Skip to content

Commit 9fdaafa

Browse files
slightsey-recurlyslightsey-recurly
committed
feat: Adding iap_web_backend_services module
Linting
1 parent 171c15b commit 9fdaafa

File tree

8 files changed

+298
-0
lines changed

8 files changed

+298
-0
lines changed

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ This is a collection of submodules that make it easier to non-destructively mana
99
* [Custom Role IAM](modules/custom_role_iam)
1010
* [DNS Zone IAM](modules/dns_zones_iam)
1111
* [Folders IAM](modules/folders_iam)
12+
* [Iap Backend Service IAM](modules/iap_web_backend_services_iam)
1213
* [KMS Crypto Keys IAM](modules/kms_crypto_keys_iam)
1314
* [KMS_Key Rings IAM](modules/kms_key_rings_iam)
1415
* [Organizations IAM](modules/organizations_iam)
@@ -120,6 +121,7 @@ You can choose the following resource types to apply the IAM bindings:
120121
- Service Accounts (`service_accounts` variable)
121122
- Subnetworks (`subnets` variable)
122123
- Storage buckets (`storage_buckets` variable)
124+
- IAP Web Backend Service (`web_backend_services` variable)
123125
- Pubsub topics (`pubsub_topics` variable)
124126
- Pubsub subscriptions (`pubsub_subscriptions` variable)
125127
- Kms Key Rings (`kms_key_rings` variable)

‎examples/iap_web_backend_services/README.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# IAP Web Backend Service Example
2+
3+
This example illustrates how to use the `iap_web_backend_services_iam` submodule
4+
5+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
6+
## Inputs
7+
8+
| Name | Description | Type | Default | Required |
9+
|------|-------------|------|---------|:--------:|
10+
| group\_email | Email for group to receive roles (ex. [email protected]) | `string` | n/a | yes |
11+
| iap\_web\_backend\_service | Name of iap\_web\_backend\_service to bind member to | `string` | n/a | yes |
12+
| project | Project where the artifact iap\_web\_backend\_services bindings are placed | `string` | n/a | yes |
13+
| sa\_email | Email for Service Account to receive roles (Ex. [email protected]) | `string` | n/a | yes |
14+
| user\_email | Email for group to receive roles (Ex. [email protected]) | `string` | n/a | yes |
15+
16+
## Outputs
17+
18+
No outputs.
19+
20+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/iap_web_backend_services/main.tf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
/******************************************
18+
Module iap_web_backend_services calling
19+
*****************************************/
20+
module "iap_web_backend_services" {
21+
source = "terraform-google-modules/iam/google//modules/iap_web_backend_services"
22+
version = "~> 8.0"
23+
24+
iap_web_backend_services = [var.iap_web_backend_service]
25+
mode = "additive"
26+
27+
bindings = {
28+
"roles/iap.httpsResourceAccessor" = [
29+
"serviceAccount:${var.sa_email}",
30+
"group:${var.group_email}",
31+
"user:${var.user_email}",
32+
]
33+
}
34+
}

‎examples/iap_web_backend_services/variables.tf‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project" {
18+
description = "Project where the artifact iap_web_backend_services bindings are placed"
19+
type = string
20+
}
21+
22+
variable "group_email" {
23+
type = string
24+
description = "Email for group to receive roles (ex. [email protected])"
25+
}
26+
27+
variable "sa_email" {
28+
type = string
29+
description = "Email for Service Account to receive roles (Ex. [email protected])"
30+
}
31+
32+
variable "user_email" {
33+
type = string
34+
description = "Email for group to receive roles (Ex. [email protected])"
35+
}
36+
37+
/******************************************
38+
google_iap_web_backend_service_iam_binding variables
39+
*****************************************/
40+
variable "iap_web_backend_service" {
41+
type = string
42+
description = "Name of iap_web_backend_service to bind member to"
43+
}
44+
45+

‎modules/iap_web_backend_services_iam/README.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Module iap_web_backend_services IAM
2+
3+
This optional module is used to assign iap_web_backend_services roles
4+
5+
## Example Usage
6+
```
7+
module "iap_web_backend_services_iam" {
8+
source = "terraform-google-modules/iam/google//modules/iap_web_backend_services_iam"
9+
version = "~> 8.0"
10+
11+
iap_web_backend_services = ["my-iap-backend-service-name"]
12+
mode = "additive"
13+
14+
bindings = {
15+
"roles/iap.httpsResourceAccessor" = [
16+
"serviceAccount:[email protected]",
17+
"group:[email protected]",
18+
"user:[email protected]",
19+
]
20+
}
21+
conditional_bindings = [
22+
{
23+
role = "roles/storage.admin"
24+
title = "expires_after_2019_12_31"
25+
description = "Expiring at midnight of 2019-12-31"
26+
expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")"
27+
members = ["user:[email protected]"]
28+
}
29+
]
30+
}
31+
```
32+
33+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
34+
## Inputs
35+
36+
| Name | Description | Type | Default | Required |
37+
|------|-------------|------|---------|:--------:|
38+
| bindings | Map of role (key) and list of members (value) to add the IAM policies/bindings | `map(list(string))` | `{}` | no |
39+
| conditional\_bindings | List of maps of role and respective conditions, and the members to add the IAM policies/bindings | <pre>list(object({<br> role = string<br> title = string<br> description = string<br> expression = string<br> members = list(string)<br> }))</pre> | `[]` | no |
40+
| iap\_web\_backend\_services | IAP Web Backend Service list to add the IAM policies/bindings | `list(string)` | `[]` | no |
41+
| mode | Mode for adding the IAM policies/bindings, additive and authoritative | `string` | `"additive"` | no |
42+
| project | Project where the iap\_web\_backend\_services bindings are placed | `string` | n/a | yes |
43+
44+
## Outputs
45+
46+
| Name | Description |
47+
|------|-------------|
48+
| iap\_web\_backend\_services | IAP Web Backend Services which received bindings. |
49+
| members | Members which were bound to the IAP Web Backend Service. |
50+
| roles | Roles which were assigned to members. |
51+
52+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/iap_web_backend_services_iam/main.tf‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/**
2+
* Copyright 2023 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
/******************************************
18+
Run helper module to get generic calculated data
19+
*****************************************/
20+
module "helper" {
21+
source = "../helper"
22+
bindings = var.bindings
23+
mode = var.mode
24+
entities = var.iap_web_backend_services
25+
conditional_bindings = var.conditional_bindings
26+
}
27+
28+
/******************************************
29+
IAP Web Backend IAM binding authoritative
30+
*****************************************/
31+
resource "google_iap_web_backend_service_iam_binding" "iap_web_backend_service_iam_authoritative" {
32+
for_each = module.helper.set_authoritative
33+
web_backend_service = module.helper.bindings_authoritative[each.key].name
34+
project = var.project
35+
role = module.helper.bindings_authoritative[each.key].role
36+
members = module.helper.bindings_authoritative[each.key].members
37+
dynamic "condition" {
38+
for_each = module.helper.bindings_authoritative[each.key].condition.title == "" ? [] : [module.helper.bindings_authoritative[each.key].condition]
39+
content {
40+
title = module.helper.bindings_authoritative[each.key].condition.title
41+
description = module.helper.bindings_authoritative[each.key].condition.description
42+
expression = module.helper.bindings_authoritative[each.key].condition.expression
43+
}
44+
}
45+
}
46+
47+
/******************************************
48+
IAP Web Backend IAM binding additive
49+
*****************************************/
50+
resource "google_iap_web_backend_service_iam_member" "iap_web_backend_service_iam_additive" {
51+
for_each = module.helper.set_additive
52+
web_backend_service = module.helper.bindings_additive[each.key].name
53+
project = var.project
54+
role = module.helper.bindings_additive[each.key].role
55+
member = module.helper.bindings_additive[each.key].member
56+
dynamic "condition" {
57+
for_each = module.helper.bindings_additive[each.key].condition.title == "" ? [] : [module.helper.bindings_additive[each.key].condition]
58+
content {
59+
title = module.helper.bindings_additive[each.key].condition.title
60+
description = module.helper.bindings_additive[each.key].condition.description
61+
expression = module.helper.bindings_additive[each.key].condition.expression
62+
}
63+
}
64+
}

‎modules/iap_web_backend_services_iam/outputs.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
/**
2+
* Copyright 2023 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "iap_web_backend_services" {
18+
value = distinct(module.helper.bindings_by_member[*].name)
19+
description = "IAP Web Backend Services which received bindings."
20+
depends_on = [google_iap_web_backend_service_iam_binding.iap_web_backend_service_iam_authoritative, google_iap_web_backend_service_iam_member.iap_web_backend_service_iam_additive, ]
21+
}
22+
23+
output "roles" {
24+
value = distinct(module.helper.bindings_by_member[*].role)
25+
description = "Roles which were assigned to members."
26+
}
27+
28+
output "members" {
29+
value = distinct(module.helper.bindings_by_member[*].member)
30+
description = "Members which were bound to the IAP Web Backend Service."
31+
}

‎modules/iap_web_backend_services_iam/variables.tf‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/**
2+
* Copyright 2023 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "iap_web_backend_services" {
18+
description = "IAP Web Backend Service list to add the IAM policies/bindings"
19+
default = []
20+
type = list(string)
21+
}
22+
23+
variable "project" {
24+
description = "Project where the iap_web_backend_services bindings are placed"
25+
type = string
26+
}
27+
28+
variable "mode" {
29+
description = "Mode for adding the IAM policies/bindings, additive and authoritative"
30+
type = string
31+
default = "additive"
32+
}
33+
34+
variable "bindings" {
35+
description = "Map of role (key) and list of members (value) to add the IAM policies/bindings"
36+
type = map(list(string))
37+
default = {}
38+
}
39+
40+
variable "conditional_bindings" {
41+
description = "List of maps of role and respective conditions, and the members to add the IAM policies/bindings"
42+
type = list(object({
43+
role = string
44+
title = string
45+
description = string
46+
expression = string
47+
members = list(string)
48+
}))
49+
default = []
50+
}

0 commit comments

Comments
 (0)