Skip to content

Commit 8bf7c44

Browse files
amandakarinaamandakarina
authored
Merge branch 'master' into fix/add-local-deployment-instructions
2 parents 1b8913b + 55a06fa commit 8bf7c44

File tree

8 files changed

+12
-70
lines changed

8 files changed

+12
-70
lines changed

‎1-org/README.md‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -68,11 +68,6 @@ See [troubleshooting](../docs/TROUBLESHOOTING.md) if you run into issues during
6868

6969
## Usage
7070

71-
**Disclaimer:** This step enables [Data Access logs](https://cloud.google.com/logging/docs/audit#data-access) for all services in your organization.
72-
Enabling Data Access logs might result in your project being charged for the additional logs usage.
73-
For details on costs you might incur, go to [Pricing](https://cloud.google.com/stackdriver/pricing).
74-
You can choose not to enable the Data Access logs by setting the variable `data_access_logs_enabled` to false.
75-
7671
Consider the following:
7772

7873
- This module creates a sink to export all logs to a Cloud Logging bucket. It also creates sinks to export a subset of security-related logs

‎1-org/envs/shared/README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@
66
| billing\_export\_dataset\_location | The location of the dataset for billing data export. | `string` | `null` | no |
77
| create\_access\_context\_manager\_access\_policy | Whether to create access context manager access policy. | `bool` | `true` | no |
88
| create\_unique\_tag\_key | Creates unique organization-wide tag keys by adding a random suffix to each key. | `bool` | `false` | no |
9-
| data\_access\_logs\_enabled | Enable Data Access logs of types DATA\_READ, DATA\_WRITE for all GCP services. Enabling Data Access logs might result in your organization being charged for the additional logs usage. See https://cloud.google.com/logging/docs/audit#data-access The ADMIN\_READ logs are enabled by default. | `bool` | `false` | no |
109
| domains\_to\_allow | The list of domains to allow users from in IAM. Used by Domain Restricted Sharing Organization Policy. Must include the domain of the organization you are deploying the foundation. To add other domains you must also grant access to these domains to the Terraform Service Account used in the deploy. | `list(string)` | n/a | yes |
1110
| enable\_hub\_and\_spoke | Enable Hub-and-Spoke architecture. | `bool` | `false` | no |
1211
| enable\_scc\_resources\_in\_terraform | Create Security Command Center resources in Terraform. If your organization has newly enabled any preview features for SCC and get an error related to the v2 API, you must set this variable to false because the v2 API does not yet support Terraform resources. See [issue 1189](https://github.com/terraform-google-modules/terraform-example-foundation/issues/1189) for context. | `bool` | `false` | no |

‎1-org/envs/shared/iam.tf‎

Lines changed: 0 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -18,52 +18,6 @@
1818
Audit Logs - IAM
1919
*****************************************/
2020

21-
locals {
22-
enabling_data_logs = var.data_access_logs_enabled ? ["DATA_WRITE", "DATA_READ"] : []
23-
}
24-
25-
resource "google_organization_iam_audit_config" "org_config" {
26-
count = local.parent_folder == "" ? 1 : 0
27-
org_id = local.org_id
28-
service = "allServices"
29-
30-
###################################################################################################
31-
### Audit logs can generate costs, to know more about it,
32-
### check the official documentation: https://cloud.google.com/stackdriver/pricing#logging-costs
33-
### To know more about audit logs, you can find more infos
34-
### here https://cloud.google.com/logging/docs/audit/configure-data-access
35-
### To enable DATA_READ and DATA_WRITE audit logs, set `data_access_logs_enabled` to true
36-
### ADMIN_READ logs are enabled by default.
37-
####################################################################################################
38-
dynamic "audit_log_config" {
39-
for_each = setunion(local.enabling_data_logs, ["ADMIN_READ"])
40-
content {
41-
log_type = audit_log_config.key
42-
}
43-
}
44-
}
45-
46-
resource "google_folder_iam_audit_config" "folder_config" {
47-
count = local.parent_folder != "" ? 1 : 0
48-
folder = "folders/${local.parent_folder}"
49-
service = "allServices"
50-
51-
###################################################################################################
52-
### Audit logs can generate costs, to know more about it,
53-
### check the official documentation: https://cloud.google.com/stackdriver/pricing#logging-costs
54-
### To know more about audit logs, you can find more infos
55-
### here https://cloud.google.com/logging/docs/audit/configure-data-access
56-
### To enable DATA_READ and DATA_WRITE audit logs, set `data_access_logs_enabled` to true
57-
### ADMIN_READ logs are enabled by default.
58-
####################################################################################################
59-
dynamic "audit_log_config" {
60-
for_each = setunion(local.enabling_data_logs, ["ADMIN_READ"])
61-
content {
62-
log_type = audit_log_config.key
63-
}
64-
}
65-
}
66-
6721
resource "google_project_iam_member" "audit_log_logging_viewer" {
6822
project = module.org_audit_logs.project_id
6923
role = "roles/logging.viewer"

‎1-org/envs/shared/variables.tf‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -54,12 +54,6 @@ variable "enforce_allowed_worker_pools" {
5454
default = false
5555
}
5656

57-
variable "data_access_logs_enabled" {
58-
description = "Enable Data Access logs of types DATA_READ, DATA_WRITE for all GCP services. Enabling Data Access logs might result in your organization being charged for the additional logs usage. See https://cloud.google.com/logging/docs/audit#data-access The ADMIN_READ logs are enabled by default."
59-
type = bool
60-
default = false
61-
}
62-
6357
variable "log_export_storage_location" {
6458
description = "The location of the storage bucket used to export logs."
6559
type = string

‎helpers/foundation-deployer/go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@ module github.com/terraform-google-modules/terraform-example-foundation/helpers/
22

33
go 1.22
44

5-
toolchain go1.22.5
5+
toolchain go1.22.6
66

77
require (
88
github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test v0.16.1
99
github.com/gruntwork-io/terratest v0.47.0
1010
github.com/hashicorp/hcl/v2 v2.21.0
1111
github.com/mitchellh/go-testing-interface v1.14.2-0.20210821155943-2d9075ca8770
1212
github.com/stretchr/testify v1.9.0
13-
github.com/terraform-google-modules/terraform-example-foundation/test/integration v0.0.0-20240530101341-20e72789e0ac
13+
github.com/terraform-google-modules/terraform-example-foundation/test/integration v0.0.0-20240808135927-5f1fd0f4104a
1414
github.com/tidwall/gjson v1.17.3
1515
)
1616

@@ -55,7 +55,7 @@ require (
5555
golang.org/x/crypto v0.21.0 // indirect
5656
golang.org/x/mod v0.19.0 // indirect
5757
golang.org/x/net v0.23.0 // indirect
58-
golang.org/x/oauth2 v0.20.0 // indirect
58+
golang.org/x/oauth2 v0.22.0 // indirect
5959
golang.org/x/sync v0.4.0 // indirect
6060
golang.org/x/sys v0.18.0 // indirect
6161
golang.org/x/text v0.14.0 // indirect

‎helpers/foundation-deployer/go.sum‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -410,8 +410,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
410410
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
411411
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
412412
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
413-
github.com/terraform-google-modules/terraform-example-foundation/test/integration v0.0.0-20240530101341-20e72789e0ac h1:hKmWS3gfdchjfK1xC6z0Tll65D+Poxr0aBCgRgGoaNs=
414-
github.com/terraform-google-modules/terraform-example-foundation/test/integration v0.0.0-20240530101341-20e72789e0ac/go.mod h1:tQ3UD4Hq6eDIfxNp5qKK6UVePeTc+fQBUqjx8jN/NyM=
413+
github.com/terraform-google-modules/terraform-example-foundation/test/integration v0.0.0-20240808135927-5f1fd0f4104a h1:4Ih0BauwdUTF+YuA55/qY8Q+d5brYKPpae0YWkB9D2A=
414+
github.com/terraform-google-modules/terraform-example-foundation/test/integration v0.0.0-20240808135927-5f1fd0f4104a/go.mod h1:p8CvVuYRey5Nb8dipH5KM+eY+TnqfLgDnQ5M1a7oHiw=
415415
github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
416416
github.com/tidwall/gjson v1.17.3 h1:bwWLZU7icoKRG+C+0PNwIKC6FCJO/Q3p2pZvuP0jN94=
417417
github.com/tidwall/gjson v1.17.3/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
@@ -567,8 +567,8 @@ golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094/go.mod h1:h4gKUeWbJ4rQPri
567567
golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
568568
golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
569569
golang.org/x/oauth2 v0.1.0/go.mod h1:G9FE4dLTsbXUu90h/Pf85g4w1D+SSAgR+q46nJZ8M4A=
570-
golang.org/x/oauth2 v0.20.0 h1:4mQdhULixXKP1rwYBW0vAijoXnkTG0BLCDRzfe1idMo=
571-
golang.org/x/oauth2 v0.20.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
570+
golang.org/x/oauth2 v0.22.0 h1:BzDx2FehcG7jJwgWLELCdmLuxk2i+x9UDpSiss2u0ZA=
571+
golang.org/x/oauth2 v0.22.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
572572
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
573573
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
574574
golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

‎helpers/foundation-deployer/steps/steps_test.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ func TestProcessSteps(t *testing.T) {
7777
badStepMsg := "bad step"
7878
assert.False(t, s.IsStepComplete("bad"), "check if 'bad' is 'COMPLETED' should be false")
7979
err = s.RunStep("bad", func() error {
80-
return fmt.Errorf(badStepMsg)
80+
return fmt.Errorf("%s", badStepMsg)
8181
})
8282
assert.Error(t, err)
8383
assert.False(t, s.IsStepComplete("bad"), "check if 'bad' is 'COMPLETED' should be false")
@@ -86,7 +86,7 @@ func TestProcessSteps(t *testing.T) {
8686
// complete states are not executed again
8787
assert.True(t, s.IsStepComplete("good"), "check if 'good' is 'COMPLETED' should be true")
8888
err = s.RunStep("good", func() error {
89-
return fmt.Errorf("will fail if executed")
89+
return fmt.Errorf("%s", "will fail if executed")
9090
})
9191
assert.NoError(t, err)
9292
assert.True(t, s.IsStepComplete("good"), "check if 'good' is 'COMPLETED' should be true")
@@ -103,7 +103,7 @@ func TestProcessSteps(t *testing.T) {
103103
assert.NoError(t, err)
104104
assert.False(t, s.IsStepDestroyed("destroy"), "check if 'destroy' is 'DESTROYED' should be false")
105105
err = s.RunDestroyStep("destroy", func() error {
106-
return fmt.Errorf(badStepMsg)
106+
return fmt.Errorf("%s", badStepMsg)
107107
})
108108
assert.Error(t, err)
109109
assert.False(t, s.IsStepDestroyed("destroy"), "check if 'destroy' is 'DESTROYED' should be false")
@@ -113,7 +113,7 @@ func TestProcessSteps(t *testing.T) {
113113
assert.NoError(t, err)
114114
assert.True(t, s.IsStepDestroyed("gone"), "check if 'gone' is 'DESTROYED' should be true")
115115
err = s.RunDestroyStep("gone", func() error {
116-
return fmt.Errorf("will fail if executed")
116+
return fmt.Errorf("%s", "will fail if executed")
117117
})
118118
assert.NoError(t, err)
119119
assert.True(t, s.IsStepDestroyed("gone"), "check if 'gone' is 'DESTROYED' should be true")

‎test/integration/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ module github.com/terraform-google-modules/terraform-example-foundation/test/int
22

33
go 1.22
44

5-
toolchain go1.22.5
5+
toolchain go1.22.6
66

77
require (
88
github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test v0.16.1

0 commit comments

Comments
 (0)