mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-07-23 15:30:44 -04:00
01f9a30017
* deps: update Terraform dependencies * deps: tidy all modules --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
107 lines
3.4 KiB
HCL
107 lines
3.4 KiB
HCL
terraform {
|
|
required_providers {
|
|
google = {
|
|
source = "hashicorp/google"
|
|
version = "6.36.0"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "google" {
|
|
project = var.project_id
|
|
region = var.region
|
|
zone = var.zone
|
|
}
|
|
|
|
locals {
|
|
sa_name = var.name_prefix == "" ? var.service_account_id : "${var.name_prefix}-sa"
|
|
sa_vm_name = var.name_prefix == "" ? "${var.service_account_id}-vm" : "${var.name_prefix}-sa-vm"
|
|
}
|
|
|
|
resource "google_service_account" "vm" {
|
|
account_id = local.sa_vm_name
|
|
display_name = "Constellation service account for VMs"
|
|
description = "Service account used by the VMs"
|
|
}
|
|
|
|
resource "google_service_account" "service_account" {
|
|
account_id = local.sa_name
|
|
display_name = "Constellation service account"
|
|
description = "Service account used inside Constellation"
|
|
}
|
|
|
|
// service_account creation is eventually consistent so add a delay to ensure it is created before the next step: https://registry.terraform.io/providers/hashicorp/google/4.69.1/docs/resources/google_service_account.html
|
|
resource "null_resource" "delay" {
|
|
provisioner "local-exec" {
|
|
command = "sleep 15"
|
|
}
|
|
triggers = {
|
|
"service_account" = "${google_service_account.service_account.id}"
|
|
}
|
|
}
|
|
|
|
|
|
resource "google_project_iam_member" "instance_admin_role" {
|
|
project = var.project_id
|
|
role = "roles/compute.instanceAdmin.v1"
|
|
member = "serviceAccount:${google_service_account.service_account.email}"
|
|
depends_on = [null_resource.delay]
|
|
}
|
|
|
|
resource "google_project_iam_member" "network_admin_role" {
|
|
project = var.project_id
|
|
role = "roles/compute.networkAdmin"
|
|
member = "serviceAccount:${google_service_account.service_account.email}"
|
|
depends_on = [null_resource.delay]
|
|
}
|
|
|
|
resource "google_project_iam_member" "security_admin_role" {
|
|
project = var.project_id
|
|
role = "roles/compute.securityAdmin"
|
|
member = "serviceAccount:${google_service_account.service_account.email}"
|
|
depends_on = [null_resource.delay]
|
|
}
|
|
|
|
resource "google_project_iam_member" "storage_admin_role" {
|
|
project = var.project_id
|
|
role = "roles/compute.storageAdmin"
|
|
member = "serviceAccount:${google_service_account.service_account.email}"
|
|
depends_on = [null_resource.delay]
|
|
}
|
|
|
|
resource "google_project_iam_member" "iam_service_account_user_role" {
|
|
project = var.project_id
|
|
role = "roles/iam.serviceAccountUser"
|
|
member = "serviceAccount:${google_service_account.service_account.email}"
|
|
depends_on = [null_resource.delay]
|
|
}
|
|
|
|
resource "google_project_iam_custom_role" "vm" {
|
|
# role_id must not contain dashes
|
|
role_id = replace("${local.sa_vm_name}-role", "-", "_")
|
|
title = "Constellation IAM role for VMs"
|
|
description = "Constellation IAM role for VMs"
|
|
permissions = [
|
|
"compute.instances.get",
|
|
"compute.instances.list",
|
|
"compute.subnetworks.get",
|
|
"compute.globalForwardingRules.list",
|
|
"compute.zones.list",
|
|
"compute.forwardingRules.list",
|
|
]
|
|
}
|
|
|
|
resource "google_project_iam_binding" "custom_role_vm_to_service_account_vm" {
|
|
project = var.project_id
|
|
role = "projects/${var.project_id}/roles/${google_project_iam_custom_role.vm.role_id}"
|
|
|
|
members = [
|
|
"serviceAccount:${google_service_account.vm.email}",
|
|
]
|
|
depends_on = [null_resource.delay]
|
|
}
|
|
|
|
resource "google_service_account_key" "service_account_key" {
|
|
service_account_id = google_service_account.service_account.name
|
|
depends_on = [null_resource.delay]
|
|
}
|