A Terraform module for managing Cloud KMS keyrings, zero or more keys in keyrings, and IAM role bindings on individual keys. Google Cloud Platform (GCP).
This module supports Terraform version 1 and is compatible with the Terraform Google Provider version 4.
This module is part of our Infrastructure as Code (IaC) framework that enables our users and customers to easily deploy and manage reusable, secure, and production-grade cloud infrastructure.
- Module Features
- Getting Started
- Module Argument Reference
- Module Outputs
- External Documentation
- Module Versioning
- About Mineiros
- Reporting Issues
- Contributing
- Makefile Targets
- License
This module implements the following terraform resources:
google_kms_key_ring
google_kms_crypto_key
google_kms_crypto_key_iam_member
Most basic usage just setting required arguments:
module "terraform-google-kms" {
source = "github.com/mineiros-io/terraform-google-kms?ref=v0.0.1"
keyring = "keyring-example"
location = "global"
project = "my-project-id"
}
See variables.tf and examples/ for details and use-cases.
-
module_enabled
: (Optionalbool
)Specifies whether resources in the module will be created.
Default is
true
. -
module_depends_on
: (Optionallist(dependency)
)A list of dependencies. Any object can be assigned to this list to define a hidden external dependency.
Example:
module_depends_on = [ google_network.network ]
-
project
: (Requiredstring
)The ID of the project in which the resources belong.
-
location
: (Requiredstring
)The location for the keyring. A full list of valid locations can be found by running
gcloud kms locations list
or in the docs: https://cloud.google.com/kms/docs/locations. -
keyring
: (Requiredstring
)The resource name for the keyring.
-
keys
: (Optionallist(key)
)A list of key objects describing how keys and IAM bindings are going to be created.
Default is
[]
.Example:
keys = [{ name = "terraform-state-bucket-key" owners = ["terraform@example-project.iam.gserviceaccount.com"] encrypters = [ "group:one@example.com", "group:two@example.com" ] decrypters = ["group:three@example.com"] }]
Each
key
object in the list accepts the following attributes:-
name
: (Requiredstring
)The name of a specified key. It must belong to the specified keyring and matching the regular expression
[a-zA-Z0-9_-]{1,63}
-
owners
: (Optionalstring
)Identities that will be granted the KMS crypto key owner privilege.
-
encrypters
: (Optionalstring
)Identities that will be granted the KMS crypto key encrypted privilege.
-
decrypters
: (Optionalstring
)Identities that will be granted the kms crypto key decrypters privilege.
-
-
key_rotation_period
: (Optionalstring
)Every time this period passes, generate a new version of the key and set it as the primary. The first rotation will take place after the specified period. The rotation period has the format of a decimal number with up to 9 fractional digits, followed by the letter
s
(seconds).Default is
"100000s"
. -
key_algorithm
: (Optionalstring
)The algorithm to use when creating a version based on this template. For possible inputs please see https://cloud.google.com/kms/docs/reference/rest/v1/CryptoKeyVersionAlgorithm.
Default is
"GOOGLE_SYMMETRIC_ENCRYPTION"
. -
key_protection_level
: (Optionalstring
)The protection level to use when creating a version based on this template. Possible values are
SOFTWARE
andHSM
.Default is
"SOFTWARE"
. -
labels
: (Optionalmap(string)
)Labels with user-defined metadata to apply to this resource.
Default is
[]
.
The following attributes are exported in the outputs of the module:
-
module_enabled
: (bool
)Whether this module is enabled.
-
key_ring
: (object(key_ring)
)All outputs of the created
google_kms_key_ring
resource. -
keys
: (list(key)
)All outputs of the created
google_kms_crypto_key
resources. -
encrypter_iam_members
: (list(encrypter_iam_member)
)All outputs of all created
google_kms_crypto_key_iam_member
resources for members with encrypter permissions. -
decrypter_iam_members
: (list(decrypter_iam_member)
)All outputs of all created
google_kms_crypto_key_iam_member
resources for members with decrypter permissions. -
owner_iam_members
: (list(owner_iam_member)
)All outputs of all created
google_kms_crypto_key_iam_member
resources for members with owner permissions.
- https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/kms_key_ring
- https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/kms_crypto_key
This Module follows the principles of Semantic Versioning (SemVer).
Given a version number MAJOR.MINOR.PATCH
, we increment the:
MAJOR
version when we make incompatible changes,MINOR
version when we add functionality in a backwards compatible manner, andPATCH
version when we make backwards compatible bug fixes.
- Backwards compatibility in versions
0.0.z
is not guaranteed whenz
is increased. (Initial development) - Backwards compatibility in versions
0.y.z
is not guaranteed wheny
is increased. (Pre-release)
Mineiros is a remote-first company headquartered in Berlin, Germany that solves development, automation and security challenges in cloud infrastructure.
Our vision is to massively reduce time and overhead for teams to manage and deploy production-grade and secure cloud infrastructure.
We offer commercial support for all of our modules and encourage you to reach out if you have any questions or need help. Feel free to email us at hello@mineiros.io or join our Community Slack channel.
We use GitHub Issues to track community reported issues and missing features.
Contributions are always encouraged and welcome! For the process of accepting changes, we use Pull Requests. If you'd like more information, please see our Contribution Guidelines.
This repository comes with a handy Makefile.
Run make help
to see details on each available target.
This module is licensed under the Apache License Version 2.0, January 2004. Please see LICENSE for full details.
Copyright © 2020-2022 Mineiros GmbH