README.md

Google Cloud Project Factory with G Suite Terraform Module

This module performs the same functions as the root module with the addition of integrating G Suite.

Usage

There are multiple examples included in the examples folder but simple usage is as follows:

module "project-factory" {
  source = "terraform-google-modules/project-factory/google//modules/gsuite_enabled"
  version = "~> 15.0"

  billing_account   = "ABCDEF-ABCDEF-ABCDEF"
  create_group      = true
  group_name        = "test_sa_group"
  group_role        = "roles/editor"
  name              = "pf-test-1"
  org_id            = "1234567890"
  random_project_id = true
  sa_group          = "test_sa_group@yourdomain.com"
  shared_vpc        = "shared_vpc_host_name"

  shared_vpc_subnets = [
    "projects/base-project-196723/regions/us-east1/subnetworks/default",
    "projects/base-project-196723/regions/us-central1/subnetworks/default",
    "projects/base-project-196723/regions/us-central1/subnetworks/subnet-1",
  ]

  usage_bucket_name   = "pf-test-1-usage-report-bucket"
  usage_bucket_prefix = "pf/test/1/integration"
}

Features

The G Suite Enabled module will perform the following actions in addition to those of the root module:

1. Create a new Google group for the project using group_name if create_group is true.
2. Add the new default service account for the project to the sa_group in Google Groups, if specified.
3. Add the Google APIs service account to the api_sa_group, if specified.

The roles granted are specifically:

• New Default Service Account
  • MEMBER of the specified sa_group
• Google APIs Service Account
  • MEMBER of the specified api_sa_group

Inputs

Name	Description	Type	Default	Required
activate_apis	The list of apis to activate within the project	list(string)	[ "compute.googleapis.com" ]	no
api_sa_group	A G Suite group to place the Google APIs Service Account for the project in	string	""	no
auto_create_network	Create the default network	bool	false	no
billing_account	The ID of the billing account to associate this project with	string	n/a	yes
bucket_location	The location for a GCS bucket to create (optional)	string	""	no
bucket_name	A name for a GCS bucket to create (in the bucket_project project), useful for Terraform state (optional)	string	""	no
bucket_project	A project to create a GCS bucket (bucket_name) in, useful for Terraform state (optional)	string	""	no
bucket_versioning	Enable versioning for a GCS bucket to create (optional)	bool	false	no
budget_alert_pubsub_topic	The name of the Cloud Pub/Sub topic where budget related messages will be published, in the form of projects/{project_id}/topics/{topic_id}	string	null	no
budget_alert_spent_percents	A list of percentages of the budget to alert on when threshold is exceeded	list(number)	[ 0.5, 0.7, 1 ]	no
budget_amount	The amount to use for a budget alert	number	null	no
budget_monitoring_notification_channels	A list of monitoring notification channels in the form [projects/{project_id}/notificationChannels/{channel_id}]. A maximum of 5 channels are allowed.	list(string)	[]	no
consumer_quotas	The quotas configuration you want to override for the project.	list(object({ service = string, metric = string, dimensions = any, limit = string, value = string, }))	[]	no
create_group	Whether to create the group or not	bool	false	no
create_project_sa	Whether the default service account for the project shall be created	bool	true	no
default_network_tier	Default Network Service Tier for resources created in this project. If unset, the value will not be modified. See https://cloud.google.com/network-tiers/docs/using-network-service-tiers and https://cloud.google.com/network-tiers.	string	""	no
default_service_account	Project default service account setting: can be one of delete, deprivilege, disable, or keep.	string	"disable"	no
disable_dependent_services	Whether services that are enabled and which depend on this service should also be disabled when this service is destroyed.	bool	true	no
disable_services_on_destroy	Whether project services will be disabled when the resources are destroyed	bool	true	no
domain	The domain name (optional).	string	""	no
enable_shared_vpc_host_project	If this project is a shared VPC host project. If true, you must not set shared_vpc variable. Default is false.	bool	false	no
enable_shared_vpc_service_project	If shared VPC should be used	bool	false	no
folder_id	The ID of a folder to host this project	string	""	no
group_name	A group to control the project by being assigned group_role - defaults to ${project_name}-editors	string	""	no
group_role	The role to give the controlling group (group_name) over the project (defaults to project editor)	string	"roles/editor"	no
labels	Map of labels for project	map(string)	{}	no
lien	Add a lien on the project to prevent accidental deletion	bool	false	no
name	The name for the project	string	n/a	yes
org_id	The organization ID.	string	n/a	yes
project_id	The ID to give the project. If not provided, the name will be used.	string	""	no
project_sa_name	Default service account name for the project.	string	"project-service-account"	no
random_project_id	Adds a suffix of 4 random characters to the project_id	bool	false	no
sa_group	A G Suite group to place the default Service Account for the project in	string	""	no
sa_role	A role to give the default Service Account for the project (defaults to none)	string	""	no
shared_vpc	The ID of the host project which hosts the shared VPC	string	""	no
shared_vpc_subnets	List of subnets fully qualified subnet IDs (ie. projects/$project_id/regions/$region/subnetworks/$subnet_id)	list(string)	[]	no
usage_bucket_name	Name of a GCS bucket to store GCE usage reports in (optional)	string	""	no
usage_bucket_prefix	Prefix in the GCS bucket to store GCE usage reports in (optional)	string	""	no

Outputs

Name	Description
domain	The organization's domain
group_email	The email of the created G Suite group with group_name
group_name	The group_name of the G Suite group
project_bucket_self_link	Project's bucket selfLink
project_bucket_url	Project's bucket url
project_id	ID of the project
project_name	Name of the project
project_number	Numeric identifier for the project
service_account_display_name	The display name of the default service account
service_account_email	The email of the default service account
service_account_id	The id of the default service account
service_account_name	The fully-qualified name of the default service account
service_account_unique_id	The unique id of the default service account