Google Cloud Project Factory Terraform Module

FAQ | Troubleshooting Guide | Glossary.

This module allows you to create opinionated Google Cloud Platform projects. It creates projects and configures aspects like Shared VPC connectivity, IAM access, Service Accounts, and API enablement to follow best practices.

To include G Suite integration for creating groups and adding Service Accounts into groups, use the gsuite_enabled module.

Compatibility

This module is meant for use with Terraform 0.13+ and tested using Terraform 1.3+. If you find incompatibilities using Terraform >=0.13, please open an issue. If you haven't upgraded and need a Terraform 0.12.x-compatible version of this module, the last released version intended for Terraform 0.12.x is 9.2.0.

Upgrading

See the docs for detailed instructions on upgrading between major releases of the module.

Usage

There are multiple examples included in the examples folder but simple usage is as follows:

module "project-factory" {
  source  = "terraform-google-modules/project-factory/google"
  version = "~> 17.0"

  name                 = "pf-test-1"
  random_project_id    = true
  org_id               = "1234567890"
  usage_bucket_name    = "pf-test-1-usage-report-bucket"
  usage_bucket_prefix  = "pf/test/1/integration"
  billing_account      = "ABCDEF-ABCDEF-ABCDEF"
  svpc_host_project_id = "shared_vpc_host_name"

  shared_vpc_subnets = [
    "projects/base-project-196723/regions/us-east1/subnetworks/default",
    "projects/base-project-196723/regions/us-central1/subnetworks/default",
    "projects/base-project-196723/regions/us-central1/subnetworks/subnet-1",
  ]
}

Features

The Project Factory module will take the following actions:

1. Create a new GCP project using the project_name.

2. If a shared VPC is specified, attach the new project to the svpc_host_project_id.

   It will also give the following users network access on the specified subnets:

   • The project's new default service account (see step 4)
   • The Google API service account for the project
   • The project controlling group specified in group_name

3. Delete the default compute service account.

4. Create a new default service account for the project.

   1. Give it access to the shared VPC (to be able to launch instances).

5. Attach the billing account (billing_account) to the project.

6. Give the controlling group access to the project, with the group_role.

7. Enable the required and specified APIs (activate_apis).

8. Delete the default network.

9. Enable usage report for GCE into central project bucket (target_usage_bucket), if provided.

10. If specified, create the GCS bucket bucket_name and give the following accounts Storage Admin on it:

    1. The controlling group (group_name).
    2. The new default compute service account created for the project.
    3. The Google APIs service account for the project.

The roles granted are specifically:

• New Default Service Account
  • compute.networkUser on host project or specified subnets
  • storage.admin on bucket_name GCS bucket
• group_name is the controlling group
  • compute.networkUser on host project or specific subnets
  • Specified group_role on project
  • iam.serviceAccountUser on the default Service Account
  • storage.admin on bucket_name GCS bucket
• Google APIs Service Account
  • compute.networkUser on host project or specified subnets
  • storage.admin on bucket_name GCS bucket

Shared VPC subnets and IAM permissions

A service project's access to shared VPC networks is controlled via the roles/compute.networkUser role and the location to where that role is assigned. If that role is assigned to the shared VPC host project, then the service project will have access to all shared VPC subnetworks. If that role is assigned to individual subnetworks, then the service project will have access to only the subnetworks on which that role was assigned. The logic for determining that location is as follows:

1. If var.svpc_host_project_id and var.shared_vpc_subnets are not set then the compute.networkUser role is not assigned
2. If var.svpc_host_project_id is set but no subnetworks are provided via var.shared_vpc_subnets then the compute.networkUser role is assigned at the host project and the service project will have access to all shared VPC subnetworks
3. If var.svpc_host_project_id is set and var.shared_vpc_subnets contains an array of subnetworks then the compute.networkUser role is assigned to each subnetwork in the array

Inputs

list(object({
    api   = string
    roles = list(string)
  }))

[
  "compute.googleapis.com"
]

[
  0.5,
  0.7,
  1
]

list(object({
    service    = string,
    metric     = string,
    dimensions = map(string),
    limit      = string,
    value      = string,
  }))

Outputs

Requirements

Software

• gcloud sdk >= 269.0.0
• jq >= 1.6
• Terraform >= 0.13.0
• terraform-provider-google plugin >= 5.33
• terraform-provider-google-beta plugin >= 5.33
• terraform-provider-gsuite plugin ~> 0.1.x if GSuite functionality is desired

Permissions

In order to execute this module you must have a Service Account with the following roles:

• roles/resourcemanager.folderViewer on the folder that you want to create the project in
• roles/resourcemanager.organizationViewer on the organization
• roles/resourcemanager.projectCreator on the organization
• roles/billing.user on the organization
• roles/storage.admin on bucket_project
• If you are using shared VPC:
  • roles/billing.user on the organization
  • roles/compute.xpnAdmin on the organization
  • roles/compute.networkAdmin on the organization
  • roles/browser on the Shared VPC host project
  • roles/resourcemanager.projectIamAdmin on the Shared VPC host project

Script Helper

A helper script is included to create the Seed Service Account in the Seed Project, grant the necessary roles to the Seed Service Account, and enable the necessary API's in the Seed Project. Run it as follows:

./helpers/setup-sa.sh -o <organization id> -p <project id> [-b <billing account id>] [-f <folder id>] [-n <service account name>]

In order to execute this script, you must have an account with the following list of permissions:

• resourcemanager.organizations.list
• resourcemanager.projects.list
• billing.accounts.list
• iam.serviceAccounts.create
• iam.serviceAccountKeys.create
• resourcemanager.organizations.setIamPolicy
• resourcemanager.projects.setIamPolicy
• serviceusage.services.enable on the project
• servicemanagement.services.bind on following services:
  • cloudresourcemanager.googleapis.com
  • cloudbilling.googleapis.com
  • iam.googleapis.com
  • admin.googleapis.com
  • appengine.googleapis.com
• billing.accounts.getIamPolicy on a billing account.
• billing.accounts.setIamPolicy on a billing account.

Specifying credentials

The Project Factory module uses the Google Terraform provider to authenticate all GCP API calls. To configure credentials, you should configure the google and google-beta providers.

provider "google" {
  credentials = "${file(var.credentials_path)}"
}

provider "google-beta" {
  credentials = "${file(var.credentials_path)}"
}

APIs

In order to operate the Project Factory, you must activate the following APIs on the base project where the Service Account was created:

• Cloud Resource Manager API - cloudresourcemanager.googleapis.com troubleshooting
• Cloud Billing API - cloudbilling.googleapis.com troubleshooting
• Identity and Access Management API - iam.googleapis.com troubleshooting
• Admin SDK - admin.googleapis.com troubleshooting

Optional APIs

• Google App Engine Admin API - appengine.googleapis.com troubleshooting
  • Please note that if you are deploying an App Engine Flex application, you should not delete the default compute service account (as is default behavior). Please see the troubleshooting doc for more information.
• Cloud Billing Budget API - billingbudgets.googleapis.com
  • Please note this API is only required if configuring budgets for projects.

Verifying setup

A preconditions checker script is included to verify that all preconditions are met before the Project Factory runs. The script will run automatically if the script dependencies (Python, "google-auth", and "google-api-python-client") are available at runtime. If the dependencies are not met, the precondition checking step will be skipped.

The precondition checker script can be directly invoked before running the project factory:

./helpers/preconditions/preconditions.py \
  --credentials_path "./credentials.json" \
  --billing_account 000000-000000-000000 \
  --org_id 000000000000 \
  --folder_id 000000000000 \
  --shared_vpc 'shared-vpc-host-ed64'

Caveats

Moving projects from org into a folder

There is currently a bug with moving a project which was originally created at the root of the organization into a folder. The bug and workaround is described here, but as a general best practice it is easier to create all projects within folders to start. Moving projects between different folders is supported.

Deleting default service accounts

Default SAs can be removed by setting default_service_account input variable to delete, but there can be certain scenarios where the default SAs are required. Hence some considerations to be aware of:

1. Using App Engine SA.
2. Cloud Scheduler dependency on AppEngine(default SA). Default SA is required to be able to setup Cloud scheduler, please refer to the document for more upto date information.

With a combination of project-factory's default behavior, disable, and setting constraints/iam.automaticIamGrantsForDefaultServiceAccounts org constraint will address removing the default editor IAM role on the SAs and limits the SA usage. However, when the default_service_account is set to delete please be aware of the default SA dependency for AppEngine/CloudScheduler services. Accounts deleted within 30days can be restored.

G Suite

The core Project Factory solely deals with GCP APIs and does not integrate G Suite functionality. If you would like certain group-management functionality which was previously included in the Project Factory, see the G Suite module.

Install

Terraform

Be sure you have the correct Terraform version (0.13.0+), you can choose the binary here:

• https://releases.hashicorp.com/terraform/