Skip to content

Commit cf84229

Browse files
arthurlapertosaarthurlapertosa
authored
feat: add confidential computing example for intel arch (#435)
1 parent 51b5b7e commit cf84229

File tree

19 files changed

+471
-0
lines changed

19 files changed

+471
-0
lines changed

‎examples/confidential_computing_intel/README.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# confidential computing vm
2+
3+
This is an example of a vm creation with confidential computing,
4+
intel architecture, encrypted disk using a multiregion (US by default)
5+
Cloud HSM key and a custom service account with cloud-platform scope.
6+
It also creates org policies enforcing the use of CMEK encrypted instances
7+
and confidential computing to all newly created VMs within the project.
8+
Also, an additional org policy constraint is created, which only allows
9+
Cloud KMS keys (used for CMEK protection) that come from the provided input project.
10+
Note: existing VM instances won't be affected by the new org policy.
11+
12+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
13+
## Inputs
14+
15+
| Name | Description | Type | Default | Required |
16+
|------|-------------|------|---------|:--------:|
17+
| key | Key name. | `string` | n/a | yes |
18+
| keyring | Keyring name. | `string` | n/a | yes |
19+
| location | Location for the resources (keyring, key, network, etc.). | `string` | `"us"` | no |
20+
| project\_id | The Google Cloud project ID. | `string` | n/a | yes |
21+
| region | The GCP region to create and test resources in. | `string` | `"us-central1"` | no |
22+
| service\_account\_roles | Predefined roles for the Service account that will be created for the VM. Remember to follow principles of least privileges with Cloud IAM. | `list(string)` | `[]` | no |
23+
| subnetwork | The subnetwork selflink to host the compute instances in. | `string` | n/a | yes |
24+
| suffix | A suffix to be used as an identifier for resources. (e.g., suffix for KMS Key, Keyring). | `string` | `""` | no |
25+
26+
## Outputs
27+
28+
| Name | Description |
29+
|------|-------------|
30+
| instance\_self\_link | Self-link for compute instance. |
31+
| name | Name of the instance templates. |
32+
| self\_link | Self-link to the instance template. |
33+
| suffix | Suffix used as an identifier for resources. |
34+
35+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/confidential_computing_intel/main.tf‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
default_suffix = var.suffix == "" ? random_string.suffix.result : "${random_string.suffix.result}-${var.suffix}"
19+
key_name = "${var.key}-${local.default_suffix}"
20+
}
21+
22+
resource "random_string" "suffix" {
23+
length = 4
24+
special = false
25+
upper = false
26+
}
27+
28+
module "kms" {
29+
source = "terraform-google-modules/kms/google"
30+
version = "3.0.0"
31+
32+
keyring = "${var.keyring}-${local.default_suffix}"
33+
location = var.location
34+
project_id = var.project_id
35+
keys = [local.key_name]
36+
purpose = "ENCRYPT_DECRYPT"
37+
key_protection_level = "HSM"
38+
prevent_destroy = false
39+
}
40+
41+
resource "google_service_account" "default" {
42+
project = var.project_id
43+
account_id = "confidential-compute-sa"
44+
display_name = "Custom SA for confidential VM Instance"
45+
}
46+
47+
resource "google_project_iam_member" "service_account_roles" {
48+
for_each = toset(var.service_account_roles)
49+
50+
project = var.project_id
51+
role = each.key
52+
member = "serviceAccount:${google_service_account.default.email}"
53+
}
54+
55+
data "google_project" "project" {
56+
project_id = var.project_id
57+
}
58+
59+
resource "google_kms_crypto_key_iam_binding" "crypto_key" {
60+
crypto_key_id = module.kms.keys[local.key_name]
61+
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
62+
members = [
63+
"serviceAccount:service-${data.google_project.project.number}@compute-system.iam.gserviceaccount.com",
64+
]
65+
}
66+
67+
module "instance_template" {
68+
source = "terraform-google-modules/vm/google//modules/instance_template"
69+
70+
region = var.region
71+
project_id = var.project_id
72+
subnetwork = var.subnetwork
73+
74+
name_prefix = "confidential-intel-encrypted"
75+
source_image_project = "tdx-guest-images"
76+
source_image = "ubuntu-2204-lts"
77+
disk_type = "pd-ssd"
78+
machine_type = "c3-standard-4"
79+
min_cpu_platform = "Intel Sapphire Rapids"
80+
enable_confidential_vm = true
81+
confidential_instance_type = "TDX"
82+
83+
service_account = {
84+
email = google_service_account.default.email
85+
scopes = ["cloud-platform"]
86+
}
87+
disk_encryption_key = module.kms.keys[local.key_name]
88+
}
89+
90+
module "compute_instance" {
91+
source = "terraform-google-modules/vm/google//modules/compute_instance"
92+
version = "~> 12.0"
93+
94+
region = var.region
95+
subnetwork = var.subnetwork
96+
hostname = "confidential-intel-encrypted"
97+
instance_template = module.instance_template.self_link
98+
deletion_protection = false
99+
}

‎examples/confidential_computing_intel/org_policies.tf‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "confidential-computing-org-policy" {
18+
source = "terraform-google-modules/org-policy/google"
19+
version = "~> 5.3"
20+
21+
project_id = var.project_id
22+
policy_for = "project"
23+
constraint = "constraints/compute.restrictNonConfidentialComputing"
24+
policy_type = "list"
25+
deny = ["compute.googleapis.com"]
26+
deny_list_length = 1
27+
}
28+
29+
module "enforce-cmek-org-policy" {
30+
source = "terraform-google-modules/org-policy/google"
31+
version = "~> 5.3"
32+
33+
project_id = var.project_id
34+
policy_for = "project"
35+
constraint = "constraints/gcp.restrictNonCmekServices"
36+
policy_type = "list"
37+
deny = ["compute.googleapis.com"]
38+
deny_list_length = 1
39+
}
40+
41+
module "restrict-cmek-cryptokey-projects-policy" {
42+
source = "terraform-google-modules/org-policy/google"
43+
version = "~> 5.3"
44+
45+
project_id = var.project_id
46+
policy_for = "project"
47+
constraint = "constraints/gcp.restrictCmekCryptoKeyProjects"
48+
policy_type = "list"
49+
allow = ["projects/${var.project_id}"]
50+
allow_list_length = 1
51+
}

‎examples/confidential_computing_intel/outputs.tf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
18+
output "self_link" {
19+
description = "Self-link to the instance template."
20+
value = module.instance_template.self_link
21+
}
22+
23+
output "name" {
24+
description = "Name of the instance templates."
25+
value = module.instance_template.name
26+
}
27+
28+
output "instance_self_link" {
29+
description = "Self-link for compute instance."
30+
value = module.compute_instance.instances_self_links[0]
31+
}
32+
33+
output "suffix" {
34+
description = "Suffix used as an identifier for resources."
35+
value = local.default_suffix
36+
}

‎examples/confidential_computing_intel/variables.tf‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The Google Cloud project ID."
19+
type = string
20+
}
21+
22+
variable "region" {
23+
description = "The GCP region to create and test resources in."
24+
type = string
25+
default = "us-central1"
26+
}
27+
28+
variable "subnetwork" {
29+
description = "The subnetwork selflink to host the compute instances in."
30+
type = string
31+
}
32+
33+
variable "location" {
34+
description = "Location for the resources (keyring, key, network, etc.)."
35+
type = string
36+
default = "us"
37+
}
38+
39+
variable "suffix" {
40+
description = "A suffix to be used as an identifier for resources. (e.g., suffix for KMS Key, Keyring)."
41+
type = string
42+
default = ""
43+
}
44+
45+
variable "keyring" {
46+
description = "Keyring name."
47+
type = string
48+
}
49+
50+
variable "key" {
51+
description = "Key name."
52+
type = string
53+
}
54+
55+
variable "service_account_roles" {
56+
description = "Predefined roles for the Service account that will be created for the VM. Remember to follow principles of least privileges with Cloud IAM."
57+
type = list(string)
58+
default = []
59+
}

‎metadata.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,8 @@ spec:
5252
location: examples/confidential_computing
5353
- name: confidential_computing
5454
location: examples/instance_template/confidential_computing
55+
- name: confidential_computing_intel
56+
location: examples/confidential_computing_intel
5557
- name: disk_snapshot
5658
location: examples/compute_instance/disk_snapshot
5759
- name: encrypted_disks

‎modules/compute_disk_snapshot/metadata.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ spec:
4242
location: examples/confidential_computing
4343
- name: confidential_computing
4444
location: examples/instance_template/confidential_computing
45+
- name: confidential_computing_intel
46+
location: examples/confidential_computing_intel
4547
- name: disk_snapshot
4648
location: examples/compute_instance/disk_snapshot
4749
- name: encrypted_disks

‎modules/compute_instance/metadata.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ spec:
4242
location: examples/confidential_computing
4343
- name: confidential_computing
4444
location: examples/instance_template/confidential_computing
45+
- name: confidential_computing_intel
46+
location: examples/confidential_computing_intel
4547
- name: disk_snapshot
4648
location: examples/compute_instance/disk_snapshot
4749
- name: encrypted_disks

‎modules/instance_template/metadata.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ spec:
4242
location: examples/confidential_computing
4343
- name: confidential_computing
4444
location: examples/instance_template/confidential_computing
45+
- name: confidential_computing_intel
46+
location: examples/confidential_computing_intel
4547
- name: disk_snapshot
4648
location: examples/compute_instance/disk_snapshot
4749
- name: encrypted_disks

‎modules/mig/metadata.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ spec:
4242
location: examples/confidential_computing
4343
- name: confidential_computing
4444
location: examples/instance_template/confidential_computing
45+
- name: confidential_computing_intel
46+
location: examples/confidential_computing_intel
4547
- name: disk_snapshot
4648
location: examples/compute_instance/disk_snapshot
4749
- name: encrypted_disks

0 commit comments

Comments
 (0)