feat!: Restricting autokey module to autokey configuration use case

examples/autokey_setup/README.md

@@ -0,0 +1,26 @@
+# Autokey Example
+
+This example illustrates how to setup the `autokey` kms submodule for [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature.
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| folder\_id | The ID of the folder for which to configure and enable Autokey feature. Required when using Autokey. | `string` | n/a | yes |
+| kms\_project\_id | The ID of the project in which kms keyring and kms keys will be provisioned by autokey. | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| autokey\_config\_id | An Autokey configuration identifier. |
+| kms\_project\_id | The ID of the project in which kms keyring and kms keys will be provisioned by autokey. |
+
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+
+To provision this example, run the following from within this directory:
+- `terraform init` to get the plugins
+- `terraform plan` to see the infrastructure plan
+- `terraform apply` to apply the infrastructure build
+- `terraform destroy` to destroy the built infrastructure

examples/autokey_setup/main.tf

@@ -0,0 +1,23 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module "autokey" {
+  source = "../../modules/autokey"
+
+  autokey_kms_project_id = var.kms_project_id
+  autokey_folder_number  = var.folder_id
+}
+

examples/autokey_setup/outputs.tf

@@ -0,0 +1,25 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+output "autokey_config_id" {
+  description = "An Autokey configuration identifier."
+  value       = module.autokey.autokey_config_id
+}
+
+output "kms_project_id" {
+  description = "The ID of the project in which kms keyring and kms keys will be provisioned by autokey."
+  value       = var.kms_project_id
+}

examples/autokey_example/variables.tf → examples/autokey_setup/variables.tf

@@ -14,18 +14,13 @@
  * limitations under the License.
  */
 
-variable "project_id" {
-  description = "The ID of the project in which to provision Autokey resources (autokey keyring and keyHandle keys)."
-  type        = string
-}
-
-variable "autokey_resource_project_id" {
-  description = "The ID of the project for Autokey to be used (e.g: a storage project which expects to use Autokey as CMEK)."
+variable "kms_project_id" {
+  description = "The ID of the project in which kms keyring and kms keys will be provisioned by autokey."
   type        = string
 }
 
 variable "folder_id" {
   type        = string
-  description = "The Autokey folder number used by Autokey config resource. Required when using Autokey."
+  description = "The ID of the folder for which to configure and enable Autokey feature. Required when using Autokey."
 }
 

examples/autokey_example/README.md → examples/bucket_setup_using_autokey/README.md

@@ -1,23 +1,23 @@
 # Autokey Example
 
-This example illustrates how to use the `autokey` kms submodule for [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature.
+This example illustrates how to use the `autokey` kms submodule for [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature to create the bucket.
 
 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| autokey\_resource\_project\_id | The ID of the project for Autokey to be used (e.g: a storage project which expects to use Autokey as CMEK). | `string` | n/a | yes |
-| folder\_id | The Autokey folder number used by Autokey config resource. Required when using Autokey. | `string` | n/a | yes |
-| project\_id | The ID of the project in which to provision Autokey resources (autokey keyring and keyHandle keys). | `string` | n/a | yes |
+| bucket\_location | The gcp location where storage bucket will be created | `string` | `"us-central1"` | no |
+| folder\_id | The ID of the folder for which to configure and enable Autokey feature. Required when using Autokey. | `string` | n/a | yes |
+| kms\_project\_id | The ID of the project in which kms keyring and kms keys will be provisioned by autokey. | `string` | n/a | yes |
+| resource\_project\_id | The ID of the project in which to provision resources (bucket, persistent disk, etc) | `string` | n/a | yes |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
-| autokey\_config\_id | An Autokey configuration identifier. |
-| autokey\_keyhandles | A map of KeyHandles created. |
-| autokey\_project\_id | Project used for autokey. |
+| bucket\_keyhandle | An Autokey configuration identifier. |
+| bucket\_name | A map of KeyHandles created. |
 
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 

examples/bucket_setup_using_autokey/main.tf

@@ -0,0 +1,61 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module "autokey" {
+  source = "../../modules/autokey"
+
+  autokey_kms_project_id = var.kms_project_id
+  autokey_folder_number  = var.folder_id
+}
+
+# Wait delay for autokey configuration.
+resource "time_sleep" "wait_autokey_config" {
+  create_duration = "20s"
+  depends_on      = [module.autokey]
+}
+
+resource "random_string" "suffix" {
+  length  = 4
+  special = false
+  upper   = false
+}
+
+resource "google_kms_key_handle" "bucket_keyhandle" {
+  provider               = google-beta
+  name                   = "${var.resource_project_id}-keyhandle-${random_string.suffix.result}"
+  project                = var.resource_project_id
+  location               = var.bucket_location
+  resource_type_selector = "storage.googleapis.com/Bucket"
+
+  lifecycle {
+    ignore_changes = [name]
+  }
+  depends_on = [time_sleep.wait_autokey_config]
+}
+
+module "bucket" {
+  source  = "terraform-google-modules/cloud-storage/google//modules/simple_bucket"
+  version = "8.0"
+
+  name       = "${var.resource_project_id}-bucket-${random_string.suffix.result}"
+  project_id = var.resource_project_id
+  location   = var.bucket_location
+  encryption = {
+    default_kms_key_name = resource.google_kms_key_handle.bucket_keyhandle.kms_key
+  }
+
+  depends_on = [resource.google_kms_key_handle.bucket_keyhandle]
+}

examples/autokey_example/outputs.tf → examples/bucket_setup_using_autokey/outputs.tf

@@ -14,17 +14,12 @@
  * limitations under the License.
  */
 
-output "autokey_config_id" {
+output "bucket_keyhandle" {
   description = "An Autokey configuration identifier."
-  value       = module.autokey.autokey_config_id != null ? module.autokey.autokey_config_id : ""
+  value       = resource.google_kms_key_handle.bucket_keyhandle
 }
 
-output "autokey_keyhandles" {
+output "bucket_name" {
   description = "A map of KeyHandles created."
-  value       = module.autokey.autokey_keyhandles != null ? module.autokey.autokey_keyhandles : {}
-}
-
-output "autokey_project_id" {
-  description = "Project used for autokey."
-  value       = var.project_id
+  value       = module.bucket.name
 }

examples/bucket_setup_using_autokey/variables.tf

@@ -0,0 +1,36 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "kms_project_id" {
+  description = "The ID of the project in which kms keyring and kms keys will be provisioned by autokey."
+  type        = string
+}
+
+variable "folder_id" {
+  type        = string
+  description = "The ID of the folder for which to configure and enable Autokey feature. Required when using Autokey."
+}
+
+variable "resource_project_id" {
+  description = "The ID of the project in which to provision resources (bucket, persistent disk, etc)"
+  type        = string
+}
+
+variable "bucket_location" {
+  type        = string
+  description = "The gcp location where storage bucket will be created"
+  default     = "us-central1"
+}

modules/autokey/README.md

@@ -7,16 +7,13 @@ This is a submodule built to make [KMS Autokey](https://cloud.google.com/kms/doc
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| autokey\_folder\_number | The Autokey folder number used by Autokey config resource. Required when using Autokey. | `string` | n/a | yes |
-| autokey\_handles | (Optional) A KeyHandle is a resource used by Autokey to auto-provision CryptoKeys for CMEK for a particular service.<br>- name: The resource name for the KeyHandle.<br>- resource\_type\_selector: Indicates the resource type that the resulting CryptoKey is meant to protect, in the following format: {SERVICE}.googleapis.com/{TYPE}. For example, storage.googleapis.com/Bucket. All Cloud KMS Autokey compatible services available at https://cloud.google.com/kms/docs/autokey-overview#compatible-services.<br>- location: The location for the KeyHandle. A full list of valid locations can be found by running gcloud kms locations list.<br>- project: The ID of the project in which the resource belongs. If it is not provided, the provider project is used. | <pre>map(object({<br>    name                   = string<br>    resource_type_selector = string<br>    location               = string<br>    project                = string<br>  }))</pre> | `null` | no |
-| project\_id | Project id where the Autokey configuration and KeyHandles will be created. | `string` | n/a | yes |
+| autokey\_folder\_number | The folder number on which autokey will be configured and enabled. Required when using Autokey. | `string` | n/a | yes |
+| autokey\_kms\_project\_id | The ID of the project in which kms keyrings and keys will be provisioned by the Autokey. | `string` | n/a | yes |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
 | autokey\_config\_id | An Autokey configuration identifier. |
-| autokey\_keyhandles | A map of KeyHandles created. |
-| random\_suffix | Random 4 digits suffix used in Autokey submodule. |
 
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

modules/autokey/iam.tf

@@ -15,12 +15,11 @@
  */
 
 data "google_project" "kms_project" {
-  project_id = var.project_id
+  project_id = var.autokey_kms_project_id
 }
 
 #Create KMS Service Agent
 resource "google_project_service_identity" "kms_service_agent" {
-  count    = var.autokey_handles != null ? 1 : 0
   provider = google-beta
 
   service = "cloudkms.googleapis.com"
@@ -29,27 +28,22 @@ resource "google_project_service_identity" "kms_service_agent" {
 
 # Wait delay after creating service agent.
 resource "time_sleep" "wait_service_agent" {
-  count = var.autokey_handles != null ? 1 : 0
-
   create_duration = "10s"
   depends_on      = [google_project_service_identity.kms_service_agent]
 }
 
 #Grant the KMS Service Agent the Cloud KMS Admin role
 resource "google_project_iam_member" "autokey_project_admin" {
-  count    = var.autokey_handles != null ? 1 : 0
   provider = google-beta
 
-  project    = var.project_id
+  project    = var.autokey_kms_project_id
   role       = "roles/cloudkms.admin"
   member     = "serviceAccount:service-${data.google_project.kms_project.number}@gcp-sa-cloudkms.iam.gserviceaccount.com"
   depends_on = [time_sleep.wait_service_agent]
 }
 
 # Wait delay after granting IAM permissions
 resource "time_sleep" "wait_srv_acc_permissions" {
-  count = var.autokey_handles != null ? 1 : 0
-
   create_duration = "10s"
   depends_on      = [google_project_iam_member.autokey_project_admin]
 }

modules/autokey/main.tf

@@ -18,27 +18,6 @@ resource "google_kms_autokey_config" "primary" {
   provider = google-beta
 
   folder      = var.autokey_folder_number
-  key_project = "projects/${var.project_id}"
-}
-
-resource "random_string" "suffix" {
-  length  = 4
-  special = false
-  upper   = false
-}
-
-resource "google_kms_key_handle" "primary" {
-  for_each = var.autokey_handles != null ? var.autokey_handles : tomap({})
-  provider = google-beta
-
-  project                = each.value.project
-  name                   = "${each.value.name}-${random_string.suffix.result}"
-  location               = each.value.location
-  resource_type_selector = each.value.resource_type_selector
-
-  lifecycle {
-    ignore_changes = [name]
-  }
-
-  depends_on = [time_sleep.wait_srv_acc_permissions]
+  key_project = "projects/${var.autokey_kms_project_id}"
+  depends_on  = [time_sleep.wait_srv_acc_permissions]
 }