Skip to content

Commit 37f42a9

Browse files
committed
added vpc sc dry run mode option
1 parent 0787fa9 commit 37f42a9

File tree

8 files changed

+45
-13
lines changed

8 files changed

+45
-13
lines changed

README.md

+6-5
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ To include G Suite integration for creating groups and adding Service Accounts i
1212

1313
## Compatibility
1414

15-
This module is meant for use with Terraform 0.13+ and tested using Terraform 1.0+. If you find incompatibilities using Terraform >=0.13, please open an issue.
15+
This module is meant for use with Terraform 0.13+ and tested using Terraform 1.3+. If you find incompatibilities using Terraform >=0.13, please open an issue.
1616
If you haven't
1717
[upgraded][terraform-0.13-upgrade] and need a Terraform
1818
0.12.x-compatible version of this module, the last released version
@@ -29,7 +29,7 @@ There are multiple examples included in the [examples](./examples/) folder but s
2929
```hcl
3030
module "project-factory" {
3131
source = "terraform-google-modules/project-factory/google"
32-
version = "~> 14.5"
32+
version = "~> 15.0"
3333
3434
name = "pf-test-1"
3535
random_project_id = true
@@ -161,7 +161,8 @@ determining that location is as follows:
161161
| tag\_binding\_values | Tag values to bind the project to. | `list(string)` | `[]` | no |
162162
| usage\_bucket\_name | Name of a GCS bucket to store GCE usage reports in (optional) | `string` | `""` | no |
163163
| usage\_bucket\_prefix | Prefix in the GCS bucket to store GCE usage reports in (optional) | `string` | `""` | no |
164-
| vpc\_service\_control\_attach\_enabled | Whether the project will be attached to a VPC Service Control Perimeter | `bool` | `false` | no |
164+
| vpc\_service\_control\_attach\_dry\_run | Whether the project will be attached to a VPC Service Control Perimeter in Dry Run Mode. vpc\_service\_control\_attach\_enabled should be false for this to be true | `bool` | `false` | no |
165+
| vpc\_service\_control\_attach\_enabled | Whether the project will be attached to a VPC Service Control Perimeter in ENFORCED MODE. vpc\_service\_control\_attach\_dry\_run should be false for this to be true | `bool` | `false` | no |
165166
| vpc\_service\_control\_perimeter\_name | The name of a VPC Service Control Perimeter to add the created project to | `string` | `null` | no |
166167
| vpc\_service\_control\_sleep\_duration | The duration to sleep in seconds before adding the project to a shared VPC after the project is added to the VPC Service Control Perimeter. VPC-SC is eventually consistent. | `string` | `"5s"` | no |
167168

@@ -197,8 +198,8 @@ determining that location is as follows:
197198
- [gcloud sdk](https://cloud.google.com/sdk/install) >= 269.0.0
198199
- [jq](https://stedolan.github.io/jq/) >= 1.6
199200
- [Terraform](https://www.terraform.io/downloads.html) >= 0.13.0
200-
- [terraform-provider-google] plugin ~> 4.11
201-
- [terraform-provider-google-beta] plugin ~> 4.11
201+
- [terraform-provider-google] plugin ~> 5.22
202+
- [terraform-provider-google-beta] plugin ~> 5.22
202203
- [terraform-provider-gsuite] plugin 0.1.x if GSuite functionality is desired
203204

204205
### Permissions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Upgrading to Project Factory v15.0
2+
3+
The v15.0 release of Project Factory is a backwards incompatible release.
4+
5+
### Google Cloud Platform Provider upgrade
6+
7+
The Project Factory module now requires version 5.22 or higher of the Google Cloud Platform Provider and 5.22 or higher of
8+
the Google Cloud Platform Beta Provider.

main.tf

+1
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ module "project-factory" {
6565
default_service_account = var.default_service_account
6666
disable_dependent_services = var.disable_dependent_services
6767
vpc_service_control_attach_enabled = var.vpc_service_control_attach_enabled
68+
vpc_service_control_attach_dry_run = var.vpc_service_control_attach_dry_run
6869
vpc_service_control_perimeter_name = var.vpc_service_control_perimeter_name
6970
vpc_service_control_sleep_duration = var.vpc_service_control_sleep_duration
7071
default_network_tier = var.default_network_tier

modules/core_project_factory/main.tf

+12-2
Original file line numberDiff line numberDiff line change
@@ -345,7 +345,7 @@ resource "google_storage_bucket_iam_member" "api_s_account_storage_admin_on_proj
345345
}
346346

347347
/******************************************
348-
Attachment to VPC Service Control Perimeter
348+
Attachment to VPC Service Control Perimeter in Enforce Mode
349349
*****************************************/
350350
resource "google_access_context_manager_service_perimeter_resource" "service_perimeter_attachment" {
351351
count = var.vpc_service_control_attach_enabled ? 1 : 0
@@ -354,11 +354,21 @@ resource "google_access_context_manager_service_perimeter_resource" "service_per
354354
resource = "projects/${google_project.main.number}"
355355
}
356356

357+
/******************************************
358+
Attachment to VPC Service Control Perimeter in Dry Run Mode
359+
*****************************************/
360+
resource "google_access_context_manager_service_perimeter_dry_run_resource" "service_perimeter_attachment_dry_run" {
361+
count = var.vpc_service_control_attach_dry_run && !var.vpc_service_control_attach_enabled ? 1 : 0
362+
depends_on = [google_service_account.default_service_account]
363+
perimeter_name = var.vpc_service_control_perimeter_name
364+
resource = "projects/${google_project.main.number}"
365+
}
366+
357367
/******************************************
358368
Enable Access Context Manager API
359369
*****************************************/
360370
resource "google_project_service" "enable_access_context_manager" {
361-
count = var.vpc_service_control_attach_enabled ? 1 : 0
371+
count = var.vpc_service_control_attach_enabled || var.vpc_service_control_attach_enabled ? 1 : 0
362372
project = google_project.main.number
363373
service = "accesscontextmanager.googleapis.com"
364374
}

modules/core_project_factory/variables.tf

+7-1
Original file line numberDiff line numberDiff line change
@@ -230,7 +230,13 @@ variable "enable_shared_vpc_host_project" {
230230
}
231231

232232
variable "vpc_service_control_attach_enabled" {
233-
description = "Whether the project will be attached to a VPC Service Control Perimeter"
233+
description = "Whether the project will be attached to a VPC Service Control Perimeter in ENFORCED MODE. vpc_service_control_attach_dry_run should be false for this to be true"
234+
type = bool
235+
default = false
236+
}
237+
238+
variable "vpc_service_control_attach_dry_run" {
239+
description = "Whether the project will be attached to a VPC Service Control Perimeter in Dry Run Mode. vpc_service_control_attach_enabled should be false for this to be true"
234240
type = bool
235241
default = false
236242
}

modules/core_project_factory/versions.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,11 @@ terraform {
2020
required_providers {
2121
google = {
2222
source = "hashicorp/google"
23-
version = ">= 3.64, < 6"
23+
version = ">= 5.22, < 6"
2424
}
2525
google-beta = {
2626
source = "hashicorp/google-beta"
27-
version = ">= 3.64, < 6"
27+
version = ">= 5.22, < 6"
2828
}
2929
null = {
3030
source = "hashicorp/null"

variables.tf

+7-1
Original file line numberDiff line numberDiff line change
@@ -289,7 +289,13 @@ variable "budget_custom_period_end_date" {
289289
}
290290

291291
variable "vpc_service_control_attach_enabled" {
292-
description = "Whether the project will be attached to a VPC Service Control Perimeter"
292+
description = "Whether the project will be attached to a VPC Service Control Perimeter in ENFORCED MODE. vpc_service_control_attach_dry_run should be false for this to be true"
293+
type = bool
294+
default = false
295+
}
296+
297+
variable "vpc_service_control_attach_dry_run" {
298+
description = "Whether the project will be attached to a VPC Service Control Perimeter in Dry Run Mode. vpc_service_control_attach_enabled should be false for this to be true"
293299
type = bool
294300
default = false
295301
}

versions.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,11 @@ terraform {
1919
required_providers {
2020
google = {
2121
source = "hashicorp/google"
22-
version = ">= 4.28, < 6"
22+
version = ">= 5.22, < 6"
2323
}
2424
google-beta = {
2525
source = "hashicorp/google-beta"
26-
version = ">= 4.28, < 6"
26+
version = ">= 5.22, < 6"
2727
}
2828
}
2929
provider_meta "google" {

0 commit comments

Comments
 (0)