Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat!: Restricting autokey module to autokey configuration use case #163

Open
wants to merge 27 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from 23 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Empty file added .terraform.lock
nb-goog marked this conversation as resolved.
Show resolved Hide resolved
Empty file.
44 changes: 0 additions & 44 deletions examples/autokey_example/main.tf
nb-goog marked this conversation as resolved.
Show resolved Hide resolved

This file was deleted.

26 changes: 26 additions & 0 deletions examples/autokey_setup/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
# Autokey Example

This example illustrates how to setup the `autokey` kms submodule for [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature.

<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| folder\_id | The ID of the folder for which to configure and enable Autokey feature. Required when using Autokey. | `string` | n/a | yes |
| kms\_project\_id | The ID of the project in which kms keyring and kms keys will be provisioned by autokey. | `string` | n/a | yes |

## Outputs

| Name | Description |
|------|-------------|
| autokey\_config\_id | An Autokey configuration identifier. |
| kms\_project\_id | The ID of the project in which kms keyring and kms keys will be provisioned by autokey. |

<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

To provision this example, run the following from within this directory:
- `terraform init` to get the plugins
- `terraform plan` to see the infrastructure plan
- `terraform apply` to apply the infrastructure build
- `terraform destroy` to destroy the built infrastructure
23 changes: 23 additions & 0 deletions examples/autokey_setup/main.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
/**
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

module "autokey" {
source = "../../modules/autokey"

autokey_kms_project_id = var.kms_project_id
autokey_folder_number = var.folder_id
}

25 changes: 25 additions & 0 deletions examples/autokey_setup/outputs.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
/**
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

output "autokey_config_id" {
description = "An Autokey configuration identifier."
value = module.autokey.autokey_config_id
}

output "kms_project_id" {
description = "The ID of the project in which kms keyring and kms keys will be provisioned by autokey."
value = var.kms_project_id
}
Original file line number Diff line number Diff line change
Expand Up @@ -14,18 +14,13 @@
* limitations under the License.
*/

variable "project_id" {
description = "The ID of the project in which to provision Autokey resources (autokey keyring and keyHandle keys)."
type = string
}

variable "autokey_resource_project_id" {
description = "The ID of the project for Autokey to be used (e.g: a storage project which expects to use Autokey as CMEK)."
variable "kms_project_id" {
description = "The ID of the project in which kms keyring and kms keys will be provisioned by autokey."
type = string
}

variable "folder_id" {
type = string
description = "The Autokey folder number used by Autokey config resource. Required when using Autokey."
description = "The ID of the folder for which to configure and enable Autokey feature. Required when using Autokey."
}

Original file line number Diff line number Diff line change
@@ -1,23 +1,23 @@
# Autokey Example

This example illustrates how to use the `autokey` kms submodule for [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature.
This example illustrates how to use the `autokey` kms submodule for [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature to create the bucket.

<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| autokey\_resource\_project\_id | The ID of the project for Autokey to be used (e.g: a storage project which expects to use Autokey as CMEK). | `string` | n/a | yes |
| folder\_id | The Autokey folder number used by Autokey config resource. Required when using Autokey. | `string` | n/a | yes |
| project\_id | The ID of the project in which to provision Autokey resources (autokey keyring and keyHandle keys). | `string` | n/a | yes |
| bucket\_location | The gcp location where storage bucket will be created | `string` | `"us-central1"` | no |
| folder\_id | The ID of the folder for which to configure and enable Autokey feature. Required when using Autokey. | `string` | n/a | yes |
| kms\_project\_id | The ID of the project in which kms keyring and kms keys will be provisioned by autokey. | `string` | n/a | yes |
| resource\_project\_id | The ID of the project in which to provision resources (bucket, persistent disk, etc) | `string` | n/a | yes |

## Outputs

| Name | Description |
|------|-------------|
| autokey\_config\_id | An Autokey configuration identifier. |
| autokey\_keyhandles | A map of KeyHandles created. |
| autokey\_project\_id | Project used for autokey. |
| bucket\_keyhandle | An Autokey configuration identifier. |
| bucket\_name | A map of KeyHandles created. |

<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

Expand Down
61 changes: 61 additions & 0 deletions examples/bucket_setup_using_autokey/main.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,61 @@
/**
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

module "autokey" {
source = "../../modules/autokey"

autokey_kms_project_id = var.kms_project_id
autokey_folder_number = var.folder_id
}

# Wait delay for autokey configuration.
resource "time_sleep" "wait_autokey_config" {
create_duration = "20s"
depends_on = [module.autokey]
}

resource "random_string" "suffix" {
length = 4
special = false
upper = false
}

resource "google_kms_key_handle" "bucket_keyhandle" {
provider = google-beta
name = "${var.resource_project_id}-keyhandle-${random_string.suffix.result}"
project = var.resource_project_id
location = var.bucket_location
resource_type_selector = "storage.googleapis.com/Bucket"

lifecycle {
ignore_changes = [name]
}
depends_on = [time_sleep.wait_autokey_config]
}

module "bucket" {
source = "terraform-google-modules/cloud-storage/google//modules/simple_bucket"
version = "8.0"
nb-goog marked this conversation as resolved.
Show resolved Hide resolved

name = "${var.resource_project_id}-bucket-${random_string.suffix.result}"
project_id = var.resource_project_id
location = var.bucket_location
encryption = {
default_kms_key_name = resource.google_kms_key_handle.bucket_keyhandle.kms_key
}

depends_on = [resource.google_kms_key_handle.bucket_keyhandle]
}
Original file line number Diff line number Diff line change
Expand Up @@ -14,17 +14,12 @@
* limitations under the License.
*/

output "autokey_config_id" {
output "bucket_keyhandle" {
description = "An Autokey configuration identifier."
nb-goog marked this conversation as resolved.
Show resolved Hide resolved
value = module.autokey.autokey_config_id != null ? module.autokey.autokey_config_id : ""
value = resource.google_kms_key_handle.bucket_keyhandle
}

output "autokey_keyhandles" {
output "bucket_name" {
description = "A map of KeyHandles created."
nb-goog marked this conversation as resolved.
Show resolved Hide resolved
value = module.autokey.autokey_keyhandles != null ? module.autokey.autokey_keyhandles : {}
}

output "autokey_project_id" {
description = "Project used for autokey."
value = var.project_id
value = module.bucket.name
}
36 changes: 36 additions & 0 deletions examples/bucket_setup_using_autokey/variables.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
/**
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

variable "kms_project_id" {
description = "The ID of the project in which kms keyring and kms keys will be provisioned by autokey."
nb-goog marked this conversation as resolved.
Show resolved Hide resolved
type = string
}

variable "folder_id" {
type = string
description = "The ID of the folder for which to configure and enable Autokey feature. Required when using Autokey."
nb-goog marked this conversation as resolved.
Show resolved Hide resolved
}

variable "resource_project_id" {
description = "The ID of the project in which to provision resources (bucket, persistent disk, etc)"
nb-goog marked this conversation as resolved.
Show resolved Hide resolved
type = string
}

variable "bucket_location" {
type = string
description = "The gcp location where storage bucket will be created"
nb-goog marked this conversation as resolved.
Show resolved Hide resolved
default = "us-central1"
}
7 changes: 2 additions & 5 deletions modules/autokey/README.md
nb-goog marked this conversation as resolved.
Show resolved Hide resolved
Original file line number Diff line number Diff line change
Expand Up @@ -7,16 +7,13 @@ This is a submodule built to make [KMS Autokey](https://cloud.google.com/kms/doc

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| autokey\_folder\_number | The Autokey folder number used by Autokey config resource. Required when using Autokey. | `string` | n/a | yes |
| autokey\_handles | (Optional) A KeyHandle is a resource used by Autokey to auto-provision CryptoKeys for CMEK for a particular service.<br>- name: The resource name for the KeyHandle.<br>- resource\_type\_selector: Indicates the resource type that the resulting CryptoKey is meant to protect, in the following format: {SERVICE}.googleapis.com/{TYPE}. For example, storage.googleapis.com/Bucket. All Cloud KMS Autokey compatible services available at https://cloud.google.com/kms/docs/autokey-overview#compatible-services.<br>- location: The location for the KeyHandle. A full list of valid locations can be found by running gcloud kms locations list.<br>- project: The ID of the project in which the resource belongs. If it is not provided, the provider project is used. | <pre>map(object({<br> name = string<br> resource_type_selector = string<br> location = string<br> project = string<br> }))</pre> | `null` | no |
| project\_id | Project id where the Autokey configuration and KeyHandles will be created. | `string` | n/a | yes |
| autokey\_folder\_number | The folder number on which autokey will be configured and enabled. Required when using Autokey. | `string` | n/a | yes |
| autokey\_kms\_project\_id | The ID of the project in which kms keyrings and keys will be provisioned by the Autokey. | `string` | n/a | yes |

## Outputs

| Name | Description |
|------|-------------|
| autokey\_config\_id | An Autokey configuration identifier. |
| autokey\_keyhandles | A map of KeyHandles created. |
| random\_suffix | Random 4 digits suffix used in Autokey submodule. |

<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
10 changes: 2 additions & 8 deletions modules/autokey/iam.tf
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,11 @@
*/

data "google_project" "kms_project" {
project_id = var.project_id
project_id = var.autokey_kms_project_id
}

#Create KMS Service Agent
resource "google_project_service_identity" "kms_service_agent" {
count = var.autokey_handles != null ? 1 : 0
provider = google-beta

service = "cloudkms.googleapis.com"
Expand All @@ -29,27 +28,22 @@ resource "google_project_service_identity" "kms_service_agent" {

# Wait delay after creating service agent.
resource "time_sleep" "wait_service_agent" {
count = var.autokey_handles != null ? 1 : 0

create_duration = "10s"
depends_on = [google_project_service_identity.kms_service_agent]
}

#Grant the KMS Service Agent the Cloud KMS Admin role
resource "google_project_iam_member" "autokey_project_admin" {
count = var.autokey_handles != null ? 1 : 0
provider = google-beta

project = var.project_id
project = var.autokey_kms_project_id
role = "roles/cloudkms.admin"
member = "serviceAccount:service-${data.google_project.kms_project.number}@gcp-sa-cloudkms.iam.gserviceaccount.com"
depends_on = [time_sleep.wait_service_agent]
}

# Wait delay after granting IAM permissions
resource "time_sleep" "wait_srv_acc_permissions" {
count = var.autokey_handles != null ? 1 : 0

create_duration = "10s"
depends_on = [google_project_iam_member.autokey_project_admin]
}
25 changes: 2 additions & 23 deletions modules/autokey/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -18,27 +18,6 @@ resource "google_kms_autokey_config" "primary" {
provider = google-beta

folder = var.autokey_folder_number
key_project = "projects/${var.project_id}"
}

resource "random_string" "suffix" {
length = 4
special = false
upper = false
}

resource "google_kms_key_handle" "primary" {
for_each = var.autokey_handles != null ? var.autokey_handles : tomap({})
provider = google-beta

project = each.value.project
name = "${each.value.name}-${random_string.suffix.result}"
location = each.value.location
resource_type_selector = each.value.resource_type_selector

lifecycle {
ignore_changes = [name]
}

depends_on = [time_sleep.wait_srv_acc_permissions]
key_project = "projects/${var.autokey_kms_project_id}"
depends_on = [time_sleep.wait_srv_acc_permissions]
}
Loading
Loading