update secrets (#61)

5-app-infra/source_repos/service-catalog/modules/secrets/README.md

@@ -1,58 +1,3 @@
-<!-- BEGIN_TF_DOCS -->
-Copyright 2024 Google LLC
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-
-## Requirements
-
-No requirements.
-
-## Providers
-
-| Name | Version |
-|------|---------|
-| <a name="provider_google"></a> [google](#provider\_google) | n/a |
-
-## Modules
-
-No modules.
-
-## Resources
-
-| Name | Type |
-|------|------|
-| [google_secret_manager_secret.secret](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/secret_manager_secret) | resource |
-| [google_kms_crypto_key.key](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/kms_crypto_key) | data source |
-| [google_kms_key_ring.kms](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/kms_key_ring) | data source |
-| [google_project.project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |
-| [google_projects.kms](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/projects) | data source |
-| [google_pubsub_topic.secret_rotations](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/pubsub_topic) | data source |
-
-## Inputs
-
-| Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:--------:|
-| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | Optional Project ID. | `string` | `null` | no |
-| <a name="input_region"></a> [region](#input\_region) | The resource region, one of [us-central1, us-east4]. | `string` | `"us-central1"` | no |
-| <a name="input_secret_names"></a> [secret\_names](#input\_secret\_names) | Names of the secrets to be created. | `list(string)` | n/a | yes |
-
-## Outputs
-
-| Name | Description |
-|------|-------------|
-| <a name="output_secret_manager"></a> [secret\_manager](#output\_secret\_manager) | Secret Manager resource. |
-<!-- END_TF_DOCS -->
-
 ## Security Controls
 
 The following table outlines which of the suggested controls for Vertex Generative AI are enabled in this module.
@@ -66,7 +11,8 @@ The following table outlines which of the suggested controls for Vertex Generati
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| project\_id | Optional Project ID. | `string` | `null` | no |
+| kms\_keyring | The KMS keyring that will be used when selecting the KMS key, preferably this should be on the same region as the other resources and the same environment.<br>This value can be obtained by running "gcloud kms keyrings list --project=KMS\_PROJECT\_ID --location=REGION." | `string` | n/a | yes |
+| project\_id | Project ID. | `string` | n/a | yes |
 | region | The resource region, one of [us-central1, us-east4]. | `string` | `"us-central1"` | no |
 | secret\_names | Names of the secrets to be created. | `list(string)` | n/a | yes |
 

5-app-infra/source_repos/service-catalog/modules/secrets/data.tf

@@ -18,19 +18,9 @@ data "google_project" "project" {
   project_id = var.project_id
 }
 
-data "google_projects" "kms" {
-  filter = "labels.application_name:env-kms labels.environment:${data.google_project.project.labels.environment} lifecycleState:ACTIVE"
-}
-
-data "google_kms_key_ring" "kms" {
-  name     = local.keyring_name
-  location = var.region
-  project  = data.google_projects.kms.projects.0.project_id
-}
-
 data "google_kms_crypto_key" "key" {
   name     = data.google_project.project.name
-  key_ring = data.google_kms_key_ring.kms.id
+  key_ring = var.kms_keyring
 }
 
 data "google_pubsub_topic" "secret_rotations" {

5-app-infra/source_repos/service-catalog/modules/secrets/locals.tf

@@ -15,6 +15,6 @@
  */
 
 locals {
-  keyring_name      = "sample-keyring"
+  key_location      = element(split("/", var.kms_keyring), 3)
   pubsub_topic_name = "secret-rotation-notifications"
 }

5-app-infra/source_repos/service-catalog/modules/secrets/main.tf

@@ -40,7 +40,7 @@ resource "google_secret_manager_secret" "secret" {
   replication {
     user_managed {
       replicas {
-        location = data.google_kms_key_ring.kms.location
+        location = local.key_location
 
         #Customer Managed Encryption Keys
         #Control ID: COM-CO-2.3

5-app-infra/source_repos/service-catalog/modules/secrets/variables.tf

@@ -16,8 +16,7 @@
 
 variable "project_id" {
   type        = string
-  description = "Optional Project ID."
-  default     = null
+  description = "Project ID."
 }
 
 variable "region" {
@@ -34,3 +33,11 @@ variable "secret_names" {
   type        = list(string)
   description = "Names of the secrets to be created."
 }
+
+variable "kms_keyring" {
+  type        = string
+  description = <<EOF
+The KMS keyring that will be used when selecting the KMS key, preferably this should be on the same region as the other resources and the same environment.
+This value can be obtained by running "gcloud kms keyrings list --project=KMS_PROJECT_ID --location=REGION."
+EOF
+}