From a3dd3f5e77400d2771e67e861605a1af404f28dd Mon Sep 17 00:00:00 2001 From: Caetano Colin <164910343+caetano-colin@users.noreply.github.com> Date: Mon, 24 Jun 2024 16:59:28 -0300 Subject: [PATCH] update secrets (#61) --- .../service-catalog/modules/secrets/README.md | 58 +------------------ .../service-catalog/modules/secrets/data.tf | 12 +--- .../service-catalog/modules/secrets/locals.tf | 2 +- .../service-catalog/modules/secrets/main.tf | 2 +- .../modules/secrets/variables.tf | 11 +++- 5 files changed, 14 insertions(+), 71 deletions(-) diff --git a/5-app-infra/source_repos/service-catalog/modules/secrets/README.md b/5-app-infra/source_repos/service-catalog/modules/secrets/README.md index d003b9b8..a8eb783a 100644 --- a/5-app-infra/source_repos/service-catalog/modules/secrets/README.md +++ b/5-app-infra/source_repos/service-catalog/modules/secrets/README.md @@ -1,58 +1,3 @@ - -Copyright 2024 Google LLC - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [google](#provider\_google) | n/a | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [google_secret_manager_secret.secret](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/secret_manager_secret) | resource | -| [google_kms_crypto_key.key](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/kms_crypto_key) | data source | -| [google_kms_key_ring.kms](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/kms_key_ring) | data source | -| [google_project.project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source | -| [google_projects.kms](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/projects) | data source | -| [google_pubsub_topic.secret_rotations](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/pubsub_topic) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [project\_id](#input\_project\_id) | Optional Project ID. | `string` | `null` | no | -| [region](#input\_region) | The resource region, one of [us-central1, us-east4]. | `string` | `"us-central1"` | no | -| [secret\_names](#input\_secret\_names) | Names of the secrets to be created. | `list(string)` | n/a | yes | - -## Outputs - -| Name | Description | -|------|-------------| -| [secret\_manager](#output\_secret\_manager) | Secret Manager resource. | - - ## Security Controls The following table outlines which of the suggested controls for Vertex Generative AI are enabled in this module. @@ -66,7 +11,8 @@ The following table outlines which of the suggested controls for Vertex Generati | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| project\_id | Optional Project ID. | `string` | `null` | no | +| kms\_keyring | The KMS keyring that will be used when selecting the KMS key, preferably this should be on the same region as the other resources and the same environment.
This value can be obtained by running "gcloud kms keyrings list --project=KMS\_PROJECT\_ID --location=REGION." | `string` | n/a | yes | +| project\_id | Project ID. | `string` | n/a | yes | | region | The resource region, one of [us-central1, us-east4]. | `string` | `"us-central1"` | no | | secret\_names | Names of the secrets to be created. | `list(string)` | n/a | yes | diff --git a/5-app-infra/source_repos/service-catalog/modules/secrets/data.tf b/5-app-infra/source_repos/service-catalog/modules/secrets/data.tf index b243d811..00eb5b9c 100644 --- a/5-app-infra/source_repos/service-catalog/modules/secrets/data.tf +++ b/5-app-infra/source_repos/service-catalog/modules/secrets/data.tf @@ -18,19 +18,9 @@ data "google_project" "project" { project_id = var.project_id } -data "google_projects" "kms" { - filter = "labels.application_name:env-kms labels.environment:${data.google_project.project.labels.environment} lifecycleState:ACTIVE" -} - -data "google_kms_key_ring" "kms" { - name = local.keyring_name - location = var.region - project = data.google_projects.kms.projects.0.project_id -} - data "google_kms_crypto_key" "key" { name = data.google_project.project.name - key_ring = data.google_kms_key_ring.kms.id + key_ring = var.kms_keyring } data "google_pubsub_topic" "secret_rotations" { diff --git a/5-app-infra/source_repos/service-catalog/modules/secrets/locals.tf b/5-app-infra/source_repos/service-catalog/modules/secrets/locals.tf index 5defd111..f464e4ce 100644 --- a/5-app-infra/source_repos/service-catalog/modules/secrets/locals.tf +++ b/5-app-infra/source_repos/service-catalog/modules/secrets/locals.tf @@ -15,6 +15,6 @@ */ locals { - keyring_name = "sample-keyring" + key_location = element(split("/", var.kms_keyring), 3) pubsub_topic_name = "secret-rotation-notifications" } diff --git a/5-app-infra/source_repos/service-catalog/modules/secrets/main.tf b/5-app-infra/source_repos/service-catalog/modules/secrets/main.tf index c20104c1..087d4a7a 100644 --- a/5-app-infra/source_repos/service-catalog/modules/secrets/main.tf +++ b/5-app-infra/source_repos/service-catalog/modules/secrets/main.tf @@ -40,7 +40,7 @@ resource "google_secret_manager_secret" "secret" { replication { user_managed { replicas { - location = data.google_kms_key_ring.kms.location + location = local.key_location #Customer Managed Encryption Keys #Control ID: COM-CO-2.3 diff --git a/5-app-infra/source_repos/service-catalog/modules/secrets/variables.tf b/5-app-infra/source_repos/service-catalog/modules/secrets/variables.tf index 517c8158..42275d76 100644 --- a/5-app-infra/source_repos/service-catalog/modules/secrets/variables.tf +++ b/5-app-infra/source_repos/service-catalog/modules/secrets/variables.tf @@ -16,8 +16,7 @@ variable "project_id" { type = string - description = "Optional Project ID." - default = null + description = "Project ID." } variable "region" { @@ -34,3 +33,11 @@ variable "secret_names" { type = list(string) description = "Names of the secrets to be created." } + +variable "kms_keyring" { + type = string + description = <