Merge branch 'main' of github.com:caetano-colin/terraform-google-ente…

…rprise-genai into refactor/ml-infra-projects
caetano-colin · May 14, 2024 · ba35d53 · ba35d53
2 parents 8676a28 + 2e9d699
commit ba35d53
Show file tree

Hide file tree

Showing 34 changed files with 1,141 additions and 798 deletions.
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
@@ -21,7 +21,7 @@ on:
   workflow_dispatch:
   pull_request:
     branches:
-      - master
+      - main
 
 concurrency:
   group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'

diff --git a/1-org/envs/shared/key_rings.tf → 1-org/envs/shared/ml_key_rings.tf b/1-org/envs/shared/key_rings.tf → 1-org/envs/shared/ml_key_rings.tf
@@ -1,5 +1,5 @@
 /**
- * Copyright 2021 Google LLC
+ * Copyright 2024 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,18 +14,14 @@
  * limitations under the License.
  */
 
+// Creates a keyring for each region (us-central1, us-east4)
+module "kms_keyring" {
+  source = "../../modules/ml_kms_keyring"
 
-// Create two keyrings in two geographic regions
-
-module "kms_keyrings" {
-  for_each = toset(var.keyring_regions)
-  source   = "terraform-google-modules/kms/google"
-  version  = "~> 2.1"
-
+  keyring_admins = [
+    "serviceAccount:${local.projects_step_terraform_service_account_email}"
+  ]
   project_id      = module.org_kms.project_id
-  keyring         = var.keyring_name
-  location        = each.key
-  prevent_destroy = "false"
-
-  depends_on = [module.org_kms]
+  keyring_regions = var.keyring_regions
+  keyring_name    = var.keyring_name
 }
diff --git a/1-org/envs/shared/ml_ops_org_policy.tf b/1-org/envs/shared/ml_ops_org_policy.tf
@@ -14,52 +14,21 @@
  * limitations under the License.
  */
 
+module "ml_organization_policies" {
+  source = "../../modules/ml-org-policies"
 
-locals {
+  org_id    = local.organization_id
+  folder_id = local.folder_id
 
-  ml_boolean_type_organization_policies = toset([
-    #Disable file downloads on new Vertex AI Workbench instances
-    #Control ID: VAI-CO-4.2
-    #NIST 800-53: AC-3 AC-17 AC-20
-    #CRI Profile: PR.AC-3.1 PR.AC-3.2 PR.AC-4.1 PR.AC-4.2 PR.AC-4.3 PR.AC-6.1 PR.PT-3.1 PR.PT-4.1
-    "ainotebooks.disableFileDownloads",
-
-    #Disable root access on new Vertex AI Workbench user-managed notebooks and instances
-    #Control ID: VAI-CO-4.3
-    #NIST 800-53: AC-3 AC-17 AC-20
-    #CRI Profile: PR.AC-3.1 PR.AC-3.2 PR.AC-4.1 PR.AC-4.2 PR.AC-4.3 PR.AC-6.1 PR.PT-3.1 PR.PT-4.1
-    "ainotebooks.disableRootAccess",
-
-    #Disable terminal on new Vertexx AI Workbench instances
-    #Control ID: VAI-CO-4.4
-    #NIST 800-53: AC-3 AC-17 AC-20
-    #CRI Profile: PR.AC-3.1 PR.AC-3.2 PR.AC-4.1 PR.AC-4.2 PR.AC-4.3 PR.AC-6.1 PR.PT-3.1 PR.PT-4.1
-    "ainotebooks.disableTerminal",
-
-    #Restrict public IP access on new Vertex AI Workbench notebooks and instances
-    #Control ID: VAI-CO-4.7
-    #NIST 800-53: AC-3 AC-17 AC-20
-    #CRI Profile: PR.AC-3.1 PR.AC-3.2 PR.AC-4.1 PR.AC-4.2 PR.AC-4.3 PR.AC-6.1 PR.PT-3.1 PR.PT-4.1
-    "ainotebooks.restrictPublicIp",
-
-    #Require automatic scheduled upgrades on new Vertex AI Workbench user-managed notebooks and instances
-    #Control ID: VAI-CO-4.6
-    #NIST 800-53: AC-3 AC-17 AC-20
-    #CRI Profile: PR.AC-3.1 PR.AC-3.2 PR.AC-4.1 PR.AC-4.2 PR.AC-4.3 PR.AC-6.1 PR.PT-3.1 PR.PT-4.1
-    "ainotebooks.requireAutoUpgradeSchedule",
+  allowed_locations = [
+    "in:us-locations"
+  ]
 
-    #Require VPC Connector
-    #Control ID: CF-CO-4.4
-    #NIST 800-53: SC-7 SC-8
-    #CRI Profile: PR.AC-5.1 PR.AC-5.2 PR.DS-2.1 PR.DS-2.2 PR.DS-5.1 PR.PT-4.1 DE.CM-1.1 DE.CM-1.2 DE.CM-1.3 DE.CM-1.4
-    "cloudfunctions.requireVPCConnector"
-  ])
+  allowed_vertex_vpc_networks = {
+    parent_type = "project"
+    ids         = [for instance in module.base_restricted_environment_network : instance.restricted_shared_vpc_project_id],
+  }
 
-  restricted_services          = ["alloydb.googleapis.com"]
-  allowed_locations            = ["us-locations"]
-  allowed_integrations         = ["github.com", "source.developers.google.com"]
-  restricted_tls_versions      = ["TLS_VERSION_1", "TLS_VERSION_1_1"]
-  restricted_non_cmek_services = ["bigquery.googleapis.com", "aiplatform.googleapis.com"]
   allowed_vertex_images = [
     "ainotebooks-vm/deeplearning-platform-release/image-family/pytorch-1-13-cu113-notebooks",
     "ainotebooks-vm/deeplearning-platform-release/image-family/pytorch-1-13-cu113-notebooks",
@@ -71,208 +40,28 @@ locals {
     "ainotebooks-container/us-docker.pkg.dev/deeplearning-platform-release/gcr.io/tf2-cpu.2-12.py310",
     "ainotebooks-container/us-docker.pkg.dev/deeplearning-platform-release/gcr.io/tf2-gpu.2-12.py310"
   ]
-  allowed_vertex_access_modes = ["single-user", "service-account"]
-  access_scope                = local.parent_folder != "" ? ["under:folders/${local.folder_id}"] : ["under:organizations/${local.org_id}"]
-  allowed_vertex_vpc_networks = [for instance in module.base_restricted_environment_network : format("under:projects/%s", instance.restricted_shared_vpc_project_id)]
-
-}
-
-module "ml_organization_policies_type_boolean" {
-  source   = "terraform-google-modules/org-policy/google"
-  version  = "~> 5.1"
-  for_each = local.ml_boolean_type_organization_policies
-
-  organization_id = local.organization_id
-  folder_id       = local.folder_id
-  policy_for      = local.policy_for
-  policy_type     = "boolean"
-  enforce         = "true"
-  constraint      = "constraints/${each.value}"
-}
-
-/******************************************
-  Cloud build
-*******************************************/
-
-module "allowed_integrations" {
-  #Allowed Integrations
-  #Control ID: CB-CO-6.2
-  #NIST 800-53: AC-3 AC-12 AC-17 AC-20
-  #CRI Profile: PR.AC-3.1 PR.AC-3.2 PR.AC-4.1 PR.AC-4.2 PR.AC-4.3 PR.AC-6.1 PR.AC-7.1 PR.AC-7.2 PR.PT-3.1 PR-PT-4.1
-  source  = "terraform-google-modules/org-policy/google"
-  version = "~> 5.1"
-
-  organization_id   = local.organization_id
-  folder_id         = local.folder_id
-  policy_for        = local.policy_for
-  policy_type       = "list"
-  allow_list_length = 1
-  allow             = local.allowed_integrations
-  constraint        = "constraints/cloudbuild.allowedIntegrations"
-}
-
-/*****************************************
-  Common
-******************************************/
-
-module "restrict_tls_versions" {
-  #Restrict TLS Versions Supported by Google APIs
-  #Control ID: COM-CO-1.1
-  #NIST 800-53: SC-8 SC-13
-  #CRI Profile: PR.DS-2.1 PR.DS-2.2 PR.DS-5.1
-
-  source  = "terraform-google-modules/org-policy/google"
-  version = "~> 5.1"
-
-  organization_id  = local.organization_id
-  folder_id        = local.folder_id
-  policy_for       = local.policy_for
-  policy_type      = "list"
-  deny_list_length = length(local.restricted_tls_versions)
-  deny             = local.restricted_tls_versions
-  constraint       = "constraints/gcp.restrictTLSVersion"
-}
-
-module "restrict_cmek_key_projects" {
-  #Customer Managed Encryption Keys (1 of 2)
-  #Control ID: COM-CO-2.2
-  #NIST 800-53 SC-12 SC-13
-  #CRI Profile: PR.DS-1.1 PR.DS-1.2 PR.DS-2.1 PR.DS-2.2 PR.DS-5.1
-  source  = "terraform-google-modules/org-policy/google"
-  version = "~> 5.1"
-
-  organization_id   = local.organization_id
-  folder_id         = local.folder_id
-  policy_for        = local.policy_for
-  policy_type       = "list"
-  allow_list_length = 1
-  allow             = local.access_scope
-  constraint        = "constraints/gcp.restrictCmekCryptoKeyProjects"
-}
 
-module "restrict_non_cmek_services" {
-  #Customer Managed Encryption Keys (2 of 2)
-  #Control ID: COM-CO-2.3
-  #NIST 800-53: SC-12
-  #CRI Profile: PR.DS-1.1 PR.DS-1.2 PR.DS-2.1 PR.DS-2.2 PR.DS-5.1
-  source  = "terraform-google-modules/org-policy/google"
-  version = "~> 5.1"
-
-  organization_id  = local.organization_id
-  folder_id        = local.folder_id
-  policy_for       = local.policy_for
-  policy_type      = "list"
-  deny_list_length = length(local.restricted_tls_versions)
-  deny             = local.restricted_non_cmek_services
-  constraint       = "constraints/gcp.restrictNonCmekServices"
-}
-
-module "restrict_service_usage" {
-  #Restrict Resource Service Usage
-  #Control ID: RM-CO-4.1
-  #NIST 800-53: AC-3 AC-17 AC-20
-  #CRI Profile: PR.AC-3.1 PR.AC-3.2 PR.AC-4.1 PR.AC-4.2 PR.AC-4.3 PR.AC-6.1 PR.PT-3.1 PR.PT-4.1
-  source  = "terraform-google-modules/org-policy/google"
-  version = "~> 5.1"
-
-  organization_id  = local.organization_id
-  folder_id        = local.folder_id
-  policy_for       = local.policy_for
-  policy_type      = "list"
-  deny_list_length = length(local.restricted_services)
-  deny             = local.restricted_services
-  constraint       = "constraints/gcp.restrictServiceUsage"
-}
-
-module "allowed_locations" {
-  #Resource Location Restriction
-  #Control ID: RM-CO-4.2
-  #NIST 800-53: AC-3 AC-17 AC-20
-  #CRI Profile: PR.AC-3.1 PR.AC-3.2 PR.AC-4.1 PR.AC-4.2 PR.AC-4.3 PR.AC-6.1 PR.PT-3.1 PR.PT-4.1
-  source  = "terraform-google-modules/org-policy/google"
-  version = "~> 5.1"
-
-  organization_id   = local.organization_id
-  folder_id         = local.folder_id
-  policy_for        = local.policy_for
-  policy_type       = "list"
-  allow_list_length = length(local.allowed_locations)
-  allow             = local.allowed_locations
-  constraint        = "constraints/gcp.resourceLocations"
-}
-
-/******************************************
-  VPC
-*******************************************/
-
-module "restrict_vm_ip_forwarding" {
-  #Restrict VM IP Forwarding
-  #Control ID: VPC-CO-6.3
-  #NIST 800-53: SC-7 SC-8
-  #CRI Profile: PR.AC-5.1 PR.AC-5.2 PR.DS-2.1 PR.DS-2.2 PR.DS-5.1 PR.PT-4.1 DE.CM-1.1 DE.CM-1.2 DE.CM-1.3 DE.CM-1.4
-  source  = "terraform-google-modules/org-policy/google"
-  version = "~> 5.1"
-
-  organization_id  = local.organization_id
-  folder_id        = local.folder_id
-  policy_for       = local.policy_for
-  policy_type      = "list"
-  deny_list_length = 1
-  deny             = local.access_scope
-  constraint       = "constraints/compute.vmCanIpForward"
-}
-
-/******************************************
-  Vertex AI
-*******************************************/
-
-module "vertexai_workbench_access_mode" {
-  #Default access mode for Vertex AI Workbench notebooks and isntances
-  #Control ID: VAI-CO-4.1
-  #NIST 800-53: AC-3 AC-17 AC-20
-  #CRI Profile: PR.AC-3.1 PR.AC-3.2 PR.AC-4.1 PR.AC-4.2 PR.AC-4.3 PR.AC-6.1 PR.PT-3.1 PR.PT-4.1
-  source  = "terraform-google-modules/org-policy/google"
-  version = "~> 5.1"
-
-  organization_id   = local.organization_id
-  folder_id         = local.folder_id
-  policy_for        = local.policy_for
-  policy_type       = "list"
-  allow_list_length = length(local.allowed_vertex_access_modes)
-  allow             = local.allowed_vertex_access_modes
-  constraint        = "constraints/ainotebooks.accessMode"
-}
+  restricted_services = [
+    "alloydb.googleapis.com"
+  ]
 
-module "vertexai_allowed_images" {
-  #Restrict environment options on new Vertex AI Workbench notebooks and instances.
-  #Control ID: VAI-CO-4.5
-  #NIST 800-53: AC-3 AC-17 AC-20
-  #CRI Profile: PR.AC-3.1 PR.AC-3.2 PR.AC-4.1 PR.AC-4.2 PR.AC-4.3 PR.AC-6.1 PR.PT-3.1 PR.PT-4.1
-  source  = "terraform-google-modules/org-policy/google"
-  version = "~> 5.1"
+  allowed_integrations = [
+    "github.com",
+    "source.developers.google.com"
+  ]
 
-  organization_id   = local.organization_id
-  folder_id         = local.folder_id
-  policy_for        = local.policy_for
-  policy_type       = "list"
-  allow_list_length = length(local.allowed_vertex_images)
-  allow             = local.allowed_vertex_images
-  constraint        = "constraints/ainotebooks.environmentOptions"
-}
+  restricted_tls_versions = [
+    "TLS_VERSION_1",
+    "TLS_VERSION_1_1"
+  ]
 
-module "restrict_vertex_notebook_vpc_networks" {
-  #Restrict VPC networks on new Vertex AI Workbench instances
-  #Control ID: VAI-CO-4.8
-  #NIST 800-53 SC-7 SC-8
-  #CRI Profile: PR.AC-3.1 PR.AC-3.2 PR.AC-4.1 PR.AC-4.2 PR.AC-4.3 PR.AC-6.1 PR.PT-3.1 PR.PT-4.1
-  source  = "terraform-google-modules/org-policy/google"
-  version = "~> 5.1"
+  restricted_non_cmek_services = [
+    "bigquery.googleapis.com",
+    "aiplatform.googleapis.com"
+  ]
 
-  organization_id   = local.organization_id
-  folder_id         = local.folder_id
-  policy_for        = local.policy_for
-  policy_type       = "list"
-  allow_list_length = length(local.allowed_vertex_vpc_networks)
-  allow             = local.allowed_vertex_vpc_networks
-  constraint        = "constraints/ainotebooks.restrictVpcNetworks"
+  allowed_vertex_access_modes = [
+    "single-user",
+    "service-account"
+  ]
 }
diff --git a/1-org/envs/shared/outputs.tf b/1-org/envs/shared/outputs.tf
@@ -156,5 +156,5 @@ output "cai_monitoring_topic" {
 
 output "key_rings" {
   description = "Keyring Names created"
-  value       = values(module.kms_keyrings)[*].keyring
+  value       = module.kms_keyring.key_rings
 }
diff --git a/1-org/envs/shared/projects.tf b/1-org/envs/shared/projects.tf
@@ -125,13 +125,6 @@ module "org_kms" {
   budget_alert_spend_basis    = var.project_budget.org_kms_budget_alert_spend_basis
 }
 
-resource "google_project_iam_member" "kms_sa_base" {
-
-  project = module.org_kms.project_id
-  role    = "roles/cloudkms.admin"
-  member  = "serviceAccount:${local.projects_step_terraform_service_account_email}"
-}
-
 /******************************************
   Project for Org-wide Secrets
 *****************************************/