Skip to content

Commit ad5d851

Browse files
bryan0515bryan0515
authored
feat: Added IAP Principals terraform resource for backend-service (#533)
1 parent 41f378c commit ad5d851

File tree

21 files changed

+203
-20
lines changed

21 files changed

+203
-20
lines changed

‎build/int.cloudbuild.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,27 @@ steps:
158158
- verify internal-lb-http gce-mig
159159
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
160160
args: ['/bin/bash', '-c', 'cft test run TestInternalLbGCEMIG --stage teardown --verbose']
161+
# Backend Service with IAP Enabled
162+
- id: init backend-with-iap
163+
waitFor:
164+
- teardown internal-lb-http gce-mig
165+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
166+
args: ['/bin/bash', '-c', 'cft test run TestLbBackendServiceIap --stage init --verbose']
167+
- id: apply backend-with-iap
168+
waitFor:
169+
- init backend-with-iap
170+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
171+
args: ['/bin/bash', '-c', 'cft test run TestLbBackendServiceIap --stage apply --verbose']
172+
- id: verify backend-with-iap
173+
waitFor:
174+
- apply backend-with-iap
175+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
176+
args: ['/bin/bash', '-c', 'cft test run TestLbBackendServiceIap --stage verify --verbose']
177+
- id: teardown backend-with-iap
178+
waitFor:
179+
- verify backend-with-iap
180+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
181+
args: ['/bin/bash', '-c', 'cft test run TestLbBackendServiceIap --stage teardown --verbose']
161182
tags:
162183
- 'ci'
163184
- 'integration'

‎examples/backend-with-iap/main.tf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/**
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "lb-backend-iap" {
18+
source = "terraform-google-modules/lb-http/google//modules/backend"
19+
version = "~> 12.0"
20+
21+
project_id = var.project_id
22+
name = "backend-with-iap"
23+
iap_config = {
24+
enable = true
25+
iap_members = ["user:[email protected]"]
26+
}
27+
}
28+
29+
module "lb-frontend" {
30+
source = "terraform-google-modules/lb-http/google//modules/frontend"
31+
version = "~> 12.0"
32+
33+
project_id = var.project_id
34+
name = "global-lb-fe-bucket"
35+
url_map_input = module.lb-backend-iap.backend_service_info
36+
}

‎examples/backend-with-iap/outputs.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
/**
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
18+
output "project_id" {
19+
value = var.project_id
20+
description = "Project ID of the service"
21+
}

‎examples/backend-with-iap/variables.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
type = string
19+
}

‎examples/lb-http-separate-frontend-and-backend/main.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,9 @@ module "cloud-nat-group2" {
6868
}
6969

7070
module "lb-http-backend" {
71-
source = "terraform-google-modules/lb-http/google//modules/backend"
72-
version = "~> 12.0"
71+
source = "terraform-google-modules/lb-http/google//modules/backend"
72+
version = "~> 12.0"
73+
7374
project_id = var.project_id
7475
name = "backend-lb"
7576
target_tags = [

‎metadata.display.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright 2024 Google LLC
1+
# Copyright 2025 Google LLC
22
#
33
# Licensed under the Apache License, Version 2.0 (the "License");
44
# you may not use this file except in compliance with the License.

‎metadata.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ spec:
4040
- name: serverless_negs
4141
location: modules/serverless_negs
4242
examples:
43+
- name: backend-with-iap
44+
location: examples/backend-with-iap
4345
- name: cdn-policy
4446
location: examples/cdn-policy
4547
- name: certificate-map
@@ -336,13 +338,13 @@ spec:
336338
roles:
337339
- level: Project
338340
roles:
339-
- roles/run.admin
340341
- roles/iam.serviceAccountUser
341342
- roles/certificatemanager.owner
342343
- roles/vpcaccess.admin
343344
- roles/iam.serviceAccountAdmin
344345
- roles/storage.admin
345346
- roles/compute.admin
347+
- roles/run.admin
346348
services:
347349
- certificatemanager.googleapis.com
348350
- cloudresourcemanager.googleapis.com

‎modules/backend/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ This module creates `google_compute_backend_service` resource and its dependenci
2222
| groups | The list of backend instance group which serves the traffic. | <pre>list(object({<br> group = string<br> description = optional(string)<br><br> balancing_mode = optional(string)<br> capacity_scaler = optional(number)<br> max_connections = optional(number)<br> max_connections_per_instance = optional(number)<br> max_connections_per_endpoint = optional(number)<br> max_rate = optional(number)<br> max_rate_per_instance = optional(number)<br> max_rate_per_endpoint = optional(number)<br> max_utilization = optional(number)<br> }))</pre> | `[]` | no |
2323
| health\_check | Input for creating HttpHealthCheck or HttpsHealthCheck resource for health checking this BackendService. A health check must be specified unless the backend service uses an internet or serverless NEG as a backend. | <pre>object({<br> host = optional(string, null)<br> request_path = optional(string, null)<br> request = optional(string, null)<br> response = optional(string, null)<br> port = optional(number, null)<br> port_name = optional(string, null)<br> proxy_header = optional(string, null)<br> port_specification = optional(string, null)<br> protocol = optional(string, null)<br> check_interval_sec = optional(number, 5)<br> timeout_sec = optional(number, 5)<br> healthy_threshold = optional(number, 2)<br> unhealthy_threshold = optional(number, 2)<br> logging = optional(bool, false)<br> })</pre> | `null` | no |
2424
| host\_path\_mappings | The list of host/path for which traffic could be sent to the backend service | <pre>list(object({<br> host = string<br> path = string<br> }))</pre> | <pre>[<br> {<br> "host": "*",<br> "path": "/*"<br> }<br>]</pre> | no |
25-
| iap\_config | Settings for enabling Cloud Identity Aware Proxy Structure. | <pre>object({<br> enable = bool<br> oauth2_client_id = optional(string)<br> oauth2_client_secret = optional(string)<br> })</pre> | <pre>{<br> "enable": false<br>}</pre> | no |
25+
| iap\_config | Settings for enabling Cloud Identity Aware Proxy and Users/SAs to be given IAP HttpResourceAccessor access to the service. | <pre>object({<br> enable = bool<br> oauth2_client_id = optional(string)<br> oauth2_client_secret = optional(string)<br> iap_members = optional(list(string))<br> })</pre> | <pre>{<br> "enable": false<br>}</pre> | no |
2626
| load\_balancing\_scheme | Load balancing scheme type (EXTERNAL for classic external load balancer, EXTERNAL\_MANAGED for Envoy-based load balancer, INTERNAL\_MANAGED for internal load balancer and INTERNAL\_SELF\_MANAGED for traffic director) | `string` | `"EXTERNAL_MANAGED"` | no |
2727
| locality\_lb\_policy | The load balancing algorithm used within the scope of the locality. | `string` | `null` | no |
2828
| log\_config | This field denotes the logging options for the load balancer traffic served by this backend service. If logging is enabled, logs will be exported to Stackdriver. | <pre>object({<br> enable = bool<br> sample_rate = number<br> })</pre> | <pre>{<br> "enable": true,<br> "sample_rate": 1<br>}</pre> | no |

‎modules/backend/main.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
locals {
1818
is_backend_bucket = var.backend_bucket_name != null && var.backend_bucket_name != ""
1919
serverless_neg_backends = local.is_backend_bucket ? [] : var.serverless_neg_backends
20+
iap_access_members = var.iap_config.enable ? coalesce(var.iap_config.iap_members, []) : []
2021
}
2122

2223
resource "google_compute_backend_service" "default" {
@@ -365,3 +366,12 @@ resource "google_compute_backend_bucket" "default" {
365366
}
366367
}
367368
}
369+
370+
resource "google_iap_web_backend_service_iam_member" "member" {
371+
for_each = toset(local.iap_access_members)
372+
project = google_compute_backend_service.default[0].project
373+
web_backend_service = google_compute_backend_service.default[0].name
374+
role = "roles/iap.httpsResourceAccessor"
375+
member = each.value
376+
}
377+

‎modules/backend/metadata.display.yaml‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright 2024 Google LLC
1+
# Copyright 2025 Google LLC
22
#
33
# Licensed under the Apache License, Version 2.0 (the "License");
44
# you may not use this file except in compliance with the License.
@@ -31,6 +31,9 @@ spec:
3131
affinity_cookie_ttl_sec:
3232
name: affinity_cookie_ttl_sec
3333
title: Affinity Cookie Ttl Sec
34+
backend_bucket_name:
35+
name: backend_bucket_name
36+
title: Backend Bucket Name
3437
cdn_policy:
3538
name: cdn_policy
3639
title: Cdn Policy
@@ -66,6 +69,9 @@ spec:
6669
firewall_projects:
6770
name: firewall_projects
6871
title: Firewall Projects
72+
firewall_source_ranges:
73+
name: firewall_source_ranges
74+
title: Firewall Source Ranges
6975
groups:
7076
name: groups
7177
title: Groups
@@ -79,6 +85,12 @@ spec:
7985
iap_config:
8086
name: iap_config
8187
title: Iap Config
88+
properties:
89+
iap_members:
90+
name: iap_members
91+
title: Iap Members
92+
regexValidation: ^(?:allUsers|allAuthenticatedUsers)$|^((?:user|group|serviceAccount):(?:[a-zA-Z0-9._-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})|(?:domain:(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,})|(?:projectOwner|projectEditor|projectViewer):[a-z][a-z0-9-]{0,28}[a-z0-9])$
93+
validation: Must be allUsers, allAuthenticatedUsers, or a service account in the format serviceAccount:[email protected]. [More info](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iap_web_backend_service_iam#google_iap_web_backend_service_iam_member).
8294
load_balancing_scheme:
8395
name: load_balancing_scheme
8496
title: Load Balancing Scheme
@@ -125,3 +137,6 @@ spec:
125137
target_tags:
126138
name: target_tags
127139
title: Target Tags
140+
timeout_sec:
141+
name: timeout_sec
142+
title: Timeout Sec

0 commit comments

Comments
 (0)