-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #2 from mineiros-io/sameh-artifact-registry-repo-iam
feat: google-artifact-registry-repository-iam
- Loading branch information
Showing
5 changed files
with
231 additions
and
72 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| resource "google_artifact_registry_repository_iam_binding" "binding" { | ||
| provider = google-beta | ||
| count = var.module_enabled && var.policy_bindings == null && var.authoritative ? 1 : 0 | ||
|
|
||
| repository = var.repository | ||
| location = var.location | ||
| role = var.role | ||
| members = var.members | ||
| project = var.project | ||
|
|
||
| depends_on = [var.module_depends_on] | ||
| } | ||
|
|
||
| resource "google_artifact_registry_repository_iam_member" "member" { | ||
| provider = google-beta | ||
| for_each = var.module_enabled && var.policy_bindings == null && var.authoritative == false ? var.members : [] | ||
|
|
||
| repository = var.repository | ||
| location = var.location | ||
| role = var.role | ||
| member = each.value | ||
| project = var.project | ||
|
|
||
| depends_on = [var.module_depends_on] | ||
| } | ||
|
|
||
| resource "google_artifact_registry_repository_iam_policy" "policy" { | ||
| provider = google-beta | ||
| count = var.module_enabled && var.policy_bindings != null ? 1 : 0 | ||
|
|
||
| repository = var.repository | ||
| location = var.location | ||
| policy_data = data.google_iam_policy.policy[0].policy_data | ||
| project = var.project | ||
|
|
||
| depends_on = [var.module_depends_on] | ||
| } | ||
|
|
||
| data "google_iam_policy" "policy" { | ||
| count = var.module_enabled && var.policy_bindings != null ? 1 : 0 | ||
|
|
||
| dynamic "binding" { | ||
| for_each = var.policy_bindings | ||
|
|
||
| content { | ||
| role = binding.value.role | ||
| members = try(binding.value.members, var.members) | ||
|
|
||
| dynamic "condition" { | ||
| for_each = try([binding.value.condition], []) | ||
|
|
||
| content { | ||
| expression = condition.value.expression | ||
| title = condition.value.title | ||
| description = try(condition.value.description, null) | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| locals { | ||
| binding = try(google_artifact_registry_repository_iam_binding.binding[0], null) | ||
| member = try(google_artifact_registry_repository_iam_member.member, null) | ||
| policy = try(google_artifact_registry_repository_iam_policy.policy[0], null) | ||
|
|
||
| iam_output = [local.binding, local.member, local.policy] | ||
|
|
||
| iam_output_index = var.policy_bindings != null ? 2 : var.authoritative ? 0 : 1 | ||
| } | ||
|
|
||
| output "iam" { | ||
| description = "All attributes of the created 'iam_binding' or 'iam_member' or 'iam_policy' resource according to the mode." | ||
| value = local.iam_output[local.iam_output_index] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| # --------------------------------------------------------------------------------------------------------------------- | ||
| # REQUIRED VARIABLES | ||
| # These variables must be set when using this module. | ||
| # --------------------------------------------------------------------------------------------------------------------- | ||
|
|
||
| variable "repository" { | ||
| description = "(Required) Used to find the parent resource to bind the IAM policy to." | ||
| type = string | ||
| } | ||
|
|
||
| variable "location" { | ||
| description = "(Required) The name of the location this repository is located in. Used to find the parent resource to bind the IAM policy to." | ||
| type = string | ||
| } | ||
|
|
||
| # --------------------------------------------------------------------------------------------------------------------- | ||
| # OPTIONAL VARIABLES | ||
| # These variables have defaults, but may be overridden. | ||
| # --------------------------------------------------------------------------------------------------------------------- | ||
|
|
||
| variable "members" { | ||
| type = set(string) | ||
| description = "(Optional) Identities that will be granted the privilege in role. Each entry can have one of the following values: 'allUsers', 'allAuthenticatedUsers', 'user:{emailid}', 'serviceAccount:{emailid}', 'group:{emailid}', 'domain:{domain}', 'projectOwner:projectid', 'projectEditor:projectid', 'projectViewer:projectid'." | ||
| default = [] | ||
| } | ||
|
|
||
| variable "role" { | ||
| description = "(Optional) The role that should be applied. Only one 'iam_binding' can be used per role. Note that custom roles must be of the format '[projects|organizations]/{parent-name}/roles/{role-name}'." | ||
| type = string | ||
| default = null | ||
| } | ||
|
|
||
| variable "authoritative" { | ||
| description = "(Optional) Whether to exclusively set (authoritative mode) or add (non-authoritative/additive mode) members to the role." | ||
| type = bool | ||
| default = true | ||
| } | ||
|
|
||
| variable "policy_bindings" { | ||
| description = "(Optional) A list of IAM policy bindings." | ||
| type = any | ||
| default = null | ||
| } | ||
|
|
||
| variable "project" { | ||
| description = "(Optional) The ID of the project in which the resource belongs. If it is not provided, the provider project is used." | ||
| type = string | ||
| default = null | ||
| } | ||
|
|
||
| # ------------------------------------------------------------------------------ | ||
| # MODULE CONFIGURATION PARAMETERS | ||
| # These variables are used to configure the module. | ||
| # ------------------------------------------------------------------------------ | ||
|
|
||
| variable "module_enabled" { | ||
| type = bool | ||
| description = "(Optional) Whether to create resources within the module or not. Default is 'true'." | ||
| default = true | ||
| } | ||
|
|
||
| variable "module_depends_on" { | ||
| type = any | ||
| description = "(Optional) A list of external resources the module depends_on. Default is '[]'." | ||
| default = [] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| terraform { | ||
| required_version = ">= 0.14, < 2.0" | ||
|
|
||
| required_providers { | ||
| google-beta = "~> 3.75" | ||
| } | ||
| } |