metadata.yaml

# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: blueprints.cloud.google.com/v1alpha1
kind: BlueprintMetadata
metadata:
  name: terraform-google-cloud-storage
  annotations:
    config.kubernetes.io/local-config: "true"
spec:
  info:
    title: Terraform Google Cloud Storage Module
    source:
      repo: https://github.com/terraform-google-modules/terraform-google-cloud-storage.git
      sourceType: git
      dir: /modules/simple_bucket
    version: 8.0.0
    actuationTool:
      flavor: Terraform
      version: ">= 0.13"
    description: {}
  content:
    examples:
      - name: multiple_buckets
        location: examples/multiple_buckets
      - name: simple_bucket
        location: examples/simple_bucket
  interfaces:
    variables:
      - name: name
        description: The name of the bucket.
        varType: string
        required: true
      - name: project_id
        description: The ID of the project to create the bucket in.
        varType: string
        required: true
      - name: location
        description: The location of the bucket. See https://cloud.google.com/storage/docs/locations.
        varType: string
        required: true
      - name: storage_class
        description: The Storage Class of the new bucket.
        varType: string
      - name: labels
        description: A set of key/value label pairs to assign to the bucket.
        varType: map(string)
      - name: bucket_policy_only
        description: Enables Bucket Policy Only access to a bucket.
        varType: bool
        defaultValue: true
      - name: versioning
        description: While set to true, versioning is fully enabled for this bucket.
        varType: bool
        defaultValue: true
      - name: autoclass
        description: While set to true, autoclass is enabled for this bucket.
        varType: bool
        defaultValue: false
      - name: force_destroy
        description: When deleting a bucket, this boolean option will delete all contained objects. If false, Terraform will fail to delete buckets which contain objects.
        varType: bool
        defaultValue: false
      - name: iam_members
        description: The list of IAM members to grant permissions on the bucket.
        varType: |-
          list(object({
              role   = string
              member = string
            }))
        defaultValue: []
        connections:
          - source:
              source: github.com/GoogleCloudPlatform/terraform-google-cloud-run//modules/v2
              version: ~> 0.13
            spec:
              outputExpr: '{"member": service_account_id.member, "role": "roles/storage.objectAdmin"}'
          - source:
              source: github.com/terraform-google-modules/terraform-google-service-accounts//modules/simple-sa
              version: ~> 4.4
            spec:
              outputExpr: '{"member": iam_email, "role": "roles/storage.objectAdmin"}'
      - name: retention_policy
        description: Configuration of the bucket's data retention policy for how long objects in the bucket should be retained.
        varType: |-
          object({
              is_locked        = bool
              retention_period = number
            })
      - name: custom_placement_config
        description: Configuration of the bucket's custom location in a dual-region bucket setup. If the bucket is designated a single or multi-region, the variable are null.
        varType: |-
          object({
              data_locations = list(string)
            })
      - name: cors
        description: Configuration of CORS for bucket with structure as defined in https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/storage_bucket#cors.
        varType: any
        defaultValue: []
      - name: encryption
        description: A Cloud KMS key that will be used to encrypt objects inserted into this bucket. To use a Cloud KMS key automatically created by the module use `internal_encryption_config`.
        varType: |-
          object({
              default_kms_key_name = string
            })
      - name: lifecycle_rules
        description: The bucket's Lifecycle Rules configuration.
        varType: |-
          list(object({
              # Object with keys:
              # - type - The type of the action of this Lifecycle Rule. Supported values: Delete and SetStorageClass.
              # - storage_class - (Required if action type is SetStorageClass) The target Storage Class of objects affected by this Lifecycle Rule.
              action = any

              # Object with keys:
              # - age - (Optional) Minimum age of an object in days to satisfy this condition.
              # - created_before - (Optional) Creation date of an object in RFC 3339 (e.g. 2017-06-13) to satisfy this condition.
              # - with_state - (Optional) Match to live and/or archived objects. Supported values include: "LIVE", "ARCHIVED", "ANY".
              # - matches_storage_class - (Optional) Storage Class of objects to satisfy this condition. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, STANDARD, DURABLE_REDUCED_AVAILABILITY.
              # - matches_prefix - (Optional) One or more matching name prefixes to satisfy this condition.
              # - matches_suffix - (Optional) One or more matching name suffixes to satisfy this condition
              # - num_newer_versions - (Optional) Relevant only for versioned objects. The number of newer versions of an object to satisfy this condition.
              condition = any
            }))
        defaultValue: []
      - name: log_bucket
        description: The bucket that will receive log objects.
        varType: string
      - name: log_object_prefix
        description: The object prefix for log objects. If it's not provided, by default GCS sets this to this bucket's name
        varType: string
      - name: website
        description: "Map of website values. Supported attributes: main_page_suffix, not_found_page"
        varType: map(any)
        defaultValue: {}
      - name: public_access_prevention
        description: Prevents public access to a bucket. Acceptable values are inherited or enforced. If inherited, the bucket uses public access prevention, only if the bucket is subject to the public access prevention organization policy constraint.
        varType: string
        defaultValue: inherited
      - name: soft_delete_policy
        description: Soft delete policies to apply. Format is the same as described in provider documentation https://www.terraform.io/docs/providers/google/r/storage_bucket.html#nested_soft_delete_policy
        varType: |-
          object({
              retention_duration_seconds = optional(number)
            })
        defaultValue: {}
      - name: internal_encryption_config
        description: "  Configuration for the creation of an internal Google Cloud Key Management Service (KMS) Key for use as Customer-managed encryption key (CMEK) for the GCS Bucket\n  instead of creating one in advance and providing the key in the variable `encryption.default_kms_key_name`.\n  create_encryption_key: If `true` a Google Cloud Key Management Service (KMS) KeyRing and a Key will be created\n  prevent_destroy: Set the prevent_destroy lifecycle attribute on keys.\n  key_destroy_scheduled_duration: Set the period of time that versions of keys spend in the `DESTROY_SCHEDULED` state before transitioning to `DESTROYED`.\n  key_rotation_period: Generate a new key every time this period passes.\n"
        varType: |-
          object({
              create_encryption_key          = optional(bool, false)
              prevent_destroy                = optional(bool, false)
              key_destroy_scheduled_duration = optional(string, null)
              key_rotation_period            = optional(string, "7776000s")
            })
        defaultValue: {}
    outputs:
      - name: apphub_service_uri
        description: URI in CAIS style to be used by Apphub.
        type:
          - object
          - service_id: string
            service_uri: string
      - name: bucket
        description: The created storage bucket
        type:
          - object
          - autoclass:
              - list
              - - object
                - enabled: bool
                  terminal_storage_class: string
            cors:
              - list
              - - object
                - max_age_seconds: number
                  method:
                    - list
                    - string
                  origin:
                    - list
                    - string
                  response_header:
                    - list
                    - string
            custom_placement_config:
              - list
              - - object
                - data_locations:
                    - set
                    - string
            default_event_based_hold: bool
            effective_labels:
              - map
              - string
            enable_object_retention: bool
            encryption:
              - list
              - - object
                - default_kms_key_name: string
            force_destroy: bool
            id: string
            labels:
              - map
              - string
            lifecycle_rule:
              - list
              - - object
                - action:
                    - set
                    - - object
                      - storage_class: string
                        type: string
                  condition:
                    - set
                    - - object
                      - age: number
                        created_before: string
                        custom_time_before: string
                        days_since_custom_time: number
                        days_since_noncurrent_time: number
                        matches_prefix:
                          - list
                          - string
                        matches_storage_class:
                          - list
                          - string
                        matches_suffix:
                          - list
                          - string
                        no_age: bool
                        noncurrent_time_before: string
                        num_newer_versions: number
                        send_age_if_zero: bool
                        send_days_since_custom_time_if_zero: bool
                        send_days_since_noncurrent_time_if_zero: bool
                        send_num_newer_versions_if_zero: bool
                        with_state: string
            location: string
            logging:
              - list
              - - object
                - log_bucket: string
                  log_object_prefix: string
            name: string
            project: string
            project_number: number
            public_access_prevention: string
            requester_pays: bool
            retention_policy:
              - list
              - - object
                - is_locked: bool
                  retention_period: number
            rpo: string
            self_link: string
            soft_delete_policy:
              - list
              - - object
                - effective_time: string
                  retention_duration_seconds: number
            storage_class: string
            terraform_labels:
              - map
              - string
            timeouts:
              - object
              - create: string
                read: string
                update: string
            uniform_bucket_level_access: bool
            url: string
            versioning:
              - list
              - - object
                - enabled: bool
            website:
              - list
              - - object
                - main_page_suffix: string
                  not_found_page: string
      - name: internal_kms_configuration
        description: The intenal KMS Resource.
      - name: name
        description: Bucket name.
        type: string
      - name: url
        description: Bucket URL.
        type: string
  requirements:
    roles:
      - level: Project
        roles:
          - roles/cloudkms.admin
          - roles/iam.serviceAccountUser
          - roles/storage.admin
    services:
      - cloudkms.googleapis.com
      - cloudresourcemanager.googleapis.com
      - compute.googleapis.com
      - iam.googleapis.com
      - serviceusage.googleapis.com
      - storage-api.googleapis.com
    providerVersions:
      - source: hashicorp/google
        version: ">= 5.43.0, < 7"