool
+    payload_format = string
+    sa_email       = string
+    topic_name     = string
+    create_topic = optional(object({
+      kms_key_id = optional(string)
+    }))
     event_types        = optional(list(string))
     custom_attributes  = optional(map(string))
     object_name_prefix = optional(string)

diff --git a/modules/spanner-instance/main.tf b/modules/spanner-instance/main.tf
@@ -15,15 +15,21 @@
  */
 
 locals {
-  spanner_instance = var.instance_create ? google_spanner_instance.spanner_instance[0] : data.google_spanner_instance.spanner_instance[0]
+  spanner_instance = (
+    var.instance_create
+    ? google_spanner_instance.spanner_instance[0]
+    : data.google_spanner_instance.spanner_instance[0]
+  )
 }
 
 resource "google_spanner_instance_config" "spanner_instance_config" {
-  count        = try(var.instance.config.auto_create, null) == null ? 0 : 1
-  name         = var.instance.config.name
-  project      = var.project_id
-  display_name = coalesce(var.instance.config.auto_create.display_name, var.instance.config.name)
-  base_config  = var.instance.config.auto_create.base_config
+  count   = try(var.instance.config.auto_create, null) == null ? 0 : 1
+  name    = var.instance.config.name
+  project = var.project_id
+  display_name = coalesce(
+    var.instance.config.auto_create.display_name, var.instance.config.name
+  )
+  base_config = var.instance.config.auto_create.base_config
   dynamic "replicas" {
     for_each = var.instance.config.auto_create.replicas
     content {
@@ -42,9 +48,13 @@ data "google_spanner_instance" "spanner_instance" {
 }
 
 resource "google_spanner_instance" "spanner_instance" {
-  count            = var.instance_create ? 1 : 0
-  project          = var.project_id
-  config           = var.instance.config.auto_create == null ? var.instance.config.name : google_spanner_instance_config.spanner_instance_config[0].name
+  count   = var.instance_create ? 1 : 0
+  project = var.project_id
+  config = (
+    var.instance.config.auto_create == null
+    ? var.instance.config.name
+    : google_spanner_instance_config.spanner_instance_config[0].name
+  )
   name             = var.instance.name
   display_name     = coalesce(var.instance.display_name, var.instance.name)
   num_nodes        = var.instance.num_nodes
@@ -64,8 +74,12 @@ resource "google_spanner_instance" "spanner_instance" {
       dynamic "autoscaling_targets" {
         for_each = var.instance.autoscaling.targets == null ? [] : [""]
         content {
-          high_priority_cpu_utilization_percent = var.instance.autoscaling.targets.high_priority_cpu_utilization_percent
-          storage_utilization_percent           = var.instance.autoscaling.targets.storage_utilization_percent
+          high_priority_cpu_utilization_percent = (
+            var.instance.autoscaling.targets.high_priority_cpu_utilization_percent
+          )
+          storage_utilization_percent = (
+            var.instance.autoscaling.targets.storage_utilization_percent
+          )
         }
       }
     }