feat!: added sub-modules for PAM and Secure Source Manager (#222)

terraform-google-modules · Sep 4, 2024 · 87f34e0 · 87f34e0
1 parent d4e0a38
commit 87f34e0
Show file tree

Hide file tree

Showing 88 changed files with 1,988 additions and 86 deletions.
diff --git a/examples/bigquery_dataset/main.tf b/examples/bigquery_dataset/main.tf
@@ -19,7 +19,7 @@
  *********************************************/
 module "bigquery_dataset_iam_binding" {
   source  = "terraform-google-modules/iam/google//modules/bigquery_datasets_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   project = var.project_id
   bigquery_datasets = [

diff --git a/examples/billing_account/main.tf b/examples/billing_account/main.tf
@@ -35,7 +35,7 @@ locals {
  *****************************************/
 module "billing-account-iam" {
   source  = "terraform-google-modules/iam/google//modules/billing_accounts_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   billing_account_ids = [var.billing_account_id]
 

diff --git a/examples/cloud_run_service/main.tf b/examples/cloud_run_service/main.tf
@@ -20,7 +20,7 @@
 
 module "cloud_run_service_iam_binding" {
   source  = "terraform-google-modules/iam/google//modules/cloud_run_services_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   project            = var.cloud_run_service_project
   location           = var.cloud_run_service_location

diff --git a/examples/custom_role_org/main.tf b/examples/custom_role_org/main.tf
@@ -23,7 +23,7 @@ resource "random_id" "rand_custom_id" {
  *****************************************/
 module "custom-roles-org" {
   source  = "terraform-google-modules/iam/google//modules/custom_role_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   target_level         = "org"
   target_id            = var.org_id

diff --git a/examples/custom_role_project/main.tf b/examples/custom_role_project/main.tf
@@ -19,7 +19,7 @@
  *****************************************/
 module "custom-role-project" {
   source  = "terraform-google-modules/iam/google//modules/custom_role_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   target_level         = "project"
   target_id            = var.project_id

diff --git a/examples/dns_zone/main.tf b/examples/dns_zone/main.tf
@@ -19,7 +19,7 @@
  *********************************************/
 module "dns_zones_iam_binding" {
   source  = "terraform-google-modules/iam/google//modules/dns_zones_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   project = var.project_id
   managed_zones = [

diff --git a/examples/folder/main.tf b/examples/folder/main.tf
@@ -19,7 +19,7 @@
  *****************************************/
 module "folder-iam" {
   source  = "terraform-google-modules/iam/google//modules/folders_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   folders = [var.folder_one, var.folder_two]
 

diff --git a/examples/kms_crypto_key/main.tf b/examples/kms_crypto_key/main.tf
@@ -19,7 +19,7 @@
  *****************************************/
 module "kms_crypto_key_iam_binding" {
   source  = "terraform-google-modules/iam/google//modules/kms_crypto_keys_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   kms_crypto_keys = [var.kms_crypto_key_one, var.kms_crypto_key_two]
 

diff --git a/examples/kms_key_ring/main.tf b/examples/kms_key_ring/main.tf
@@ -19,7 +19,7 @@
  *****************************************/
 module "kms_key_ring_iam_binding" {
   source  = "terraform-google-modules/iam/google//modules/kms_key_rings_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   kms_key_rings = [var.kms_key_ring_one, var.kms_key_ring_two]
   mode          = "additive"

diff --git a/examples/member_iam/main.tf b/examples/member_iam/main.tf
@@ -22,7 +22,7 @@ resource "google_service_account" "member_iam_test" {
 
 module "member_roles" {
   source  = "terraform-google-modules/iam/google//modules/member_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   service_account_address = google_service_account.member_iam_test.email
   project_id              = var.project_id

diff --git a/examples/organization/main.tf b/examples/organization/main.tf
@@ -19,7 +19,7 @@
  *****************************************/
 module "organization_iam_binding" {
   source  = "terraform-google-modules/iam/google//modules/organizations_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   organizations = [var.organization_one, var.organization_two]
   mode          = "authoritative"

diff --git a/examples/privileged_access_manager/README.md b/examples/privileged_access_manager/README.md
@@ -0,0 +1,16 @@
+# DNS ZOne Example
+
+This example illustrates how to use the `privileged_access_manager` submodule
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| project\_id | Project ID to create BigQuery resources in | `string` | n/a | yes |
+
+## Outputs
+
+No outputs.
+
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/examples/privileged_access_manager/main.tf b/examples/privileged_access_manager/main.tf
@@ -0,0 +1,39 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module "entitlement" {
+  source  = "terraform-google-modules/iam/google//modules/privileged_access_manager"
+  version = "~> 8.0"
+
+  entitlement_id = "example-entitlement"
+  parent_id      = var.project_id
+  parent_type    = "project"
+  entitlement_requesters = [
+    "user:requester@example.com",
+  ]
+  entitlement_approvers = [
+    "user:approver@example.com",
+  ]
+  role_bindings = [
+    {
+      role                 = "roles/storage.admin"
+      condition_expression = "request.time < timestamp(\"2024-04-23T18:30:00.000Z\")"
+    },
+    {
+      role = "roles/bigquery.admin"
+    }
+  ]
+}
diff --git a/examples/privileged_access_manager/variables.tf b/examples/privileged_access_manager/variables.tf
@@ -0,0 +1,20 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "project_id" {
+  type        = string
+  description = "Project ID to create BigQuery resources in"
+}
diff --git a/examples/project/main.tf b/examples/project/main.tf
@@ -19,7 +19,7 @@
  *****************************************/
 module "project_iam_binding" {
   source  = "terraform-google-modules/iam/google//modules/projects_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   projects = [var.project_one, var.project_two]
   mode     = "additive"

diff --git a/examples/project_conditions/main.tf b/examples/project_conditions/main.tf
@@ -19,7 +19,7 @@
  *****************************************/
 module "project_iam_binding" {
   source  = "terraform-google-modules/iam/google//modules/projects_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   projects = [var.project_one, var.project_two]
   mode     = "additive"

diff --git a/examples/pubsub_subscription/main.tf b/examples/pubsub_subscription/main.tf
@@ -19,7 +19,7 @@
  *****************************************/
 module "pubsub_subscription_iam_binding" {
   source  = "terraform-google-modules/iam/google//modules/pubsub_subscriptions_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   project              = var.pubsub_subscription_project
   pubsub_subscriptions = [var.pubsub_subscription_one, var.pubsub_subscription_two]

diff --git a/examples/pubsub_topic/main.tf b/examples/pubsub_topic/main.tf
@@ -19,7 +19,7 @@
  *****************************************/
 module "pubsub_topic_iam_binding" {
   source  = "terraform-google-modules/iam/google//modules/pubsub_topics_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   project       = var.pubsub_topic_project
   pubsub_topics = [var.pubsub_topic_one, var.pubsub_topic_two]

diff --git a/examples/secret_manager/main.tf b/examples/secret_manager/main.tf
@@ -19,7 +19,7 @@
  *****************************************/
 module "folder-iam" {
   source  = "terraform-google-modules/iam/google//modules/secret_manager_iam"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   project = var.project_id
   secrets = [var.secret_one, var.secret_two]

diff --git a/examples/secure_source_manager/README.md b/examples/secure_source_manager/README.md
@@ -0,0 +1,22 @@
+# DNS ZOne Example
+
+This example illustrates how to use the `privileged_access_manager` submodule
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| group\_email | Email for group to receive roles (ex. group@example.com) | `string` | n/a | yes |
+| project\_id | Project ID to create BigQuery resources in | `string` | n/a | yes |
+| sa\_email | Email for Service Account to receive roles (Ex. default-sa@example-project-id.iam.gserviceaccount.com) | `string` | n/a | yes |
+| user\_email | Email for user to receive roles (Ex. user@example.com) | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| instance\_id | SSM Instance ID |
+| repository\_id | SSM repository ID |
+
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/examples/secure_source_manager/main.tf b/examples/secure_source_manager/main.tf
@@ -0,0 +1,91 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+resource "google_secure_source_manager_instance" "default" {
+  location    = "us-central1"
+  instance_id = "ssm-instance"
+  project     = var.project_id
+}
+
+resource "google_secure_source_manager_repository" "default" {
+  project       = var.project_id
+  location      = "us-central1"
+  repository_id = "ssm-repo1"
+  instance      = google_secure_source_manager_instance.default.name
+
+  description = "test repository"
+  initial_config {
+    default_branch = "main"
+  }
+}
+
+module "ssm_instance_iam_binding" {
+  source  = "terraform-google-modules/iam/google//modules/secure_source_manager_iam"
+  version = "~> 8.0"
+
+  project  = var.project_id
+  location = "us-central1"
+
+  entity_ids = {
+    instance_ids = [google_secure_source_manager_instance.default.instance_id]
+  }
+
+  mode = "additive"
+
+  bindings = {
+    "roles/securesourcemanager.instanceAccessor" = [
+      "serviceAccount:${var.sa_email}",
+      "group:${var.group_email}",
+      "user:${var.user_email}",
+    ]
+    "roles/securesourcemanager.instanceManager" = [
+      "serviceAccount:${var.sa_email}",
+      "group:${var.group_email}",
+      "user:${var.user_email}",
+    ]
+  }
+
+  depends_on = [google_secure_source_manager_instance.default]
+}
+
+module "ssm_repository_iam_binding" {
+  source  = "terraform-google-modules/iam/google//modules/secure_source_manager_iam"
+  version = "~> 8.0"
+
+  project  = var.project_id
+  location = "us-central1"
+
+  entity_ids = {
+    repository_ids = [google_secure_source_manager_repository.default.repository_id]
+  }
+
+  mode = "additive"
+
+  bindings = {
+    "roles/securesourcemanager.repoReader" = [
+      "serviceAccount:${var.sa_email}",
+      "group:${var.group_email}",
+      "user:${var.user_email}",
+    ]
+    "roles/securesourcemanager.repoWriter" = [
+      "serviceAccount:${var.sa_email}",
+      "group:${var.group_email}",
+      "user:${var.user_email}",
+    ]
+  }
+
+  depends_on = [google_secure_source_manager_repository.default]
+}
diff --git a/examples/secure_source_manager/outputs.tf b/examples/secure_source_manager/outputs.tf
@@ -0,0 +1,25 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+output "instance_id" {
+  value       = google_secure_source_manager_instance.default.instance_id
+  description = "SSM Instance ID"
+}
+
+output "repository_id" {
+  value       = google_secure_source_manager_repository.default.repository_id
+  description = "SSM repository ID"
+}
diff --git a/examples/secure_source_manager/variables.tf b/examples/secure_source_manager/variables.tf
@@ -0,0 +1,35 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "group_email" {
+  type        = string
+  description = "Email for group to receive roles (ex. group@example.com)"
+}
+
+variable "sa_email" {
+  type        = string
+  description = "Email for Service Account to receive roles (Ex. default-sa@example-project-id.iam.gserviceaccount.com)"
+}
+
+variable "user_email" {
+  type        = string
+  description = "Email for user to receive roles (Ex. user@example.com)"
+}
+
+variable "project_id" {
+  type        = string
+  description = "Project ID to create BigQuery resources in"
+}