Add support for subnet-level service network user grants to project module, improve docs

blueprints/factories/project-factory/README.md

@@ -57,7 +57,7 @@ module "project-factory" {
   # location where the yaml files are read from
   factory_data_path = "data"
 }
-# tftest modules=7 resources=26 files=prj-app-1,prj-app-2,prj-app-3 inventory=example.yaml
+# tftest modules=7 resources=31 files=prj-app-1,prj-app-2,prj-app-3 inventory=example.yaml
 ```
 
 ```yaml
@@ -92,10 +92,19 @@ service_accounts:
   app-2-be: {}
 services:
 - compute.googleapis.com
+- container.googleapis.com
 - run.googleapis.com
 - storage.googleapis.com
 shared_vpc_service_config:
   host_project: foo-host
+  service_identity_iam:
+    "roles/compute.networkUser":
+      - cloudservices
+      - container-engine
+    "roles/vpcaccess.user":
+      - cloudrun
+    "roles/container.hostServiceAgentUser":
+      - container-engine
 
 # tftest-file id=prj-app-2 path=data/prj-app-2.yaml
 ```

modules/project/README.md

@@ -228,9 +228,21 @@ This table lists all affected services and roles that you need to grant to servi
 
 ## Shared VPC
 
-The module allows managing Shared VPC status for both hosts and service projects, and includes a simple way of assigning Shared VPC roles to service identities.
+The module allows managing Shared VPC status for both hosts and service projects, and control of IAM bindings for API service identities.
 
-You can enable Shared VPC Host at the project level and manage project service association independently.
+Project service association for VPC host projects can be
+
+- autoritatively managed in the host project by enabling Shared VPC and specifying the set of service projects, or
+- additively managed in service projects by by enabling Shared VPC in the host project and then "attaching" each service project independently
+
+IAM bindings in the host project for API service identities can be managed from service projects in two different ways:
+
+- via the `service_identity_iam` attribute, by specifying the set of roles and service agents
+- via the `service_iam_grants` attribute that leverages a [fixed list of roles for each service](./sharedvpc-agent-iam.yaml), by specifying a list of services
+
+While the first method is more explicit and readable, the second method is simpler and less error prone as all appropriate roles are predefined for all required service agents (eg compute and cloud services). You can mix and match as the two sets of bindings are then internally combined.
+
+This example shows a simple configuration with a host project, and a service project independently attached with granular IAM bindings for service identities.
 
 ```hcl
 module "host-project" {
@@ -272,7 +284,7 @@ module "service-project" {
 # tftest modules=2 resources=10 inventory=shared-vpc.yaml e2e
 ```
 
-The module allows also granting necessary permissions in host project to service identities by specifying which services will be used in service project in `grant_iam_for_services`.
+This example shows a similar configuration, with the simpler way of defining IAM bindings for service identities. The list of services passed to `service_iam_grants` uses the same module's outputs to establish a dependency, as service identities are only typically available after service (API) activation.
 
 ```hcl
 module "host-project" {
@@ -296,13 +308,47 @@ module "service-project" {
     "container.googleapis.com",
   ]
   shared_vpc_service_config = {
-    host_project       = module.host-project.project_id
+    host_project = module.host-project.project_id
+    # reuse the list of services from the module's outputs
     service_iam_grants = module.service-project.services
   }
 }
 # tftest modules=2 resources=9 inventory=shared-vpc-auto-grants.yaml e2e
 ```
 
+In specific cases it might make sense to selectively grant the `compute.networkUser` role for service identities at the subnet level, and while that is best done via org policies it's also supported by this module.
+
+```hcl
+module "host-project" {
+  source          = "./fabric/modules/project"
+  billing_account = var.billing_account_id
+  name            = "host"
+  parent          = var.folder_id
+  prefix          = var.prefix
+  shared_vpc_host_config = {
+    enabled = true
+  }
+}
+
+module "service-project" {
+  source          = "./fabric/modules/project"
+  billing_account = var.billing_account_id
+  name            = "service"
+  parent          = var.folder_id
+  prefix          = var.prefix
+  services = [
+    "compute.googleapis.com",
+  ]
+  shared_vpc_service_config = {
+    host_project = module.host-project.project_id
+    service_identity_subnet_iam = {
+      "europe-west1/gce" = ["compute"]
+    }
+  }
+}
+# tftest modules=2 resources=6 inventory=shared-vpc-subnet-grants.yaml
+```
+
 ## Organization Policies
 
 To manage organization policies, the `orgpolicy.googleapis.com` service should be enabled in the quota project.
@@ -617,7 +663,7 @@ output "compute_robot" {
 
 ### Managing project related configuration without creating it
 
-The module offers managing all related resources without ever touching the project itself by using `project_create = false` 
+The module offers managing all related resources without ever touching the project itself by using `project_create = false`
 
 ```hcl
 module "create-project" {
@@ -827,7 +873,6 @@ module "bucket" {
 # tftest modules=7 resources=53 inventory=data.yaml e2e
 ```
 
-
 <!-- TFDOC OPTS files:1 -->
 <!-- BEGIN TFDOC -->
 ## Files
@@ -840,7 +885,7 @@ module "bucket" {
 | [organization-policies.tf](./organization-policies.tf) | Project-level organization policies. | <code>google_org_policy_policy</code> |
 | [outputs.tf](./outputs.tf) | Module outputs. |  |
 | [service-accounts.tf](./service-accounts.tf) | Service identities and supporting resources. | <code>google_kms_crypto_key_iam_member</code> · <code>google_project_default_service_accounts</code> · <code>google_project_iam_member</code> · <code>google_project_service_identity</code> |
-| [shared-vpc.tf](./shared-vpc.tf) | Shared VPC project-level configuration. | <code>google_compute_shared_vpc_host_project</code> · <code>google_compute_shared_vpc_service_project</code> · <code>google_project_iam_member</code> |
+| [shared-vpc.tf](./shared-vpc.tf) | Shared VPC project-level configuration. | <code>google_compute_shared_vpc_host_project</code> · <code>google_compute_shared_vpc_service_project</code> · <code>google_compute_subnetwork_iam_member</code> · <code>google_project_iam_member</code> |
 | [tags.tf](./tags.tf) | None | <code>google_tags_tag_binding</code> |
 | [variables.tf](./variables.tf) | Module variables. |  |
 | [versions.tf](./versions.tf) | Version pins. |  |
@@ -879,9 +924,9 @@ module "bucket" {
 | [service_perimeter_standard](variables.tf#L276) | Name of VPC-SC Standard perimeter to add project into. See comment in the variables file for format. | <code>string</code> |  | <code>null</code> |
 | [services](variables.tf#L282) | Service APIs to enable. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |
 | [shared_vpc_host_config](variables.tf#L288) | Configures this project as a Shared VPC host project (mutually exclusive with shared_vpc_service_project). | <code title="object&#40;&#123;&#10;  enabled          &#61; bool&#10;  service_projects &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
-| [shared_vpc_service_config](variables.tf#L297) | Configures this project as a Shared VPC service project (mutually exclusive with shared_vpc_host_config). | <code title="object&#40;&#123;&#10;  host_project         &#61; string&#10;  service_identity_iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  service_iam_grants   &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  host_project &#61; null&#10;&#125;">&#123;&#8230;&#125;</code> |
-| [skip_delete](variables.tf#L319) | Allows the underlying resources to be destroyed without destroying the project itself. | <code>bool</code> |  | <code>false</code> |
-| [tag_bindings](variables.tf#L325) | Tag bindings for this project, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
+| [shared_vpc_service_config](variables.tf#L297) | Configures this project as a Shared VPC service project (mutually exclusive with shared_vpc_host_config). | <code title="object&#40;&#123;&#10;  host_project                &#61; string&#10;  service_identity_iam        &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  service_identity_subnet_iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  service_iam_grants          &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  host_project &#61; null&#10;&#125;">&#123;&#8230;&#125;</code> |
+| [skip_delete](variables.tf#L320) | Allows the underlying resources to be destroyed without destroying the project itself. | <code>bool</code> |  | <code>false</code> |
+| [tag_bindings](variables.tf#L326) | Tag bindings for this project, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
 
 ## Outputs
 

modules/project/shared-vpc.tf

@@ -17,22 +17,27 @@
 # tfdoc:file:description Shared VPC project-level configuration.
 
 locals {
-  _shared_vpc_agent_config = yamldecode(file("${path.module}/sharedvpc-agent-iam.yaml"))
-  _shared_vpc_agent_config_filtered = [
-    for config in local._shared_vpc_agent_config : config
-    if contains(var.shared_vpc_service_config.service_iam_grants, config.service)
+  _svpc = var.shared_vpc_service_config
+  # read the list of service/roles for API service agents
+  _svpc_agent_config = yamldecode(file(
+    "${path.module}/sharedvpc-agent-iam.yaml"
+  ))
+  # filter the list and keep services for which we need to create IAM bindings
+  _svpc_agent_config_filtered = [
+    for v in local._svpc_agent_config : v
+    if contains(local._svpc.service_iam_grants, v.service)
   ]
-  _shared_vpc_agent_grants = flatten(flatten([
-    for api in local._shared_vpc_agent_config_filtered : [
-      for service, roles in api.agents : [
+  # normalize the list of service/role tuples
+  _svpc_agent_grants = flatten(flatten([
+    for v in local._svpc_agent_config_filtered : [
+      for service, roles in v.agents : [
         for role in roles : { role = role, service = service }
       ]
     ]
   ]))
-
-  # compute the host project IAM bindings for this project's service identities
+  # normalize the service identity IAM bindings directly defined by the user
   _svpc_service_iam = flatten([
-    for role, services in var.shared_vpc_service_config.service_identity_iam : [
+    for role, services in local._svpc.service_identity_iam : [
       for service in services : { role = role, service = service }
     ]
   ])
@@ -44,9 +49,24 @@ locals {
       try(var.shared_vpc_host_config.service_projects, null), []
     )
   }
-
+  # combine the two sets of service/role bindings defined above
   svpc_service_iam = {
-    for b in setunion(local._svpc_service_iam, local._shared_vpc_agent_grants) : "${b.role}:${b.service}" => b
+    for b in setunion(local._svpc_service_iam, local._svpc_agent_grants) :
+    "${b.role}:${b.service}" => b
+  }
+  # normalize the service identity subnet IAM bindings
+  _svpc_service_subnet_iam = flatten([
+    for subnet, services in local._svpc.service_identity_subnet_iam : [
+      for service in services : [{
+        region  = split("/", subnet)[0]
+        subnet  = split("/", subnet)[1]
+        service = service
+      }]
+    ]
+  ])
+  svpc_service_subnet_iam = {
+    for v in local._svpc_service_subnet_iam :
+    "${v.region}:${v.subnet}:${v.service}" => v
   }
 }
 
@@ -90,3 +110,24 @@ resource "google_project_iam_member" "shared_vpc_host_robots" {
     data.google_storage_project_service_account.gcs_sa,
   ]
 }
+
+resource "google_compute_subnetwork_iam_member" "shared_vpc_host_robots" {
+  for_each   = local.svpc_service_subnet_iam
+  project    = var.shared_vpc_service_config.host_project
+  region     = each.value.region
+  subnetwork = each.value.subnet
+  role       = "roles/compute.networkUser"
+  member = (
+    each.value.service == "cloudservices"
+    ? "serviceAccount:${local.service_account_cloud_services}"
+    : "serviceAccount:${local.service_accounts_robots[each.value.service]}"
+  )
+  depends_on = [
+    google_project_service.project_services,
+    google_project_service_identity.servicenetworking,
+    google_project_service_identity.jit_si,
+    google_project_default_service_accounts.default_service_accounts,
+    data.google_bigquery_default_service_account.bq_sa,
+    data.google_storage_project_service_account.gcs_sa,
+  ]
+}

modules/project/variables.tf

@@ -298,9 +298,10 @@ variable "shared_vpc_service_config" {
   description = "Configures this project as a Shared VPC service project (mutually exclusive with shared_vpc_host_config)."
   # the list of valid service identities is in service-agents.yaml
   type = object({
-    host_project         = string
-    service_identity_iam = optional(map(list(string)), {})
-    service_iam_grants   = optional(list(string), [])
+    host_project                = string
+    service_identity_iam        = optional(map(list(string)), {})
+    service_identity_subnet_iam = optional(map(list(string)), {})
+    service_iam_grants          = optional(list(string), [])
   })
   default = {
     host_project = null

tests/blueprints/factories/project_factory/examples/example.yaml

@@ -102,12 +102,34 @@ values:
       environment: test
       team: foo
     timeouts: null
+  ? module.project-factory.module.projects["prj-app-2"].google_project_iam_member.shared_vpc_host_robots["roles/compute.networkUser:cloudservices"]
+  : condition: []
+    project: foo-host
+    role: roles/compute.networkUser
+  ? module.project-factory.module.projects["prj-app-2"].google_project_iam_member.shared_vpc_host_robots["roles/compute.networkUser:container-engine"]
+  : condition: []
+    project: foo-host
+    role: roles/compute.networkUser
+  ? module.project-factory.module.projects["prj-app-2"].google_project_iam_member.shared_vpc_host_robots["roles/container.hostServiceAgentUser:container-engine"]
+  : condition: []
+    project: foo-host
+    role: roles/container.hostServiceAgentUser
+  ? module.project-factory.module.projects["prj-app-2"].google_project_iam_member.shared_vpc_host_robots["roles/vpcaccess.user:cloudrun"]
+  : condition: []
+    project: foo-host
+    role: roles/vpcaccess.user
   module.project-factory.module.projects["prj-app-2"].google_project_service.project_services["compute.googleapis.com"]:
     disable_dependent_services: false
     disable_on_destroy: false
     project: test-pf-prj-app-2
     service: compute.googleapis.com
     timeouts: null
+  module.project-factory.module.projects["prj-app-2"].google_project_service.project_services["container.googleapis.com"]:
+    disable_dependent_services: false
+    disable_on_destroy: false
+    project: test-pf-prj-app-2
+    service: container.googleapis.com
+    timeouts: null
   module.project-factory.module.projects["prj-app-2"].google_project_service.project_services["run.googleapis.com"]:
     disable_dependent_services: false
     disable_on_destroy: false
@@ -204,11 +226,11 @@ counts:
   google_essential_contacts_contact: 3
   google_kms_crypto_key_iam_member: 1
   google_project: 3
-  google_project_iam_member: 2
-  google_project_service: 10
+  google_project_iam_member: 6
+  google_project_service: 11
   google_service_account: 3
   google_storage_project_service_account: 3
   modules: 7
-  resources: 26
+  resources: 31
 
 outputs: {}

tests/modules/project/examples/shared-vpc-subnet-grants.yaml

@@ -0,0 +1,66 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+values:
+  module.host-project.google_compute_shared_vpc_host_project.shared_vpc_host[0]:
+    project: test-host
+    timeouts: null
+  module.host-project.google_project.project[0]:
+    auto_create_network: false
+    billing_account: 123456-123456-123456
+    folder_id: '1122334455'
+    labels: null
+    name: test-host
+    org_id: null
+    project_id: test-host
+    skip_delete: false
+    timeouts: null
+  module.service-project.google_compute_shared_vpc_service_project.shared_vpc_service[0]:
+    deletion_policy: null
+    host_project: test-host
+    service_project: test-service
+    timeouts: null
+  module.service-project.google_compute_subnetwork_iam_member.shared_vpc_host_robots["europe-west1:gce:compute"]:
+    condition: []
+    project: test-host
+    region: europe-west1
+    role: roles/compute.networkUser
+    subnetwork: gce
+  module.service-project.google_project.project[0]:
+    auto_create_network: false
+    billing_account: 123456-123456-123456
+    folder_id: '1122334455'
+    labels: null
+    name: test-service
+    org_id: null
+    project_id: test-service
+    skip_delete: false
+    timeouts: null
+  module.service-project.google_project_service.project_services["compute.googleapis.com"]:
+    disable_dependent_services: false
+    disable_on_destroy: false
+    project: test-service
+    service: compute.googleapis.com
+    timeouts: null
+
+counts:
+  google_compute_shared_vpc_host_project: 1
+  google_compute_shared_vpc_service_project: 1
+  google_compute_subnetwork_iam_member: 1
+  google_project: 2
+  google_project_service: 1
+  modules: 2
+  resources: 6
+
+outputs: {}