terraform-google-modules / terraform-example-foundation

Shows how the CFT modules can be composed to build a secure cloud foundation
https://cloud.google.com/architecture/security-foundations
Apache License 2.0
1.22k stars 714 forks source link

Bucket name length exceeds 63 characters with non-US region deployment #1166

Open mromascanu123 opened 6 months ago

mromascanu123 commented 6 months ago

TL;DR

When deploying 1-org Error: error: bucket name validation failed bkt-cai-monitoring-5003-sources-699933893618-northamerica-northeast2 with module.cai_monitoring.module.cloudfunction_source_bucket.google_storage_bucket.bucket, on ../../../terraform-google-modules/cloud-storage/google/modules/simple_bucket/main.tf line 17, in resource "google_storage_bucket" "bucket": 17: resource "google_storage_bucket" "bucket" {

Expected behavior

Limit name to max 63 characters regardless of how long the region name is

Observed behavior

No response

Terraform Configuration

in 0-bootstrap terraform.tfvars
org_id = "9468...etc..." # format "000000000000"
billing_account = "01A591-... etc..." # format "000000-000000-000000"

group_org_admins = "gcp-org-admins@gcp...etc....ca"

group_billing_admins = "gcp-billing-admins@gcp...etc...ca"

group_billing_data_users  = "gcp-billing-data-users@gcp...etc...ca"
group_audit_data_users    = "gcp-audit-data-users@gcp...etc...ca"
group_monitoring_workspace_users = "gcp-monitoring-workspace-users@gcp...etc...ca"

default_region = "northamerica-northeast2"

Terraform Version

[myself@linuxbox 0-bootstrap]# terraform version
Terraform v1.6.0
on linux_amd64
+ provider registry.terraform.io/hashicorp/google v5.20.0
+ provider registry.terraform.io/hashicorp/google-beta v5.20.0
+ provider registry.terraform.io/hashicorp/null v3.2.2
+ provider registry.terraform.io/hashicorp/random v3.6.0
+ provider registry.terraform.io/hashicorp/time v0.11.1

Your version of Terraform is out of date! The latest version
is 1.7.5. You can update by downloading from https://www.terraform.io/downloads.html
[myself@linuxbox 0-bootstrap]#

Additional information

Very easy (and tested) fix also guaranteeing uniqueness in 1-org/modules/cai-monitoring/main.tf locals { project_service_apis = [ ... etc ... ] cai_source_name = var.random_suffix ? "CAI Monitoring - ${random_id.suffix.hex}" : "CAI Monitoring"

add this:

cai_monitoring_bucket_suffix = "${random_id.suffix.hex}-sources-${data.google_project.project.number}-${var.location}" ...

module "cloudfunction_source_bucket" { ... // deterministic name length < 63 chars // name = "bkt-cai-monitoring-${random_id.suffix.hex}-sources-${data.google_project.project.number}-${var.location}" name = "bkt-cai-monitoring-${md5(local.cai_monitoring_bucket_suffix)}"

fmichaelobrien commented 6 months ago

Also verify upcoming change in https://github.com/terraform-google-modules/terraform-google-cloud-storage/pull/308

fmichaelobrien commented 5 months ago

stale bot timer restart - https://github.com/terraform-google-modules/terraform-example-foundation/blob/master/.github/workflows/stale.yml#L21

eeaton commented 4 months ago

ACK that some regions with long names tend to exceed the character limit for resource names (this problem can happen in many places, not just the bucket in this issue).

For the v5 changes, we'll evaluate if there's a better way to address this consistently, such as logic to truncate excessively long resource names, or a convention to abbreviate region names to a consistent length instead of writing out the full name.

github-actions[bot] commented 1 month ago

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days