feat: remove logging bucket [DA-3846] (#32)

* feat: remove logging bucket

* feat: add checkov skip

* fix: Fix terraform dependencies to prevent terratest failures

---------

Co-authored-by: sunilhonest <sunil@honestbank.com>

modules/gcp_gcs_bucket/README.md

@@ -17,7 +17,6 @@ This module will create bucket in GCP with enable server-side encryption and log
 |------|---------|
 | <a name="provider_google"></a> [google](#provider\_google) | ~> 5.22 |
 | <a name="provider_random"></a> [random](#provider\_random) | >= 3.0, < 4.0 |
-| <a name="provider_time"></a> [time](#provider\_time) | >= 0.11, < 1.0 |
 
 ## Modules
 
@@ -31,9 +30,7 @@ No modules.
 | [google_kms_crypto_key_iam_binding.google_kms_crypto_key_iam_binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/kms_crypto_key_iam_binding) | resource |
 | [google_kms_key_ring.google_kms_key_ring](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/kms_key_ring) | resource |
 | [google_storage_bucket.google_storage_bucket](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/storage_bucket) | resource |
-| [google_storage_bucket.google_storage_bucket_logging](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/storage_bucket) | resource |
 | [random_id.random_id](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
-| [time_sleep.time_sleep](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
 | [google_storage_project_service_account.google_storage_project_service_account](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/storage_project_service_account) | data source |
 
 ## Inputs

modules/gcp_gcs_bucket/main.tf

@@ -34,46 +34,22 @@ resource "google_kms_crypto_key" "google_kms_crypto_key" {
   rotation_period = "7776000s" # 90 days
 }
 
-resource "time_sleep" "time_sleep" {
-  depends_on = [google_kms_crypto_key.google_kms_crypto_key]
-
-  create_duration = "30s"
-}
-
 data "google_storage_project_service_account" "google_storage_project_service_account" {
   project = var.project_id
 }
 
 resource "google_kms_crypto_key_iam_binding" "google_kms_crypto_key_iam_binding" {
-  depends_on = [time_sleep.time_sleep]
-
   crypto_key_id = google_kms_crypto_key.google_kms_crypto_key.id
   role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
 
   members = ["serviceAccount:${data.google_storage_project_service_account.google_storage_project_service_account.email_address}"]
 }
 
-resource "google_storage_bucket" "google_storage_bucket_logging" {
-  #checkov:skip=CKV_GCP_62: logging bucket doesn't need a log
-  #checkov:skip=CKV_GCP_78:: logging bucket doesn't need a version
-
+resource "google_storage_bucket" "google_storage_bucket" {
+  # Ensures the storage service account has permission to use the KMS key for encryption/decryption before creating the storage bucket.
   depends_on = [google_kms_crypto_key_iam_binding.google_kms_crypto_key_iam_binding]
-  name       = "${var.name}_logging_${random_id.random_id.hex}"
-  project    = var.project_id
-
-  location                    = var.location
-  force_destroy               = var.force_destroy
-  storage_class               = "ARCHIVE"
-  uniform_bucket_level_access = true
-
-  public_access_prevention = "enforced"
 
-  encryption {
-    default_kms_key_name = google_kms_crypto_key.google_kms_crypto_key.id
-  }
-}
-
-resource "google_storage_bucket" "google_storage_bucket" {
+  #checkov:skip=CKV_GCP_62: "Bucket should log access, however we never use the access log"
   #checkov:skip=CKV_GCP_78: Bucket versioning should be enabled by default however skipping the Checkov rule as it is not a requirement for all buckets with retention policy enabled.
   name          = "${var.name}_${random_id.random_id.hex}"
   location      = var.location
@@ -91,10 +67,6 @@ resource "google_storage_bucket" "google_storage_bucket" {
     enabled = var.object_versioning_enabled
   }
 
-  logging {
-    log_bucket = google_storage_bucket.google_storage_bucket_logging.name
-  }
-
   encryption {
     default_kms_key_name = google_kms_crypto_key.google_kms_crypto_key.id
   }