Skip to content

Commit 11d117b

Browse files
ludooludoo
committed
initial import from internal modules
1 parent 4e933ac commit 11d117b

File tree

12 files changed

+331
-53
lines changed

12 files changed

+331
-53
lines changed

‎README.md‎

Lines changed: 42 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,14 @@
1-
# terraform-google-service-accounts
1+
# Terraform Service Accounts Module
22

3-
This module was generated from [terraform-google-module-template](https://github.com/terraform-google-modules/terraform-google-module-template/), which by default generates a module that simply creates a GCS bucket. As the module develops, this README should be updated.
3+
This module allows easy creation of one or more service accounts, and granting them basic roles.
44

55
The resources/services/activations/deletions that this module will create/trigger are:
66

7-
- Create a GCS bucket with the provided name
7+
- one or more service accounts
8+
- optional project-level IAM role bindings for each service account
9+
- one optional billing IAM role binding per service account, at the organization or billing account level
10+
- two optional organization-level IAM bindings per service account, to enable the service accounts to create and manage Shared VPC networks
11+
- one optional service account key per service account
812

913
## Usage
1014

@@ -14,9 +18,13 @@ Basic usage of this module is as follows:
1418
module "service_accounts" {
1519
source = "terraform-google-modules/service-accounts/google"
1620
version = "~> 0.1"
17-
1821
project_id = "<PROJECT ID>"
19-
bucket_name = "gcs-test-bucket"
22+
prefix = ""
23+
names = ["test-first", "test-second"]
24+
project_roles = [
25+
"project-foo=>roles/viewer",
26+
"project-spam=>roles/storage.objectViewer",
27+
]
2028
}
2129
```
2230

@@ -25,6 +33,30 @@ Functional examples are included in the
2533

2634
[^]: (autogen_docs_start)
2735

36+
## Inputs
37+
38+
| Name | Description | Type | Default | Required |
39+
|------|-------------|:----:|:-----:|:-----:|
40+
| billing\_account\_id | If assigning billing role, specificy a billing account (default is to assign at the organizational level). | string | `""` | no |
41+
| generate\_keys | Generate keys for service accounts. | string | `"false"` | no |
42+
| grant\_billing\_role | Grant billing user role. | string | `"false"` | no |
43+
| grant\_xpn\_roles | Grant roles for shared VPC management. | string | `"true"` | no |
44+
| names | Names of the service accounts to create. | list | `<list>` | no |
45+
| org\_id | Id of the organization for org-level roles. | string | `""` | no |
46+
| prefix | Prefix applied to service account names. | string | `""` | no |
47+
| project\_id | Project id where service account will be created. | string | n/a | yes |
48+
| project\_roles | Common roles to apply to all service accounts, project=>role as elements. | list | `<list>` | no |
49+
50+
## Outputs
51+
52+
| Name | Description |
53+
|------|-------------|
54+
| email | Service account email (single-use case). |
55+
| emails | Map of service account emails. |
56+
| iam\_email | IAM-format service account email (single-use case). |
57+
| iam\_emails | IAM-format service account emails. |
58+
| keys | Map of service account keys. |
59+
2860
[^]: (autogen_docs_end)
2961

3062
## Requirements
@@ -36,28 +68,14 @@ These sections describe requirements for using this module.
3668
The following dependencies must be available:
3769

3870
- [Terraform][terraform] v0.11
39-
- [Terraform Provider for GCP][terraform-provider-gcp] plugin v2.0
40-
41-
### Service Account
42-
43-
A service account with the following roles must be used to provision
44-
the resources of this module:
45-
46-
- Storage Admin: `roles/storage.admin`
47-
48-
The [Project Factory module][project-factory-module] and the
49-
[IAM module][iam-module] may be used in combination to provision a
50-
service account with the necessary roles applied.
51-
52-
### APIs
71+
- [Terraform Provider for GCP][terraform-provider-gcp] plugin >= v2.0
5372

54-
A project with the following APIs enabled must be used to host the
55-
resources of this module:
73+
### IAM
5674

57-
- Google Cloud Storage JSON API: `storage-api.googleapis.com`
75+
Service account or user credentials with the following roles must be used to provision the resources of this module:
5876

59-
The [Project Factory module][project-factory-module] can be used to
60-
provision a project with the necessary APIs enabled.
77+
- Service Account Admin: `roles/iam.serviceAccountAdmin`
78+
- roles needed to grant optional IAM roles at the project or organizational level
6179

6280
## Contributing
6381

‎examples/multiple_service_accounts/README.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Simple Example
2+
3+
This example illustrates how to use the `service-accounts` module.
4+
5+
[^]: (autogen_docs_start)
6+
7+
## Inputs
8+
9+
| Name | Description | Type | Default | Required |
10+
|------|-------------|:----:|:-----:|:-----:|
11+
| project\_id | The ID of the project in which to provision resources. | string | n/a | yes |
12+
13+
## Outputs
14+
15+
| Name | Description |
16+
|------|-------------|
17+
| emails | The service account emails. |
18+
| iam\_emails | The service account IAM-format emails. |
19+
| keys | The service account keys. |
20+
21+
[^]: (autogen_docs_end)
22+
23+
To provision this example, run the following from within this directory:
24+
- `terraform init` to get the plugins
25+
- `terraform plan` to see the infrastructure plan
26+
- `terraform apply` to apply the infrastructure build
27+
- `terraform destroy` to destroy the built infrastructure

‎examples/multiple_service_accounts/main.tf‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
provider "google" {
18+
version = "~> 2.7.0"
19+
}
20+
21+
module "service_accounts" {
22+
source = "../.."
23+
project_id = "${var.project_id}"
24+
prefix = ""
25+
names = ["test-first", "test-second"]
26+
generate_keys = true
27+
28+
project_roles = [
29+
"${var.project_id}=>roles/viewer",
30+
"${var.project_id}=>roles/storage.objectViewer",
31+
]
32+
}

‎examples/multiple_service_accounts/outputs.tf‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "emails" {
18+
description = "The service account emails."
19+
value = "${values(module.service_accounts.emails)}"
20+
}
21+
22+
output "iam_emails" {
23+
description = "The service account IAM-format emails."
24+
value = "${values(module.service_accounts.iam_emails)}"
25+
}
26+
27+
output "keys" {
28+
description = "The service account keys."
29+
value = "${module.service_accounts.keys}"
30+
}

‎examples/simple_example/variables.tf‎ renamed to ‎examples/multiple_service_accounts/variables.tf‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2018 Google LLC
2+
* Copyright 2019 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -18,8 +18,3 @@ variable "project_id" {
1818
description = "The ID of the project in which to provision resources."
1919
type = "string"
2020
}
21-
22-
variable "bucket_name" {
23-
description = "The name of the bucket to create."
24-
type = "string"
25-
}

‎examples/simple_example/README.md‎ renamed to ‎examples/single_service_account/README.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,19 @@ This example illustrates how to use the `service-accounts` module.
44

55
[^]: (autogen_docs_start)
66

7+
## Inputs
8+
9+
| Name | Description | Type | Default | Required |
10+
|------|-------------|:----:|:-----:|:-----:|
11+
| project\_id | The ID of the project in which to provision resources. | string | n/a | yes |
12+
13+
## Outputs
14+
15+
| Name | Description |
16+
|------|-------------|
17+
| email | The service account email. |
18+
| iam\_email | The service account IAM-format email. |
19+
720
[^]: (autogen_docs_end)
821

922
To provision this example, run the following from within this directory:

‎examples/simple_example/main.tf‎ renamed to ‎examples/single_service_account/main.tf‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2018 Google LLC
2+
* Copyright 2019 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -15,12 +15,13 @@
1515
*/
1616

1717
provider "google" {
18-
version = "~> 2.0"
18+
version = "~> 2.7.0"
1919
}
2020

2121
module "service_accounts" {
22-
source = "../.."
23-
24-
project_id = "${var.project_id}"
25-
bucket_name = "${var.bucket_name}"
22+
source = "../.."
23+
project_id = "${var.project_id}"
24+
prefix = "single-test"
25+
names = ["first"]
26+
project_roles = ["${var.project_id}=>roles/viewer"]
2627
}

‎examples/single_service_account/outputs.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "email" {
18+
description = "The service account email."
19+
value = "${module.service_accounts.email}"
20+
}
21+
22+
output "iam_email" {
23+
description = "The service account IAM-format email."
24+
value = "${module.service_accounts.iam_email}"
25+
}

‎examples/simple_example/outputs.tf‎ renamed to ‎examples/single_service_account/variables.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2018 Google LLC
2+
* Copyright 2019 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -14,7 +14,7 @@
1414
* limitations under the License.
1515
*/
1616

17-
output "bucket_name" {
18-
description = "The name of the bucket."
19-
value = "${module.service_accounts.bucket_name}"
17+
variable "project_id" {
18+
description = "The ID of the project in which to provision resources."
19+
type = "string"
2020
}

‎main.tf‎

Lines changed: 69 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2018 Google LLC
2+
* Copyright 2019 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -14,11 +14,74 @@
1414
* limitations under the License.
1515
*/
1616

17-
terraform {
18-
required_version = "~> 0.11.0"
17+
locals {
18+
account_billing = "${var.grant_billing_role && var.billing_account_id != ""}"
19+
org_billing = "${var.grant_billing_role && var.billing_account_id == "" && var.org_id != ""}"
20+
prefix = "${var.prefix != "" ? "${var.prefix}-" : ""}"
21+
xpn = "${var.grant_xpn_roles && var.org_id != ""}"
1922
}
2023

21-
resource "google_storage_bucket" "main" {
22-
project = "${var.project_id}"
23-
name = "${var.bucket_name}"
24+
# create service accounts
25+
resource "google_service_account" "service_accounts" {
26+
count = "${length(var.names)}"
27+
account_id = "${local.prefix}${lower(element(var.names, count.index))}"
28+
display_name = "Terraform-managed service account"
29+
project = "${var.project_id}"
30+
}
31+
32+
# common roles
33+
resource "google_project_iam_member" "project-roles" {
34+
count = "${length(var.project_roles) * length(var.names)}"
35+
36+
project = "${element(
37+
split("=>", element(var.project_roles, count.index % length(var.names))
38+
), 0)}"
39+
40+
role = "${element(
41+
split("=>", element(var.project_roles, count.index % length(var.names))
42+
), 1)}"
43+
44+
member = "serviceAccount:${element(
45+
google_service_account.service_accounts.*.email,
46+
count.index / length(var.project_roles)
47+
)}"
48+
}
49+
50+
# conditionally assign billing user role at the org level
51+
resource "google_organization_iam_member" "billing_user" {
52+
count = "${local.org_billing ? length(var.names) : 0}"
53+
org_id = "${var.org_id}"
54+
role = "roles/billing.user"
55+
member = "serviceAccount:${element(google_service_account.service_accounts.*.email, count.index)}"
56+
}
57+
58+
# conditionally assign billing user role on a specific billing account
59+
resource "google_billing_account_iam_member" "billing_user" {
60+
count = "${local.account_billing ? length(var.names) : 0}"
61+
billing_account_id = "${var.billing_account_id}"
62+
role = "roles/billing.user"
63+
member = "serviceAccount:${element(google_service_account.service_accounts.*.email, count.index)}"
64+
}
65+
66+
# conditionally assign roles for shared VPC
67+
# ref: https://cloud.google.com/vpc/docs/shared-vpc
68+
69+
resource "google_organization_iam_member" "xpn_admin" {
70+
count = "${local.xpn ? length(var.names) : 0}"
71+
org_id = "${var.org_id}"
72+
role = "roles/compute.xpnAdmin"
73+
member = "serviceAccount:${element(google_service_account.service_accounts.*.email, count.index)}"
74+
}
75+
76+
resource "google_organization_iam_member" "organization_viewer" {
77+
count = "${local.xpn ? length(var.names) : 0}"
78+
org_id = "${var.org_id}"
79+
role = "roles/resourcemanager.organizationViewer"
80+
member = "serviceAccount:${element(google_service_account.service_accounts.*.email, count.index)}"
81+
}
82+
83+
# keys
84+
resource "google_service_account_key" "keys" {
85+
count = "${var.generate_keys ? length(var.names) : 0}"
86+
service_account_id = "${element(google_service_account.service_accounts.*.email, count.index)}"
2487
}

0 commit comments

Comments
 (0)