Skip to content

Commit af5e9de

Browse files
prabhu34bharathkkb
prabhu34
and
bharathkkb
authored
feat: added org_policy_v2 as a submodule supporting conditions (#58)
* feat: added org_policy_v2 initial draft * chore: removed readme * chore: applied tf fmt * chore: lint * chore: lint * feat: added new test framework for org policy v2 * chore: path * chore: linting * feat: added go files * chore: tests updated * chore: tests updated * chore: test updated * feat: updated fixtures * feat: updated fixtures * feat: updated outputs * ft: added string output * feat: added list test * chore: lint and integration tests * feat: updated build steps * feat: updated build steps * feat: added org policy * chore: commented * chore: commented * chore: trigger * chore: trigger reverted * chore: added variable * chore: added variable * chore: docs and comments * chore: terraform fmt * chore: lint and comments * chore: build step fix * chore: build step fix * chore: removed build and trigger * fix: updated outputs * chore: trigger build * chore: trigger * fix: cleanup environment * fix: cleanup environment * feat: updated logic and previous comments * chore: retrigger * debug: added sleep * chore: retrigger * fix: updated org id variable * chore: updated readme * Update modules/org_policy_v2/versions.tf Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com> * Update test/integration/v2_boolean_org_enforce/v2_boolean_org_enforce_test.go Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com> * chore: retrigger Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>
1 parent 56d3878 commit af5e9de

File tree

20 files changed

+2545
-3
lines changed

20 files changed

+2545
-3
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,4 @@ credentials.json
4646

4747
# tf lock file
4848
.terraform.lock.hcl
49+

‎build/int.cloudbuild.yaml‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,21 +21,56 @@ steps:
2121
- 'TF_VAR_org_id=$_ORG_ID'
2222
- 'TF_VAR_folder_id=$_FOLDER_ID'
2323
- 'TF_VAR_billing_account=$_BILLING_ACCOUNT'
24+
- id: sleep
25+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
26+
args: ['/bin/bash', '-c', 'sleep 30']
27+
waitFor:
28+
- prepare
29+
# Ruby Test Framework - org policy v1 APIs
2430
- id: create
2531
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
2632
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do create']
33+
waitFor:
34+
- sleep
2735
- id: converge
2836
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
2937
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge']
38+
waitFor:
39+
- create
3040
- id: verify
3141
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
3242
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify']
43+
waitFor:
44+
- converge
3345
- id: destroy
3446
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
3547
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy']
48+
waitFor:
49+
- verify
50+
# Boolean Org Enforce Example Test
51+
- id: create all
52+
waitFor:
53+
- sleep
54+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
55+
args: ['/bin/bash', '-c', 'cft test run TestVersion2BooleanOrgEnforce --test-dir test/integration --stage init --verbose']
56+
- id: converge org-policy-v2
57+
waitFor:
58+
- create all
59+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
60+
args: ['/bin/bash', '-c', 'cft test run TestVersion2BooleanOrgEnforce --test-dir test/integration --stage apply --verbose']
61+
- id: verify org-policy-v2
62+
waitFor:
63+
- converge org-policy-v2
64+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
65+
args: ['/bin/bash', '-c', 'cft test run TestVersion2BooleanOrgEnforce --test-dir test/integration --stage verify --verbose']
66+
- id: destroy org-policy-v2
67+
waitFor:
68+
- verify org-policy-v2
69+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
70+
args: ['/bin/bash', '-c', 'cft test run TestVersion2BooleanOrgEnforce --test-dir test/integration --stage destroy --verbose']
3671
tags:
3772
- 'ci'
3873
- 'integration'
3974
substitutions:
4075
_DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
41-
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.0'
76+
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.3'

‎build/lint.cloudbuild.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,4 @@ tags:
2121
- 'lint'
2222
substitutions:
2323
_DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
24-
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.0'
24+
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.3'

‎examples/v2_boolean_org_enforce/README.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Boolean Constraint with option to add multiple rules and conditions
2+
3+
This example shows how to set a boolean constraint on an org level, with option to add multiple rules and conditions supported by latest Organization Policy APIs.
4+
5+
This boolean constraint, when set to true, enables OS Login on all newly created Projects. All VM instances created in new projects will have OS Login enabled. On new and existing projects, this constraint prevents metadata updates that disable OS Login at the project or instance level. By default, the OS Login feature is disabled on Compute Engine projects. GKE instances in private clusters running node pool versions 1.20.5-gke.2000 and later support OS Login. GKE instances in public clusters do not currently support OS Login. If this constraint is applied to a Project running public clusters, GKE instances running in that Project may not function properly.
6+
7+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
8+
## Inputs
9+
10+
| Name | Description | Type | Default | Required |
11+
|------|-------------|------|---------|:--------:|
12+
| org\_id | The organization id for applying the policy | `string` | `null` | no |
13+
14+
## Outputs
15+
16+
| Name | Description |
17+
|------|-------------|
18+
| constraint | Policy Constraint Identifier |
19+
| policy\_root | Policy Root in the hierarchy for the given policy |
20+
| policy\_root\_id | Project Root ID at which the policy is applied |
21+
22+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/v2_boolean_org_enforce/main.tf‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
/********************************************************
18+
Apply the sample constraint using the org_policy_v2 module
19+
*******************************************************/
20+
module "gcp_org_policy_v2" {
21+
source = "../../modules/org_policy_v2"
22+
23+
policy_root = "organization"
24+
policy_root_id = var.org_id
25+
rules = [{
26+
enforcement = true
27+
allow = []
28+
deny = []
29+
conditions = []
30+
}]
31+
constraint = "compute.requireOsLogin"
32+
policy_type = "boolean"
33+
}

‎examples/v2_boolean_org_enforce/outputs.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "policy_root" {
18+
description = "Policy Root in the hierarchy for the given policy"
19+
value = module.gcp_org_policy_v2.policy_root
20+
}
21+
22+
output "policy_root_id" {
23+
description = "Project Root ID at which the policy is applied"
24+
value = module.gcp_org_policy_v2.policy_root_id
25+
}
26+
27+
output "constraint" {
28+
description = "Policy Constraint Identifier"
29+
value = module.gcp_org_policy_v2.constraint
30+
}
31+

‎examples/v2_boolean_org_enforce/variables.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
# Organization ID for this example
18+
# It could be Folder or Project ID
19+
variable "org_id" {
20+
description = "The organization id for applying the policy"
21+
type = string
22+
default = null
23+
}

‎examples/v2_boolean_org_enforce/versions.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
/**
2+
* Copyright 2021 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_version = ">= 0.13"
19+
required_providers {
20+
21+
google = {
22+
source = "hashicorp/google"
23+
version = ">= 3.53, < 5.0"
24+
}
25+
}
26+
}

‎modules/org_policy_v2/README.md‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
# Google Cloud Organization Policy v2 Terraform Module
2+
3+
This Terraform module makes it easier to manage [organization policies](https://cloud.google.com/resource-manager/docs/organization-policy/overview) for your Google Cloud environment, particularly when you want to have exclusion rules. This module will allow you to set a top-level org policy and then disable it on individual projects or folders easily. This module allows **_conditional policy enforcements based on the latest API version_** of the organization policies API.
4+
5+
Organization Policies are of two types `boolean` and `list`.
6+
7+
---
8+
9+
## Usage
10+
Example usage is included in the [examples](./examples/org_policy_v2) folder, but simple usage is as follows:
11+
12+
```hcl
13+
module "gcp_org_policy_v2" {
14+
source = "terraform-google-modules/org-policy/google//modules/org_policy_v2"
15+
version = "~> 5.2.0"
16+
17+
policy_root = "organization" # either of organization, folder or project
18+
policy_root_id = "123456789" # either of org id, folder id or project id
19+
constraint = "constraint name" # constraint identifier without constriants/ prefix. Example "compute.requireOsLogin"
20+
policy_type = "boolean" # either of list or boolean
21+
exclude_folders = []
22+
exclude_projects = []
23+
24+
rules = [
25+
# Rule 1
26+
{
27+
enforcement = true
28+
allow = []
29+
deny = []
30+
conditions = []
31+
},
32+
# Rule 2
33+
{
34+
enforcement = true
35+
allow = []
36+
deny = []
37+
conditions = [{
38+
description = "description of the condition"
39+
expression = "resource.matchTagId('tagKeys/123456789', 'tagValues/123456789') && resource.matchTag('123456789/1234', 'abcd')"
40+
location = "sample-location.log"
41+
title = "Title of the condition"
42+
}]
43+
},
44+
]
45+
}
46+
```
47+
48+
### Variables
49+
To control module's behavior, change variables' values regarding the following:
50+
51+
- `constraint`: set this variable with the [constraint value](https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints#available_constraints) in the form `{constraint identifier}`. For example, `serviceuser.services`
52+
- `policy_type`: Specify either `boolean` for boolean policies or `list` for list policies.
53+
- `policy_root`: set one of the following values to determine where the policy is applied. Values should be either one of the below.
54+
- organization
55+
- project
56+
- folder
57+
- `policy_root_id`: set one of the following values to determine where the policy is applied. Based on `policy_root`, either one of the below IDs should be provided.
58+
- organization_id
59+
- project_id
60+
- folder_id
61+
- `exclude_folders`: a list of folder IDs to be excluded from this policy. These folders must be lower in the hierarchy than the policy root.
62+
- `exclude_projects`: a list of project IDs to be excluded from this policy. They must be lower in the hierarchy than the policy root.
63+
- `rules`: Specify policy rules and conditions. Rules contain the following parameters:
64+
- `enforcement`: if `true` or `null`then policy will `deny_all`; if `false` then policy will `allow_all`. Applies for `boolean` based policies.
65+
- `allow`: list of values to include in the policy with ALLOW behavior. Set `enforce` to `null` to use it.
66+
- `deny`: list of values to include in the policy with DENY behavior. Set `enforce` to `null` to use it.
67+
- `conditions`: [Organization tags](https://cloud.google.com/resource-manager/docs/organization-policy/tags-organization-policy) provides a way to conditionally allow or deny policies based on whether a resource has a specific tag. You can use tags and conditional enforcement of organization policies to provide centralized control of the resources in your hierarchy. Each condition has the following properties:
68+
- `description`: Description of the condition
69+
- `expression`: Common Expression Language, or CEL, is the expression language used to specify conditional expressions. A conditional expression consists of one or more statements that are joined using logical operators (&&, ||, or !). For more information, see the [CEL spec](https://github.com/google/cel-spec) and its [language definition](https://github.com/google/cel-spec/blob/master/doc/langdef.md).
70+
- `location`: Log location
71+
- `title`: Title of the condition
72+
73+
---
74+
75+
### IMPORTANT
76+
- Boolean policies (with `type: "boolean"`) can set the following variables:
77+
- `enforcement`: if `true` or `null` then the policy is enforced at the root; if `false` then policy is not enforced at the root.
78+
- Following requirements apply, refer [Terraform Documentation](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/org_policy_policy#rules):
79+
- There must be one and only one Policy Rule where condition is unset.
80+
- Boolean Policy Rules with conditions must set enforced to the opposite of the PolicyRule without a condition.
81+
- During policy evaluation, Policy Rules with conditions that are true for a target resource take precedence.
82+
83+
- List policies (with `type: "list"`) can set `allow` and `deny` with a list of resources to allow or deny. For `enforcement` you can set it as follows:
84+
- set `enforcement` = false for `allow all`
85+
- set `enforcement` = true for `deny all`
86+
- Each policy can have [maximum of 10 rules](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/org_policy_policy#rules)
87+
88+
---
89+
90+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
91+
## Inputs
92+
93+
| Name | Description | Type | Default | Required |
94+
|------|-------------|------|---------|:--------:|
95+
| constraint | The constraint to be applied | `string` | n/a | yes |
96+
| exclude\_folders | Set of folders to exclude from the policy | `set(string)` | `[]` | no |
97+
| exclude\_projects | Set of projects to exclude from the policy | `set(string)` | `[]` | no |
98+
| policy\_root | Resource hierarchy node to apply the policy to: can be one of `organization`, `folder`, or `project`. | `string` | `"organization"` | no |
99+
| policy\_root\_id | The policy root id, either of organization\_id, folder\_id or project\_id | `string` | `null` | no |
100+
| policy\_type | The constraint type to work with (either 'boolean' or 'list') | `string` | `"list"` | no |
101+
| rules | List of rules per policy. Upto 10. | `list(any)` | n/a | yes |
102+
103+
## Outputs
104+
105+
| Name | Description |
106+
|------|-------------|
107+
| constraint | Policy Constraint Identifier without constraints/ prefix |
108+
| policy\_root | Policy Root in the hierarchy for the given policy |
109+
| policy\_root\_id | Project Root ID at which the policy is applied |
110+
111+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
112+
113+
---
114+
115+
## Compatibility
116+
This module is meant for use with Terraform 0.13+ and tested using Terraform 1.0+. If you find incompatibilities using Terraform >=0.13, please open an issue.
117+
If you haven't
118+
[upgraded](https://www.terraform.io/upgrade-guides/0-13.html) and need a Terraform
119+
0.12.x-compatible version of this module, the last released version
120+
intended for Terraform 0.12.x is [v4.0.0](https://registry.terraform.io/modules/terraform-google-modules/-org-policy/google/v4.0.0).
121+
122+
## Requirements
123+
### Terraform plugins
124+
- [Terraform](https://www.terraform.io/downloads.html) >= 0.13.0
125+
- [terraform-provider-google](https://github.com/terraform-providers/terraform-provider-google) >= v2.5.0
126+
127+
### Permissions
128+
In order to execute this module, the Service Account you run as must have the **Organization Policy Administrator** (`roles/orgpolicy.PolicyAdmin`) role.
129+
130+
## Install
131+
### Terraform
132+
Be sure you have the correct Terraform version (0.12.x), you can choose the binary here:
133+
- https://releases.hashicorp.com/terraform/
134+
135+
### Terraform plugins
136+
137+
- [terraform-provider-google](https://github.com/terraform-providers/terraform-provider-google) >= v2.5.0
138+

0 commit comments

Comments
 (0)