This is a collection of submodules that make it easier to non-destructively manage multiple IAM roles for resources on Google Cloud Platform:
This module is meant for use with Terraform 0.13+ and tested using Terraform 1.0+. If you find incompatibilities using Terraform >=0.13, please open an issue. If you haven't upgraded and need a Terraform 0.12.x-compatible version of this module, the last released version intended for Terraform 0.12.x is v6.4.1.
The following guides are available to assist with upgrades:
Full examples are in the examples folder, but basic usage is as follows for managing roles on two projects:
module "projects_iam_bindings" {
source = "terraform-google-modules/iam/google//modules/projects_iam"
version = "~> 7.7"
projects = ["project-123456", "project-9876543"]
bindings = {
"roles/storage.admin" = [
"group:test_sa_group@lnescidev.com",
"user:someone@google.com",
]
"roles/compute.networkAdmin" = [
"group:test_sa_group@lnescidev.com",
"user:someone@google.com",
]
"roles/compute.imageUser" = [
"user:someone@google.com",
]
}
}
The module also offers an authoritative mode which will remove all roles not assigned through Terraform. This is an example of using the authoritative mode to manage access to a storage bucket:
module "storage_buckets_iam_bindings" {
source = "terraform-google-modules/iam/google//modules/storage_buckets_iam"
version = "~> 8.0"
storage_buckets = ["my-storage-bucket"]
mode = "authoritative"
bindings = {
"roles/storage.legacyBucketReader" = [
"user:josemanuelt@google.com",
"group:test_sa_group@lnescidev.com",
]
"roles/storage.legacyBucketWriter" = [
"user:josemanuelt@google.com",
"group:test_sa_group@lnescidev.com",
]
}
}
The mode
variable controls a submodule's behavior, by default it's set to "additive", possible options are:
In authoritative mode, a submodule takes full control over the IAM bindings listed in the module. This means that any members added to roles outside the module will be removed the next time Terraform runs. However, roles not listed in the module will be unaffected.
In additive mode, a submodule leaves existing bindings unaffected. Instead, any members listed in the module will be added to the existing set of IAM bindings. However, members listed in the module are fully controlled by the module. This means that if you add a binding via the module and later remove it, the module will correctly handle removing the role binding.
Each submodule performs operations over some variables before making any changes on the IAM bindings in GCP. Because of the limitations of for_each
(more info), which is widely used in the submodules, there are certain limitations to what kind of dynamic values you can provide to a submodule:
projects
) are only allowed for 1 entity.projects
), the configuration MUST be static, meaning that it can't use any of the other resources' fields to get the entity name from (this includes getting the randomly generated hashes through the random_id
resource).authoritative
mode.You can choose the following resource types to apply the IAM bindings:
projects
variable)organizations
variable)folders
variable)service_accounts
variable)subnets
variable)storage_buckets
variable)pubsub_topics
variable)pubsub_subscriptions
variable)kms_key_rings
variable)kms_crypto_keys
variable)secrets
variable)managed_zones
variable)Set the specified variable on the module call to choose the resources to affect. Remember to set the mode
variable and give enough permissions to manage the selected resource as well. Note that the bindings
variable accepts an empty map {}
passed in as an argument in the case that resources don't have IAM bindings to apply.
In order to execute a submodule you must have a Service Account with an appropriate role to manage IAM for the applicable resource. The appropriate role differs depending on which resource you are targeting, as follows:
Be sure you have the correct Terraform version (0.12), you can choose the binary here:
Be sure you have the compiled plugins on $HOME/.terraform.d/plugins/
See each plugin page for more information about how to compile and use them.
For a fast install, please configure the variables on init_centos.sh or init_debian.sh script and then launch it.
The script will do: