feat!: Restricting autokey module to autokey configuration use case

examples/autokey_setup/README.md

@@ -0,0 +1,26 @@
+# Autokey Example
+
+This example illustrates how to setup the `autokey` kms submodule for [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature.
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| folder\_id | The ID of the folder for which to configure and enable Autokey feature. | `string` | n/a | yes |
+| kms\_project\_id | The ID of the project in which KMS keyring and KMS keys will be provisioned by autokey. | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| autokey\_config\_id | An Autokey configuration identifier. |
+| kms\_project\_id | The ID of the project in which kms keyring and kms keys will be provisioned by autokey. |
+
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+
+To provision this example, run the following from within this directory:
+- `terraform init` to get the plugins
+- `terraform plan` to see the infrastructure plan
+- `terraform apply` to apply the infrastructure build
+- `terraform destroy` to destroy the built infrastructure

examples/autokey_setup/main.tf

@@ -0,0 +1,23 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module "autokey" {
+  source = "../../modules/autokey"
+
+  autokey_kms_project_id = var.kms_project_id
+  autokey_folder_number  = var.folder_id
+}
+

examples/autokey_setup/outputs.tf

@@ -0,0 +1,25 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+output "autokey_config_id" {
+  description = "An Autokey configuration identifier."
+  value       = module.autokey.autokey_config_id
+}
+
+output "kms_project_id" {
+  description = "The ID of the project in which kms keyring and kms keys will be provisioned by autokey."
+  value       = var.kms_project_id
+}

examples/autokey_setup/variables.tf

@@ -0,0 +1,26 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "kms_project_id" {
+  description = "The ID of the project in which KMS keyring and KMS keys will be provisioned by autokey."
+  type        = string
+}
+
+variable "folder_id" {
+  type        = string
+  description = "The ID of the folder for which to configure and enable Autokey feature."
+}
+

examples/autokey_example/README.md → examples/bucket_setup_using_autokey/README.md

@@ -1,23 +1,23 @@
 # Autokey Example
 
-This example illustrates how to use the `autokey` kms submodule for [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature.
+This example illustrates how to use the `autokey` kms submodule for [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature to create the bucket.
 
 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| autokey\_resource\_project\_id | The ID of the project for Autokey to be used (e.g: a storage project which expects to use Autokey as CMEK). | `string` | n/a | yes |
-| folder\_id | The Autokey folder number used by Autokey config resource. Required when using Autokey. | `string` | n/a | yes |
-| project\_id | The ID of the project in which to provision Autokey resources (autokey keyring and keyHandle keys). | `string` | n/a | yes |
+| bucket\_location | The GCP location where storage bucket will be created | `string` | `"us-central1"` | no |
+| folder\_id | The ID of the folder for which to configure and enable Autokey feature. | `string` | n/a | yes |
+| kms\_project\_id | The ID of the project in which KMS keyring and KMS keys will be provisioned by autokey. | `string` | n/a | yes |
+| resource\_project\_id | The ID of the project in which to provision cloud storage bucket resource. | `string` | n/a | yes |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
-| autokey\_config\_id | An Autokey configuration identifier. |
-| autokey\_keyhandles | A map of KeyHandles created. |
-| autokey\_project\_id | Project used for autokey. |
+| bucket\_keyhandle | Keyhandle configuration created for the bucket. |
+| bucket\_name | Name of the bucket created. |
 
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 

examples/bucket_setup_using_autokey/main.tf

@@ -0,0 +1,61 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module "autokey" {
+  source = "../../modules/autokey"
+
+  autokey_kms_project_id = var.kms_project_id
+  autokey_folder_number  = var.folder_id
+}
+
+# Wait delay for autokey configuration.
+resource "time_sleep" "wait_autokey_config" {
+  create_duration = "20s"
+  depends_on      = [module.autokey]
+}
+
+resource "random_string" "suffix" {
+  length  = 4
+  special = false
+  upper   = false
+}
+
+resource "google_kms_key_handle" "bucket_keyhandle" {
+  provider               = google-beta
+  name                   = "${var.resource_project_id}-keyhandle-${random_string.suffix.result}"
+  project                = var.resource_project_id
+  location               = var.bucket_location
+  resource_type_selector = "storage.googleapis.com/Bucket"
+
+  lifecycle {
+    ignore_changes = [name]
+  }
+  depends_on = [time_sleep.wait_autokey_config]
+}
+
+module "bucket" {
+  source  = "terraform-google-modules/cloud-storage/google//modules/simple_bucket"
+  version = "~> 8.0.3"
+
+  name       = "${var.resource_project_id}-bucket-${random_string.suffix.result}"
+  project_id = var.resource_project_id
+  location   = var.bucket_location
+  encryption = {
+    default_kms_key_name = resource.google_kms_key_handle.bucket_keyhandle.kms_key
+  }
+
+  depends_on = [resource.google_kms_key_handle.bucket_keyhandle]
+}

examples/bucket_setup_using_autokey/outputs.tf

@@ -0,0 +1,25 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+output "bucket_keyhandle" {
+  description = "Keyhandle configuration created for the bucket."
+  value       = resource.google_kms_key_handle.bucket_keyhandle
+}
+
+output "bucket_name" {
+  description = "Name of the bucket created."
+  value       = module.bucket.name
+}

examples/bucket_setup_using_autokey/variables.tf

@@ -0,0 +1,36 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "kms_project_id" {
+  description = "The ID of the project in which KMS keyring and KMS keys will be provisioned by autokey."
+  type        = string
+}
+
+variable "folder_id" {
+  type        = string
+  description = "The ID of the folder for which to configure and enable Autokey feature."
+}
+
+variable "resource_project_id" {
+  description = "The ID of the project in which to provision cloud storage bucket resource."
+  type        = string
+}
+
+variable "bucket_location" {
+  type        = string
+  description = "The GCP location where storage bucket will be created"
+  default     = "us-central1"
+}

modules/autokey/README.md

@@ -1,22 +1,18 @@
 # Autokey submodule
 
-This is a submodule built to make [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature simple to be used. This submodule will create the [Autokey Config](https://cloud.google.com/kms/docs/enable-autokey#enable-autokey-folder) for an existing folder where you want to enable Autokey, set up the Cloud KMS [service agent](https://cloud.google.com/kms/docs/enable-autokey#autokey-service-agent) on an existing key project and create [Key Handles](https://cloud.google.com/kms/docs/resource-hierarchy#key_handles) for existing resource projects.
-
+This is a submodule built to make [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature simple to be used. This submodule will create the [Autokey Config](https://cloud.google.com/kms/docs/enable-autokey#enable-autokey-folder) for an existing folder where you want to enable Autokey, set up the Cloud KMS [service agent](https://cloud.google.com/kms/docs/enable-autokey#autokey-service-agent) on an existing key project.
 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| autokey\_folder\_number | The Autokey folder number used by Autokey config resource. Required when using Autokey. | `string` | n/a | yes |
-| autokey\_handles | (Optional) A KeyHandle is a resource used by Autokey to auto-provision CryptoKeys for CMEK for a particular service.<br>- name: The resource name for the KeyHandle.<br>- resource\_type\_selector: Indicates the resource type that the resulting CryptoKey is meant to protect, in the following format: {SERVICE}.googleapis.com/{TYPE}. For example, storage.googleapis.com/Bucket. All Cloud KMS Autokey compatible services available at https://cloud.google.com/kms/docs/autokey-overview#compatible-services.<br>- location: The location for the KeyHandle. A full list of valid locations can be found by running gcloud kms locations list.<br>- project: The ID of the project in which the resource belongs. If it is not provided, the provider project is used. | <pre>map(object({<br>    name                   = string<br>    resource_type_selector = string<br>    location               = string<br>    project                = string<br>  }))</pre> | `null` | no |
-| project\_id | Project id where the Autokey configuration and KeyHandles will be created. | `string` | n/a | yes |
+| autokey\_folder\_number | The folder number on which autokey will be configured and enabled. Required when using Autokey. | `string` | n/a | yes |
+| autokey\_kms\_project\_id | The ID of the project in which kms keyrings and keys will be provisioned by the Autokey. | `string` | n/a | yes |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
 | autokey\_config\_id | An Autokey configuration identifier. |
-| autokey\_keyhandles | A map of KeyHandles created. |
-| random\_suffix | Random 4 digits suffix used in Autokey submodule. |
 
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->