sink for billing account

0-bootstrap/sa.tf

@@ -227,3 +227,9 @@ resource "google_billing_account_iam_member" "billing_admin_user" {
     google_billing_account_iam_member.tf_billing_user
   ]
 }
+
+resource "google_billing_account_iam_member" "billing_account_sink" {
+  billing_account_id = var.billing_account
+  role               = "roles/logging.configWriter"
+  member             = "serviceAccount:${google_service_account.terraform-env-sa["org"].email}"
+}

1-org/modules/centralized-logging/main.tf

@@ -90,6 +90,22 @@ module "log_export" {
   include_children       = local.include_children
 }
 
+########################################################
+module "log_export_billing" {
+  source  = "terraform-google-modules/log-export/google"
+  version = "~> 7.4"
+
+  for_each = var.enable_billing_account_sink != "" ? local.log_export : {}
+
+  destination_uri        = local.destination_uri_map[each.value.type]
+  filter                 = ""
+  log_sink_name          = "${coalesce(each.value.options.logging_sink_name, local.logging_sink_name_map[each.value.type])}-billing"
+  parent_resource_id     = var.billing_account
+  parent_resource_type   = "billing_account"
+  unique_writer_identity = true
+}
+########################################################
+
 #-------------------------#
 # Send logs to Log Bucket #
 #-------------------------#

1-org/modules/centralized-logging/variables.tf

@@ -24,13 +24,14 @@ variable "resources" {
   }
 }
 
+###
 variable "resource_type" {
-  description = "Resource type of the resource that will export logs to destination. Must be: project, organization, or folder."
+  description = "Resource type of the resource that will export logs to destination. Must be: project, organization, billing_account or folder."
   type        = string
 
   validation {
-    condition     = contains(["project", "folder", "organization"], var.resource_type)
-    error_message = "The resource_type value must be: project, organization, or folder."
+    condition     = contains(["project", "folder", "organization", "billing_account"], var.resource_type)
+    error_message = "The resource_type value must be: project, organization, billing_account or folder."
   }
 }
 
@@ -40,6 +41,20 @@ variable "logging_project_key" {
   default     = ""
 }
 
+###
+variable "billing_account" {
+  description = "Billing Account ID used in case sinks are under billing account level. Format 000000-000000-000000."
+  type        = string
+  default     = "010ECE-40301B-50DDD5"
+}
+
+###
+variable "enable_billing_account_sink" {
+description = "Verify if billing account will be logged in the sink."
+  type        = bool
+  default     = true
+}
+
 variable "logging_destination_project_id" {
   description = "The ID of the project that will have the resources where the logs will be created."
   type        = string