Skip to content

Commit f4471fd

Browse files
romanini-ciandtromanini-ciandt
authored
feat: Introduce autokey feature (#151)
1 parent eb71a31 commit f4471fd

File tree

18 files changed

+512
-10
lines changed

18 files changed

+512
-10
lines changed

‎examples/autokey_example/README.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Autokey Example
2+
3+
This example illustrates how to use the `autokey` kms submodule for [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature.
4+
5+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
6+
## Inputs
7+
8+
| Name | Description | Type | Default | Required |
9+
|------|-------------|------|---------|:--------:|
10+
| autokey\_resource\_project\_id | The ID of the project for Autokey to be used (e.g: a storage project which expects to use Autokey as CMEK). | `string` | n/a | yes |
11+
| folder\_id | The Autokey folder number used by Autokey config resource. Required when using Autokey. | `string` | n/a | yes |
12+
| project\_id | The ID of the project in which to provision Autokey resources (autokey keyring and keyHandle keys). | `string` | n/a | yes |
13+
14+
## Outputs
15+
16+
| Name | Description |
17+
|------|-------------|
18+
| autokey\_config\_id | An Autokey configuration identifier. |
19+
| autokey\_keyhandles | A map of KeyHandles created. |
20+
| autokey\_project\_id | Project used for autokey. |
21+
22+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
23+
24+
To provision this example, run the following from within this directory:
25+
- `terraform init` to get the plugins
26+
- `terraform plan` to see the infrastructure plan
27+
- `terraform apply` to apply the infrastructure build
28+
- `terraform destroy` to destroy the built infrastructure

‎examples/autokey_example/main.tf‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "autokey" {
18+
source = "terraform-google-modules/kms/google//modules/autokey"
19+
20+
project_id = var.project_id
21+
autokey_folder_number = var.folder_id
22+
autokey_handles = {
23+
storage_bucket = {
24+
name = "bucket-key-handle",
25+
project = var.autokey_resource_project_id,
26+
resource_type_selector = "storage.googleapis.com/Bucket",
27+
location = "us-central1"
28+
}
29+
compute_disk = {
30+
name = "disk-key-handle",
31+
project = var.autokey_resource_project_id,
32+
resource_type_selector = "compute.googleapis.com/Disk",
33+
location = "us-central1"
34+
}
35+
bigquery_dataset = {
36+
name = "dataset-key-handle",
37+
project = var.autokey_resource_project_id,
38+
resource_type_selector = "bigquery.googleapis.com/Dataset",
39+
location = "us-central1"
40+
}
41+
}
42+
}
43+

‎examples/autokey_example/outputs.tf‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "autokey_config_id" {
18+
description = "An Autokey configuration identifier."
19+
value = module.autokey.autokey_config_id != null ? module.autokey.autokey_config_id : ""
20+
}
21+
22+
output "autokey_keyhandles" {
23+
description = "A map of KeyHandles created."
24+
value = module.autokey.autokey_keyhandles != null ? module.autokey.autokey_keyhandles : {}
25+
}
26+
27+
output "autokey_project_id" {
28+
description = "Project used for autokey."
29+
value = var.project_id
30+
}

‎examples/autokey_example/variables.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The ID of the project in which to provision Autokey resources (autokey keyring and keyHandle keys)."
19+
type = string
20+
}
21+
22+
variable "autokey_resource_project_id" {
23+
description = "The ID of the project for Autokey to be used (e.g: a storage project which expects to use Autokey as CMEK)."
24+
type = string
25+
}
26+
27+
variable "folder_id" {
28+
type = string
29+
description = "The Autokey folder number used by Autokey config resource. Required when using Autokey."
30+
}
31+

‎main.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,4 +92,3 @@ resource "google_kms_crypto_key_iam_binding" "encrypters" {
9292
crypto_key_id = local.keys_by_name[element(var.set_encrypters_for, count.index)]
9393
members = compact(split(",", var.encrypters[count.index]))
9494
}
95-

‎modules/autokey/README.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Autokey submodule
2+
3+
This is a submodule built to make [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature simple to be used. This submodule will create the [Autokey Config](https://cloud.google.com/kms/docs/enable-autokey#enable-autokey-folder) for an existing folder where you want to enable Autokey, set up the Cloud KMS [service agent](https://cloud.google.com/kms/docs/enable-autokey#autokey-service-agent) on an existing key project and create [Key Handles](https://cloud.google.com/kms/docs/resource-hierarchy#key_handles) for existing resource projects.
4+
5+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
6+
## Inputs
7+
8+
| Name | Description | Type | Default | Required |
9+
|------|-------------|------|---------|:--------:|
10+
| autokey\_folder\_number | The Autokey folder number used by Autokey config resource. Required when using Autokey. | `string` | n/a | yes |
11+
| autokey\_handles | (Optional) A KeyHandle is a resource used by Autokey to auto-provision CryptoKeys for CMEK for a particular service.<br>- name: The resource name for the KeyHandle.<br>- resource\_type\_selector: Indicates the resource type that the resulting CryptoKey is meant to protect, in the following format: {SERVICE}.googleapis.com/{TYPE}. For example, storage.googleapis.com/Bucket. All Cloud KMS Autokey compatible services available at https://cloud.google.com/kms/docs/autokey-overview#compatible-services.<br>- location: The location for the KeyHandle. A full list of valid locations can be found by running gcloud kms locations list.<br>- project: The ID of the project in which the resource belongs. If it is not provided, the provider project is used. | <pre>map(object({<br> name = string<br> resource_type_selector = string<br> location = string<br> project = string<br> }))</pre> | `null` | no |
12+
| project\_id | Project id where the Autokey configuration and KeyHandles will be created. | `string` | n/a | yes |
13+
14+
## Outputs
15+
16+
| Name | Description |
17+
|------|-------------|
18+
| autokey\_config\_id | An Autokey configuration identifier. |
19+
| autokey\_keyhandles | A map of KeyHandles created. |
20+
21+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/autokey/iam.tf‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
data "google_project" "kms_project" {
18+
project_id = var.project_id
19+
}
20+
21+
#Create KMS Service Agent
22+
resource "google_project_service_identity" "kms_service_agent" {
23+
count = local.create_autokey_key_handles ? 1 : 0
24+
provider = google-beta
25+
26+
service = "cloudkms.googleapis.com"
27+
project = data.google_project.kms_project.number
28+
}
29+
30+
# Wait delay after creating service agent.
31+
resource "time_sleep" "wait_service_agent" {
32+
count = local.create_autokey_key_handles ? 1 : 0
33+
34+
create_duration = "10s"
35+
depends_on = [google_project_service_identity.kms_service_agent]
36+
}
37+
38+
#Grant the KMS Service Agent the Cloud KMS Admin role
39+
resource "google_project_iam_member" "autokey_project_admin" {
40+
count = local.create_autokey_key_handles ? 1 : 0
41+
provider = google-beta
42+
43+
project = var.project_id
44+
role = "roles/cloudkms.admin"
45+
member = "serviceAccount:service-${data.google_project.kms_project.number}@gcp-sa-cloudkms.iam.gserviceaccount.com"
46+
depends_on = [time_sleep.wait_service_agent]
47+
}
48+
49+
# Wait delay after granting IAM permissions
50+
resource "time_sleep" "wait_srv_acc_permissions" {
51+
count = local.create_autokey_key_handles ? 1 : 0
52+
53+
create_duration = "10s"
54+
depends_on = [google_project_iam_member.autokey_project_admin]
55+
}

‎modules/autokey/main.tf‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
create_autokey_key_handles = var.autokey_folder_number != null && var.autokey_handles != null
19+
}
20+
21+
resource "google_kms_autokey_config" "primary" {
22+
count = var.autokey_folder_number != null ? 1 : 0
23+
provider = google-beta
24+
25+
folder = var.autokey_folder_number
26+
key_project = "projects/${var.project_id}"
27+
}
28+
29+
resource "random_string" "suffix" {
30+
count = local.create_autokey_key_handles ? 1 : 0
31+
32+
length = 4
33+
special = false
34+
upper = false
35+
}
36+
37+
resource "google_kms_key_handle" "primary" {
38+
for_each = local.create_autokey_key_handles ? var.autokey_handles : tomap({})
39+
provider = google-beta
40+
41+
project = each.value.project
42+
name = "${each.value.name}-${random_string.suffix[0].result}"
43+
location = each.value.location
44+
resource_type_selector = each.value.resource_type_selector
45+
46+
depends_on = [time_sleep.wait_srv_acc_permissions]
47+
}

‎modules/autokey/outputs.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "autokey_config_id" {
18+
description = "An Autokey configuration identifier."
19+
value = var.autokey_folder_number != null ? google_kms_autokey_config.primary[0].id : ""
20+
}
21+
22+
output "autokey_keyhandles" {
23+
description = "A map of KeyHandles created."
24+
value = local.create_autokey_key_handles ? google_kms_key_handle.primary : {}
25+
}

‎modules/autokey/variables.tf‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "Project id where the Autokey configuration and KeyHandles will be created."
19+
type = string
20+
}
21+
22+
variable "autokey_folder_number" {
23+
type = string
24+
description = "The Autokey folder number used by Autokey config resource. Required when using Autokey."
25+
}
26+
27+
variable "autokey_handles" {
28+
type = map(object({
29+
name = string
30+
resource_type_selector = string
31+
location = string
32+
project = string
33+
}))
34+
description = <<-EOF
35+
(Optional) A KeyHandle is a resource used by Autokey to auto-provision CryptoKeys for CMEK for a particular service.
36+
- name: The resource name for the KeyHandle.
37+
- resource_type_selector: Indicates the resource type that the resulting CryptoKey is meant to protect, in the following format: {SERVICE}.googleapis.com/{TYPE}. For example, storage.googleapis.com/Bucket. All Cloud KMS Autokey compatible services available at https://cloud.google.com/kms/docs/autokey-overview#compatible-services.
38+
- location: The location for the KeyHandle. A full list of valid locations can be found by running gcloud kms locations list.
39+
- project: The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
40+
EOF
41+
default = null
42+
}

0 commit comments

Comments
 (0)