Skip to content

Commit

Permalink
Fix status ingress/egress policies in vpc-sc module (#1036)
Browse files Browse the repository at this point in the history 
* fix status ingress/egress policies

* fix default status/spec value
  • Loading branch information
@ludoo
ludoo committed Dec 5, 2022
1 parent f97239b commit 67fca10
Show file tree
Hide file tree
Showing 3 changed files with 32 additions and 29 deletions.
2 changes: 1 addition & 1 deletion modules/vpc-sc/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -193,7 +193,7 @@ module "test" {
| [egress_policies](variables.tf#L70) | Egress policy definitions that can be referenced in perimeters. | <code title="map&#40;object&#40;&#123;&#10; from &#61; object&#40;&#123;&#10; identity_type &#61; optional&#40;string, &#34;ANY_IDENTITY&#34;&#41;&#10; identities &#61; optional&#40;list&#40;string&#41;&#41;&#10; &#125;&#41;&#10; to &#61; object&#40;&#123;&#10; operations &#61; optional&#40;list&#40;object&#40;&#123;&#10; method_selectors &#61; optional&#40;list&#40;string&#41;&#41;&#10; service_name &#61; string&#10; &#125;&#41;&#41;, &#91;&#93;&#41;&#10; resources &#61; optional&#40;list&#40;string&#41;&#41;&#10; resource_type_external &#61; optional&#40;bool, false&#41;&#10; &#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [ingress_policies](variables.tf#L99) | Ingress policy definitions that can be referenced in perimeters. | <code title="map&#40;object&#40;&#123;&#10; from &#61; object&#40;&#123;&#10; access_levels &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10; identity_type &#61; optional&#40;string&#41;&#10; identities &#61; optional&#40;list&#40;string&#41;&#41;&#10; resources &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10; &#125;&#41;&#10; to &#61; object&#40;&#123;&#10; operations &#61; optional&#40;list&#40;object&#40;&#123;&#10; method_selectors &#61; optional&#40;list&#40;string&#41;&#41;&#10; service_name &#61; string&#10; &#125;&#41;&#41;, &#91;&#93;&#41;&#10; resources &#61; optional&#40;list&#40;string&#41;&#41;&#10; &#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [service_perimeters_bridge](variables.tf#L130) | Bridge service perimeters. | <code title="map&#40;object&#40;&#123;&#10; spec_resources &#61; optional&#40;list&#40;string&#41;&#41;&#10; status_resources &#61; optional&#40;list&#40;string&#41;&#41;&#10; use_explicit_dry_run_spec &#61; optional&#40;bool, false&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [service_perimeters_regular](variables.tf#L140) | Regular service perimeters. | <code title="map&#40;object&#40;&#123;&#10; spec &#61; optional&#40;object&#40;&#123;&#10; access_levels &#61; optional&#40;list&#40;string&#41;&#41;&#10; resources &#61; optional&#40;list&#40;string&#41;&#41;&#10; restricted_services &#61; optional&#40;list&#40;string&#41;&#41;&#10; egress_policies &#61; optional&#40;list&#40;string&#41;&#41;&#10; ingress_policies &#61; optional&#40;list&#40;string&#41;&#41;&#10; vpc_accessible_services &#61; optional&#40;object&#40;&#123;&#10; allowed_services &#61; list&#40;string&#41;&#10; enable_restriction &#61; bool&#10; &#125;&#41;&#41;&#10; &#125;&#41;, &#123;&#125;&#41;&#10; status &#61; optional&#40;object&#40;&#123;&#10; access_levels &#61; optional&#40;list&#40;string&#41;&#41;&#10; resources &#61; optional&#40;list&#40;string&#41;&#41;&#10; restricted_services &#61; optional&#40;list&#40;string&#41;&#41;&#10; egress_policies &#61; optional&#40;list&#40;string&#41;&#41;&#10; ingress_policies &#61; optional&#40;list&#40;string&#41;&#41;&#10; vpc_accessible_services &#61; optional&#40;object&#40;&#123;&#10; allowed_services &#61; list&#40;string&#41;&#10; enable_restriction &#61; bool&#10; &#125;&#41;&#41;&#10; &#125;&#41;, &#123;&#125;&#41;&#10; use_explicit_dry_run_spec &#61; optional&#40;bool, false&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [service_perimeters_regular](variables.tf#L140) | Regular service perimeters. | <code title="map&#40;object&#40;&#123;&#10; spec &#61; optional&#40;object&#40;&#123;&#10; access_levels &#61; optional&#40;list&#40;string&#41;&#41;&#10; resources &#61; optional&#40;list&#40;string&#41;&#41;&#10; restricted_services &#61; optional&#40;list&#40;string&#41;&#41;&#10; egress_policies &#61; optional&#40;list&#40;string&#41;&#41;&#10; ingress_policies &#61; optional&#40;list&#40;string&#41;&#41;&#10; vpc_accessible_services &#61; optional&#40;object&#40;&#123;&#10; allowed_services &#61; list&#40;string&#41;&#10; enable_restriction &#61; bool&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;&#10; status &#61; optional&#40;object&#40;&#123;&#10; access_levels &#61; optional&#40;list&#40;string&#41;&#41;&#10; resources &#61; optional&#40;list&#40;string&#41;&#41;&#10; restricted_services &#61; optional&#40;list&#40;string&#41;&#41;&#10; egress_policies &#61; optional&#40;list&#40;string&#41;&#41;&#10; ingress_policies &#61; optional&#40;list&#40;string&#41;&#41;&#10; vpc_accessible_services &#61; optional&#40;object&#40;&#123;&#10; allowed_services &#61; list&#40;string&#41;&#10; enable_restriction &#61; bool&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;&#10; use_explicit_dry_run_spec &#61; optional&#40;bool, false&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |

## Outputs

Expand Down
53 changes: 28 additions & 25 deletions modules/vpc-sc/service-perimeters-regular.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,20 +28,21 @@ resource "google_access_context_manager_service_perimeter" "regular" {
perimeter_type = "PERIMETER_TYPE_REGULAR"
use_explicit_dry_run_spec = each.value.use_explicit_dry_run_spec
dynamic "spec" {
for_each = each.value.spec == null ? [] : [""]
for_each = each.value.spec == null ? [] : [each.value.spec]
iterator = spec
content {
access_levels = (
each.value.spec.access_levels == null ? null : [
for k in each.value.spec.access_levels :
spec.value.access_levels == null ? null : [
for k in spec.value.access_levels :
try(google_access_context_manager_access_level.basic[k].id, k)
]
)
resources = each.value.spec.resources
restricted_services = each.value.spec.restricted_services
resources = spec.value.resources
restricted_services = spec.value.restricted_services

dynamic "egress_policies" {
for_each = each.value.spec.egress_policies == null ? {} : {
for k in each.value.spec.egress_policies :
for_each = spec.value.egress_policies == null ? {} : {
for k in spec.value.egress_policies :
k => lookup(var.egress_policies, k, null)
if contains(keys(var.egress_policies), k)
}
Expand Down Expand Up @@ -77,8 +78,8 @@ resource "google_access_context_manager_service_perimeter" "regular" {
}

dynamic "ingress_policies" {
for_each = each.value.spec.ingress_policies == null ? {} : {
for k in each.value.spec.ingress_policies :
for_each = spec.value.ingress_policies == null ? {} : {
for k in spec.value.ingress_policies :
k => lookup(var.ingress_policies, k, null)
if contains(keys(var.ingress_policies), k)
}
Expand Down Expand Up @@ -129,30 +130,31 @@ resource "google_access_context_manager_service_perimeter" "regular" {
}

dynamic "vpc_accessible_services" {
for_each = each.value.spec.vpc_accessible_services == null ? {} : { 1 = 1 }
for_each = spec.value.vpc_accessible_services == null ? {} : { 1 = 1 }
content {
allowed_services = each.value.spec.vpc_accessible_services.allowed_services
enable_restriction = each.value.spec.vpc_accessible_services.enable_restriction
allowed_services = spec.value.vpc_accessible_services.allowed_services
enable_restriction = spec.value.vpc_accessible_services.enable_restriction
}
}

}
}
dynamic "status" {
for_each = each.value.status == null ? {} : { 1 = 1 }
for_each = each.value.status == null ? [] : [each.value.status]
iterator = status
content {
access_levels = (
each.value.status.access_levels == null ? null : [
for k in each.value.status.access_levels :
status.value.access_levels == null ? null : [
for k in status.value.access_levels :
try(google_access_context_manager_access_level.basic[k].id, k)
]
)
resources = each.value.status.resources
restricted_services = each.value.status.restricted_services
resources = status.value.resources
restricted_services = status.value.restricted_services

dynamic "egress_policies" {
for_each = each.value.spec.egress_policies == null ? {} : {
for k in each.value.spec.egress_policies :
for_each = status.value.egress_policies == null ? {} : {
for k in status.value.egress_policies :
k => lookup(var.egress_policies, k, null)
if contains(keys(var.egress_policies), k)
}
Expand Down Expand Up @@ -188,8 +190,8 @@ resource "google_access_context_manager_service_perimeter" "regular" {
}

dynamic "ingress_policies" {
for_each = each.value.spec.ingress_policies == null ? {} : {
for k in each.value.spec.ingress_policies :
for_each = status.value.ingress_policies == null ? {} : {
for k in status.value.ingress_policies :
k => lookup(var.ingress_policies, k, null)
if contains(keys(var.ingress_policies), k)
}
Expand All @@ -205,7 +207,8 @@ resource "google_access_context_manager_service_perimeter" "regular" {
iterator = s
content {
access_level = try(
google_access_context_manager_access_level.basic[s.value].id, s.value
google_access_context_manager_access_level.basic[s.value].id,
s.value
)
}
}
Expand Down Expand Up @@ -240,10 +243,10 @@ resource "google_access_context_manager_service_perimeter" "regular" {
}

dynamic "vpc_accessible_services" {
for_each = each.value.status.vpc_accessible_services == null ? {} : { 1 = 1 }
for_each = status.value.vpc_accessible_services == null ? {} : { 1 = 1 }
content {
allowed_services = each.value.status.vpc_accessible_services.allowed_services
enable_restriction = each.value.status.vpc_accessible_services.enable_restriction
allowed_services = status.value.vpc_accessible_services.allowed_services
enable_restriction = status.value.vpc_accessible_services.enable_restriction
}
}

Expand Down
6 changes: 3 additions & 3 deletions modules/vpc-sc/variables.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ variable "egress_policies" {
"ANY_USER", "ANY_SERVICE_ACCOUNT"
], v.from.identity_type)
])
error_message = "Invalid `from.identity_type` value in eress policy."
error_message = "Invalid `from.identity_type` value in egress policy."
}
}

Expand Down Expand Up @@ -150,7 +150,7 @@ variable "service_perimeters_regular" {
allowed_services = list(string)
enable_restriction = bool
}))
}), {})
}))
status = optional(object({
access_levels = optional(list(string))
resources = optional(list(string))
Expand All @@ -161,7 +161,7 @@ variable "service_perimeters_regular" {
allowed_services = list(string)
enable_restriction = bool
}))
}), {})
}))
use_explicit_dry_run_spec = optional(bool, false)
}))
default = {}
Expand Down

0 comments on commit 67fca10

Please sign in to comment.