From 854e52cf416e25a62b889ce416ec38ef3b033a91 Mon Sep 17 00:00:00 2001 From: samen93 Date: Tue, 19 Oct 2021 15:39:56 +0200 Subject: [PATCH] feat: terraform-google-artifact-registry-repository-iam --- README.md | 156 +++++++++++++++++++++++++++------------------------ main.tf | 60 ++++++++++++++++++++ outputs.tf | 14 +++++ variables.tf | 66 ++++++++++++++++++++++ versions.tf | 7 +++ 5 files changed, 231 insertions(+), 72 deletions(-) create mode 100644 main.tf create mode 100644 outputs.tf create mode 100644 variables.tf create mode 100644 versions.tf diff --git a/README.md b/README.md index 781657e..8619032 100644 --- a/README.md +++ b/README.md @@ -34,40 +34,12 @@ secure, and production-grade cloud infrastructure. ## Module Features - - This module implements the following terraform resources -- `google_resource` -- `google_something_else` - -and supports additional features of the following modules: - - -- [mineiros-io/something/google](https://github.com/mineiros-io/terraform-google-something) - - - +- `google_artifact_registry_repository_iam_binding` +- `google_artifact_registry_repository_iam_member` +- `google_artifact_registry_repository_iam_policy` +- `google_iam_policy` ## Getting Started @@ -76,6 +48,11 @@ Most basic usage just setting required arguments: ```hcl module "terraform-google-artifact-registry-repository-iam" { source = "github.com/mineiros-io/terraform-google-artifact-registry-repository-iam?ref=v0.1.0" + + repository = "my-repository" + location = "us-central1" + role = "roles/viewer" + members = ["user:member@example.com"] } ``` @@ -107,58 +84,91 @@ See [variables.tf] and [examples/] for details and use-cases. #### Main Resource Configuration - + Identities that will be granted the privilege in role. Each entry can have one of the following values: + - `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. + - `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. + - `user:{emailid}`: An email address that represents a specific Google account. For example, alice@gmail.com or joe@example.com. + - `serviceAccount:{emailid}`: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com. + - `group:{emailid}`: An email address that represents a Google group. For example, admins@example.com. + - `domain:{domain}`: A G Suite domain (primary, instead of alias) name that represents all the users of that domain. For example, google.com or example.com. - + The resource name of the project the policy is attached to. Its format is `projects/{project_id}`. - + - **`expression`**: **_(Required `string`)_** + + Textual representation of an expression in Common Expression Language syntax. + + - **`title`**: **_(Required `string`)_** + + A title for the expression, i.e. a short string describing its purpose. + + - **`description`**: _(Optional `string`)_ + + An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. #### Extended Resource Configuration @@ -170,18 +180,20 @@ The following attributes are exported in the outputs of the module: Whether this module is enabled. - +- **`iam`** + + All attributes of the created `iam_binding` or `iam_member` or `iam_policy` resource according to the mode. ## External Documentation ### Google Documentation - - https://link-to-docs + - https://cloud.google.com/artifact-registry ### Terraform Google Provider Documentation: - - https://www.terraform.io/docs/providers/google/r/something.html + - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/artifact_registry_repository_iam ## Module Versioning @@ -241,7 +253,7 @@ Copyright © 2020-2021 [Mineiros GmbH][homepage] -[badge-build]: https://github.com/mineiros-io/terraform-google-premium-modules/workflows/Tests/badge.svg +[badge-build]: https://github.com/mineiros-io/terraform-google-artifact-registry-repository-iam/workflows/Tests/badge.svg @@ -252,8 +264,8 @@ Copyright © 2020-2021 [Mineiros GmbH][homepage] -[build-status]: https://github.com/mineiros-io/terraform-google-premium-modules/modules/terraform-google-artifact-registry-repository-iam/actions -[releases-github]: https://github.com/mineiros-io/terraform-google-premium-modules/modules/terraform-google-artifact-registry-repository-iam/releases +[build-status]: https://github.com/mineiros-io/terraform-google-artifact-registry-repository-iam/actions +[releases-github]: https://github.com/mineiros-io/terraform-google-artifact-registry-repository-iam/releases @@ -268,12 +280,12 @@ Copyright © 2020-2021 [Mineiros GmbH][homepage] -[variables.tf]: https://github.com/mineiros-io/terraform-google-premium-modules/blob/modules/terraform-google-artifact-registry-repository-iam/main/variables.tf -[examples/]: https://github.com/mineiros-io/terraform-google-premium-modules/blob/modules/terraform-google-artifact-registry-repository-iam/main/examples -[issues]: https://github.com/mineiros-io/terraform-google-premium-modules/issues -[license]: https://github.com/mineiros-io/terraform-google-premium-modules/blob/main/LICENSE -[makefile]: https://github.com/mineiros-io/terraform-google-premium-modules/blob/main/Makefile -[pull requests]: https://github.com/mineiros-io/terraform-google-premium-modules/pulls -[contribution guidelines]: https://github.com/mineiros-io/terraform-google-premium-modules/blob/main/CONTRIBUTING.md +[variables.tf]: https://github.com/mineiros-io/terraform-google-artifact-registry-repository-iam/main/variables.tf +[examples/]: https://github.com/mineiros-io/terraform-google-artifact-registry-repository-iam/main/examples +[issues]: https://github.com/mineiros-io/terraform-google-artifact-registry-repository-iam/issues +[license]: https://github.com/mineiros-io/terraform-google-artifact-registry-repository-iam/blob/main/LICENSE +[makefile]: https://github.com/mineiros-io/terraform-google-artifact-registry-repository-iam/blob/main/Makefile +[pull requests]: https://github.com/mineiros-io/terraform-google-artifact-registry-repository-iam/pulls +[contribution guidelines]: https://github.com/mineiros-io/terraform-google-artifact-registry-repository-iam/blob/main/CONTRIBUTING.md diff --git a/main.tf b/main.tf new file mode 100644 index 0000000..4c3beb9 --- /dev/null +++ b/main.tf @@ -0,0 +1,60 @@ +resource "google_artifact_registry_repository_iam_binding" "binding" { + provider = google-beta + count = var.module_enabled && var.policy_bindings == null && var.authoritative ? 1 : 0 + + repository = var.repository + location = var.location + role = var.role + members = var.members + project = var.project + + depends_on = [var.module_depends_on] +} + +resource "google_artifact_registry_repository_iam_member" "member" { + provider = google-beta + for_each = var.module_enabled && var.policy_bindings == null && var.authoritative == false ? var.members : [] + + repository = var.repository + location = var.location + role = var.role + member = each.value + project = var.project + + depends_on = [var.module_depends_on] +} + +resource "google_artifact_registry_repository_iam_policy" "policy" { + provider = google-beta + count = var.module_enabled && var.policy_bindings != null ? 1 : 0 + + repository = var.repository + location = var.location + policy_data = data.google_iam_policy.policy[0].policy_data + project = var.project + + depends_on = [var.module_depends_on] +} + +data "google_iam_policy" "policy" { + count = var.module_enabled && var.policy_bindings != null ? 1 : 0 + + dynamic "binding" { + for_each = var.policy_bindings + + content { + role = binding.value.role + members = try(binding.value.members, var.members) + + dynamic "condition" { + for_each = try([binding.value.condition], []) + + content { + expression = condition.value.expression + title = condition.value.title + description = try(condition.value.description, null) + } + } + } + } +} diff --git a/outputs.tf b/outputs.tf new file mode 100644 index 0000000..7ff8414 --- /dev/null +++ b/outputs.tf @@ -0,0 +1,14 @@ +locals { + binding = try(google_artifact_registry_repository_iam_binding.binding[0], null) + member = try(google_artifact_registry_repository_iam_member.member, null) + policy = try(google_artifact_registry_repository_iam_policy.policy[0], null) + + iam_output = [local.binding, local.member, local.policy] + + iam_output_index = var.policy_bindings != null ? 2 : var.authoritative ? 0 : 1 +} + +output "iam" { + description = "All attributes of the created 'iam_binding' or 'iam_member' or 'iam_policy' resource according to the mode." + value = local.iam_output[local.iam_output_index] +} diff --git a/variables.tf b/variables.tf new file mode 100644 index 0000000..aab8771 --- /dev/null +++ b/variables.tf @@ -0,0 +1,66 @@ +# --------------------------------------------------------------------------------------------------------------------- +# REQUIRED VARIABLES +# These variables must be set when using this module. +# --------------------------------------------------------------------------------------------------------------------- + +variable "repository" { + description = "(Required) Used to find the parent resource to bind the IAM policy to." + type = string +} + +variable "location" { + description = "(Required) The name of the location this repository is located in. Used to find the parent resource to bind the IAM policy to." + type = string +} + +# --------------------------------------------------------------------------------------------------------------------- +# OPTIONAL VARIABLES +# These variables have defaults, but may be overridden. +# --------------------------------------------------------------------------------------------------------------------- + +variable "members" { + type = set(string) + description = "(Optional) Identities that will be granted the privilege in role. Each entry can have one of the following values: 'allUsers', 'allAuthenticatedUsers', 'user:{emailid}', 'serviceAccount:{emailid}', 'group:{emailid}', 'domain:{domain}', 'projectOwner:projectid', 'projectEditor:projectid', 'projectViewer:projectid'." + default = [] +} + +variable "role" { + description = "(Optional) The role that should be applied. Only one 'iam_binding' can be used per role. Note that custom roles must be of the format '[projects|organizations]/{parent-name}/roles/{role-name}'." + type = string + default = null +} + +variable "authoritative" { + description = "(Optional) Whether to exclusively set (authoritative mode) or add (non-authoritative/additive mode) members to the role." + type = bool + default = true +} + +variable "policy_bindings" { + description = "(Optional) A list of IAM policy bindings." + type = any + default = null +} + +variable "project" { + description = "(Optional) The ID of the project in which the resource belongs. If it is not provided, the provider project is used." + type = string + default = null +} + +# ------------------------------------------------------------------------------ +# MODULE CONFIGURATION PARAMETERS +# These variables are used to configure the module. +# ------------------------------------------------------------------------------ + +variable "module_enabled" { + type = bool + description = "(Optional) Whether to create resources within the module or not. Default is 'true'." + default = true +} + +variable "module_depends_on" { + type = any + description = "(Optional) A list of external resources the module depends_on. Default is '[]'." + default = [] +} diff --git a/versions.tf b/versions.tf new file mode 100644 index 0000000..c4f0116 --- /dev/null +++ b/versions.tf @@ -0,0 +1,7 @@ +terraform { + required_version = ">= 0.14, < 2.0" + + required_providers { + google-beta = "~> 3.75" + } +}