Skip to content

Latest commit

 

History

History
119 lines (101 loc) · 7.18 KB

README.md

File metadata and controls

119 lines (101 loc) · 7.18 KB
Raw

Google Cloud Project Factory with G Suite Terraform Module

This module performs the same functions as the root module with the addition of integrating G Suite.

Usage

There are multiple examples included in the examples folder but simple usage is as follows:

module "project-factory" {
  source = "terraform-google-modules/project-factory/google//modules/gsuite_enabled"
  version = "~> 10.1"

  billing_account   = "ABCDEF-ABCDEF-ABCDEF"
  create_group      = true
  group_name        = "test_sa_group"
  group_role        = "roles/editor"
  name              = "pf-test-1"
  org_id            = "1234567890"
  random_project_id = true
  sa_group          = "test_sa_group@yourdomain.com"
  shared_vpc        = "shared_vpc_host_name"

  shared_vpc_subnets = [
    "projects/base-project-196723/regions/us-east1/subnetworks/default",
    "projects/base-project-196723/regions/us-central1/subnetworks/default",
    "projects/base-project-196723/regions/us-central1/subnetworks/subnet-1",
  ]

  usage_bucket_name   = "pf-test-1-usage-report-bucket"
  usage_bucket_prefix = "pf/test/1/integration"
}

Features

The G Suite Enabled module will perform the following actions in addition to those of the root module:

  1. Create a new Google group for the project using group_name if create_group is true.
  2. Add the new default service account for the project to the sa_group in Google Groups, if specified.
  3. Add the Google APIs service account to the api_sa_group, if specified.

The roles granted are specifically:

  • New Default Service Account
    • MEMBER of the specified sa_group
  • Google APIs Service Account
    • MEMBER of the specified api_sa_group

Inputs

Name Description Type Default Required
activate_apis The list of apis to activate within the project list(string) 
[
  "compute.googleapis.com"
]
 no
api_sa_group A G Suite group to place the Google APIs Service Account for the project in string "" no
auto_create_network Create the default network bool false no
billing_account The ID of the billing account to associate this project with any n/a yes
bucket_location The location for a GCS bucket to create (optional) string "" no
bucket_name A name for a GCS bucket to create (in the bucket_project project), useful for Terraform state (optional) string "" no
bucket_project A project to create a GCS bucket (bucket_name) in, useful for Terraform state (optional) string "" no
bucket_versioning Enable versioning for a GCS bucket to create (optional) bool false no
budget_alert_pubsub_topic The name of the Cloud Pub/Sub topic where budget related messages will be published, in the form of projects/{project_id}/topics/{topic_id} string null no
budget_alert_spent_percents A list of percentages of the budget to alert on when threshold is exceeded list(number) 
[
  0.5,
  0.7,
  1
]
 no
budget_amount The amount to use for a budget alert number null no
budget_monitoring_notification_channels A list of monitoring notification channels in the form [projects/{project_id}/notificationChannels/{channel_id}]. A maximum of 5 channels are allowed. list(string) [] no
consumer_quotas The quotas configuration you want to override for the project. 
list(object({
    service = string,
    metric  = string,
    limit   = string,
    value   = string,
  }))
 [] no
create_group Whether to create the group or not bool false no
create_project_sa Whether the default service account for the project shall be created bool true no
default_service_account Project default service account setting: can be one of delete, deprivilege, disable, or keep. string "disable" no
disable_dependent_services Whether services that are enabled and which depend on this service should also be disabled when this service is destroyed. bool true no
disable_services_on_destroy Whether project services will be disabled when the resources are destroyed bool true no
domain The domain name (optional). string "" no
enable_shared_vpc_host_project If this project is a shared VPC host project. If true, you must not set shared_vpc variable. Default is false. bool false no
enable_shared_vpc_service_project If shared VPC should be used bool false no
folder_id The ID of a folder to host this project string "" no
group_name A group to control the project by being assigned group_role - defaults to ${project_name}-editors string "" no
group_role The role to give the controlling group (group_name) over the project (defaults to project editor) string "roles/editor" no
labels Map of labels for project map(string) {} no
lien Add a lien on the project to prevent accidental deletion bool false no
name The name for the project any n/a yes
org_id The organization ID. any n/a yes
project_id The ID to give the project. If not provided, the name will be used. string "" no
project_sa_name Default service account name for the project. string "project-service-account" no
random_project_id Adds a suffix of 4 random characters to the project_id bool false no
sa_group A G Suite group to place the default Service Account for the project in string "" no
sa_role A role to give the default Service Account for the project (defaults to none) string "" no
shared_vpc The ID of the host project which hosts the shared VPC string "" no
shared_vpc_subnets List of subnets fully qualified subnet IDs (ie. projects/$project_id/regions/$region/subnetworks/$subnet_id) list(string) [] no
usage_bucket_name Name of a GCS bucket to store GCE usage reports in (optional) string "" no
usage_bucket_prefix Prefix in the GCS bucket to store GCE usage reports in (optional) string "" no

Outputs

Name Description
domain The organization's domain
group_email The email of the created G Suite group with group_name
group_name The group_name of the G Suite group
project_bucket_self_link Project's bucket selfLink
project_bucket_url Project's bucket url
project_id n/a
project_name n/a
project_number n/a
service_account_display_name The display name of the default service account
service_account_email The email of the default service account
service_account_id The id of the default service account
service_account_name The fully-qualified name of the default service account
service_account_unique_id The unique id of the default service account