-
Notifications
You must be signed in to change notification settings - Fork 700
/
service_control.tf
119 lines (101 loc) · 4.6 KB
/
service_control.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
/**
* Copyright 2021 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
locals {
prefix = "${var.environment_code}_shared_restricted"
access_level_name = "alp_${local.prefix}_members_${random_id.random_access_level_suffix.hex}"
access_level_name_dry_run = "alp_${local.prefix}_members_dry_run_${random_id.random_access_level_suffix.hex}"
perimeter_name = "sp_${local.prefix}_default_perimeter_${random_id.random_access_level_suffix.hex}"
bridge_name = "spb_c_to_${local.prefix}_bridge_${random_id.random_access_level_suffix.hex}"
}
resource "random_id" "random_access_level_suffix" {
byte_length = 2
}
module "access_level" {
source = "terraform-google-modules/vpc-service-controls/google//modules/access_level"
version = "~> 6.0"
description = "${local.prefix} Access Level"
policy = var.access_context_manager_policy_id
name = local.access_level_name
members = var.members
}
module "access_level_dry_run" {
source = "terraform-google-modules/vpc-service-controls/google//modules/access_level"
version = "~> 5.0"
description = "${local.prefix} Access Level for testing with a dry run perimeter"
policy = var.access_context_manager_policy_id
name = local.access_level_name_dry_run
members = var.members_dry_run
}
resource "time_sleep" "wait_vpc_sc_propagation" {
create_duration = "60s"
destroy_duration = "60s"
depends_on = [
module.main,
module.peering,
google_compute_global_address.private_service_access_address,
google_service_networking_connection.private_vpc_connection,
module.region1_router1,
module.region1_router2,
module.region2_router1,
module.region2_router2,
module.private_service_connect,
google_dns_policy.default_policy,
module.peering_zone,
module.firewall_rules,
google_compute_router.nat_router_region1,
google_compute_address.nat_external_addresses1,
google_compute_router_nat.nat_external_addresses_region1,
google_compute_router.nat_router_region2,
google_compute_address.nat_external_addresses_region2,
google_compute_router_nat.egress_nat_region2,
]
}
module "regular_service_perimeter" {
source = "terraform-google-modules/vpc-service-controls/google//modules/regular_service_perimeter"
version = "~> 6.0"
policy = var.access_context_manager_policy_id
perimeter_name = local.perimeter_name
description = "Default VPC Service Controls perimeter"
# configurations for a perimeter in enforced mode.
resources = var.enforce_vpcsc ? [var.project_number] : []
access_levels = var.enforce_vpcsc ? [module.access_level.name] : []
restricted_services = var.enforce_vpcsc ? var.restricted_services : []
vpc_accessible_services = var.enforce_vpcsc ? ["RESTRICTED-SERVICES"] : []
ingress_policies = var.enforce_vpcsc ? var.ingress_policies : []
egress_policies = var.enforce_vpcsc ? var.egress_policies : []
# configurations for a perimeter in dry run mode.
resources_dry_run = [var.project_number]
access_levels_dry_run = [module.access_level_dry_run.name]
restricted_services_dry_run = var.restricted_services_dry_run
vpc_accessible_services_dry_run = ["RESTRICTED-SERVICES"]
ingress_policies_dry_run = var.ingress_policies_dry_run
egress_policies_dry_run = var.egress_policies_dry_run
depends_on = [
time_sleep.wait_vpc_sc_propagation
]
}
resource "google_access_context_manager_service_perimeter" "bridge_to_network_hub_perimeter" {
count = var.mode == "spoke" ? 1 : 0
perimeter_type = "PERIMETER_TYPE_BRIDGE"
parent = "accessPolicies/${var.access_context_manager_policy_id}"
name = "accessPolicies/${var.access_context_manager_policy_id}/servicePerimeters/${local.bridge_name}"
title = local.bridge_name
use_explicit_dry_run_spec = var.enforce_vpcsc ? false : true
status {
resources = var.enforce_vpcsc ? formatlist("projects/%s", [var.project_number, var.restricted_net_hub_project_number]) : []
}
depends_on = [module.regular_service_perimeter]
}