Skip to content

Commit 28f3072

Browse files
nb-googbharathkkb
nb-goog
and
bharathkkb
authoredDec 31, 2024··
feat!: Restricting autokey module to autokey configuration use case (#163)
Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>
·
v4.0.0
1 parent f863889 commit 28f3072

29 files changed

+420
-442
lines changed
 

‎docs/importing_autokey_key_handles.md

-54
This file was deleted.

‎docs/upgrading_to_v4.0.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Upgrading to v4.0
2+
The v4.0 release of *kms* is a backwards incompatible release.
3+
4+
### Autokey Submodule
5+
The current users of Autokey submodules needs to
6+
- Switch `project_id` to `key_project_id`
7+
- Stop using `autokey_handles` field to generate keyhandles, instead directly use `google_kms_key_handle` terraform resource to create keyhandles. For detailed example check [bucket_setup_using_autokey](../examples/bucket_setup_using_autokey/).
8+
9+
10+
### To Migrate from v3.0 to v4.0
11+
Using V3.0 of Autokey modules if you have created keyhandles and wants to use them with V4.0 version then they need to be imported using below steps
12+
13+
1. Retrieve the keyhandles created:
14+
- Run `terraform state list module.autokey.google_kms_key_handle.primary` to list all keyhandles created using v3.0
15+
- For each item in the output of above CLI, run `terraform state show 'module.autokey.google_kms_key_handle.primary["<an id from the output of list>"]'` and copy the resulting `id` field from the cli output to notepad
16+
2. Delete all keyhandles from the state: run `terraform state rm module.autokey.google_kms_key_handle.primary`
17+
3. Update the main root module to use V4.0 version. Add the keyhandle config definition to the main root module for all the keyhandle found in step1.
18+
4. Import all the keyhandles configs using id copied in setp1 to the terraform state
19+
- for each keyhandle id found in step1, Run `terraform import resource.google_kms_key_handle.<key_handle_name_given_in_step3> "<paste corresponding keyhandle id copied in step 1>"`
20+
21+

‎examples/autokey_example/main.tf

-44
This file was deleted.

‎examples/autokey_setup/README.md

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Autokey Example
2+
3+
This example illustrates how to setup the `autokey` kms submodule for [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature.
4+
5+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
6+
## Inputs
7+
8+
| Name | Description | Type | Default | Required |
9+
|------|-------------|------|---------|:--------:|
10+
| folder\_id | The ID of the folder for which to configure and enable Autokey feature. | `string` | n/a | yes |
11+
| key\_project\_id | The ID of the project in which KMS keyring and KMS keys will be provisioned by autokey. | `string` | n/a | yes |
12+
13+
## Outputs
14+
15+
| Name | Description |
16+
|------|-------------|
17+
| autokey\_config\_id | An Autokey configuration identifier. |
18+
| key\_project\_id | The ID of the project in which kms keyring and kms keys will be provisioned by autokey. |
19+
20+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
21+
22+
To provision this example, run the following from within this directory:
23+
- `terraform init` to get the plugins
24+
- `terraform plan` to see the infrastructure plan
25+
- `terraform apply` to apply the infrastructure build
26+
- `terraform destroy` to destroy the built infrastructure

‎examples/autokey_setup/main.tf

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "autokey" {
18+
source = "terraform-google-modules/kms/google//modules/autokey"
19+
version = "~> 4.0"
20+
21+
key_project_id = var.key_project_id
22+
autokey_folder_number = var.folder_id
23+
}
24+

‎examples/autokey_setup/outputs.tf

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "autokey_config_id" {
18+
description = "An Autokey configuration identifier."
19+
value = module.autokey.autokey_config_id
20+
}
21+
22+
output "key_project_id" {
23+
description = "The ID of the project in which kms keyring and kms keys will be provisioned by autokey."
24+
value = var.key_project_id
25+
}

‎examples/autokey_setup/variables.tf

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "key_project_id" {
18+
description = "The ID of the project in which KMS keyring and KMS keys will be provisioned by autokey."
19+
type = string
20+
}
21+
22+
variable "folder_id" {
23+
type = string
24+
description = "The ID of the folder for which to configure and enable Autokey feature."
25+
}
26+

‎examples/autokey_example/README.md ‎examples/bucket_setup_using_autokey/README.md

+7-7
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
11
# Autokey Example
22

3-
This example illustrates how to use the `autokey` kms submodule for [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature.
3+
This example illustrates how to use the `autokey` kms submodule for [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature to create the bucket.
44

55
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
66
## Inputs
77

88
| Name | Description | Type | Default | Required |
99
|------|-------------|------|---------|:--------:|
10-
| autokey\_resource\_project\_id | The ID of the project for Autokey to be used (e.g: a storage project which expects to use Autokey as CMEK). | `string` | n/a | yes |
11-
| folder\_id | The Autokey folder number used by Autokey config resource. Required when using Autokey. | `string` | n/a | yes |
12-
| project\_id | The ID of the project in which to provision Autokey resources (autokey keyring and keyHandle keys). | `string` | n/a | yes |
10+
| bucket\_location | The GCP location where storage bucket will be created | `string` | `"us-central1"` | no |
11+
| folder\_id | The ID of the folder for which to configure and enable Autokey feature. | `string` | n/a | yes |
12+
| key\_project\_id | The ID of the project in which KMS keyring and KMS keys will be provisioned by autokey. | `string` | n/a | yes |
13+
| resource\_project\_id | The ID of the project in which to provision cloud storage bucket resource. | `string` | n/a | yes |
1314

1415
## Outputs
1516

1617
| Name | Description |
1718
|------|-------------|
18-
| autokey\_config\_id | An Autokey configuration identifier. |
19-
| autokey\_keyhandles | A map of KeyHandles created. |
20-
| autokey\_project\_id | Project used for autokey. |
19+
| bucket\_keyhandle | Keyhandle configuration created for the bucket. |
20+
| bucket\_name | Name of the bucket created. |
2121

2222
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
2323

‎examples/bucket_setup_using_autokey/main.tf

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "autokey" {
18+
source = "terraform-google-modules/kms/google//modules/autokey"
19+
version = "~> 4.0"
20+
21+
key_project_id = var.key_project_id
22+
autokey_folder_number = var.folder_id
23+
}
24+
25+
# Wait delay for autokey configuration.
26+
resource "time_sleep" "wait_autokey_config" {
27+
create_duration = "20s"
28+
depends_on = [module.autokey]
29+
}
30+
31+
resource "random_string" "suffix" {
32+
length = 4
33+
special = false
34+
upper = false
35+
}
36+
37+
resource "google_kms_key_handle" "bucket_keyhandle" {
38+
provider = google-beta
39+
name = "${var.resource_project_id}-keyhandle-${random_string.suffix.result}"
40+
project = var.resource_project_id
41+
location = var.bucket_location
42+
resource_type_selector = "storage.googleapis.com/Bucket"
43+
44+
lifecycle {
45+
ignore_changes = [name]
46+
}
47+
depends_on = [time_sleep.wait_autokey_config]
48+
}
49+
50+
module "bucket" {
51+
source = "terraform-google-modules/cloud-storage/google//modules/simple_bucket"
52+
version = "~> 9.0"
53+
54+
name = "${var.resource_project_id}-bucket-${random_string.suffix.result}"
55+
project_id = var.resource_project_id
56+
location = var.bucket_location
57+
encryption = {
58+
default_kms_key_name = resource.google_kms_key_handle.bucket_keyhandle.kms_key
59+
}
60+
61+
depends_on = [resource.google_kms_key_handle.bucket_keyhandle]
62+
}

‎examples/bucket_setup_using_autokey/outputs.tf

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "bucket_keyhandle" {
18+
description = "Keyhandle configuration created for the bucket."
19+
value = resource.google_kms_key_handle.bucket_keyhandle
20+
}
21+
22+
output "bucket_name" {
23+
description = "Name of the bucket created."
24+
value = module.bucket.name
25+
}

‎examples/bucket_setup_using_autokey/variables.tf

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "key_project_id" {
18+
description = "The ID of the project in which KMS keyring and KMS keys will be provisioned by autokey."
19+
type = string
20+
}
21+
22+
variable "folder_id" {
23+
type = string
24+
description = "The ID of the folder for which to configure and enable Autokey feature."
25+
}
26+
27+
variable "resource_project_id" {
28+
description = "The ID of the project in which to provision cloud storage bucket resource."
29+
type = string
30+
}
31+
32+
variable "bucket_location" {
33+
type = string
34+
description = "The GCP location where storage bucket will be created"
35+
default = "us-central1"
36+
}

‎modules/autokey/README.md

+3-7
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,18 @@
11
# Autokey submodule
22

3-
This is a submodule built to make [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature simple to be used. This submodule will create the [Autokey Config](https://cloud.google.com/kms/docs/enable-autokey#enable-autokey-folder) for an existing folder where you want to enable Autokey, set up the Cloud KMS [service agent](https://cloud.google.com/kms/docs/enable-autokey#autokey-service-agent) on an existing key project and create [Key Handles](https://cloud.google.com/kms/docs/resource-hierarchy#key_handles) for existing resource projects.
4-
3+
This is a submodule built to make [KMS Autokey](https://cloud.google.com/kms/docs/autokey-overview) feature simple to be used. This submodule will create the [Autokey Config](https://cloud.google.com/kms/docs/enable-autokey#enable-autokey-folder) for an existing folder where you want to enable Autokey, set up the Cloud KMS [service agent](https://cloud.google.com/kms/docs/enable-autokey#autokey-service-agent) on an existing key project.
54
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
65
## Inputs
76

87
| Name | Description | Type | Default | Required |
98
|------|-------------|------|---------|:--------:|
10-
| autokey\_folder\_number | The Autokey folder number used by Autokey config resource. Required when using Autokey. | `string` | n/a | yes |
11-
| autokey\_handles | (Optional) A KeyHandle is a resource used by Autokey to auto-provision CryptoKeys for CMEK for a particular service.<br>- name: The resource name for the KeyHandle.<br>- resource\_type\_selector: Indicates the resource type that the resulting CryptoKey is meant to protect, in the following format: {SERVICE}.googleapis.com/{TYPE}. For example, storage.googleapis.com/Bucket. All Cloud KMS Autokey compatible services available at https://cloud.google.com/kms/docs/autokey-overview#compatible-services.<br>- location: The location for the KeyHandle. A full list of valid locations can be found by running gcloud kms locations list.<br>- project: The ID of the project in which the resource belongs. If it is not provided, the provider project is used. | <pre>map(object({<br> name = string<br> resource_type_selector = string<br> location = string<br> project = string<br> }))</pre> | `null` | no |
12-
| project\_id | Project id where the Autokey configuration and KeyHandles will be created. | `string` | n/a | yes |
9+
| autokey\_folder\_number | The folder number on which autokey will be configured and enabled. Required when using Autokey. | `string` | n/a | yes |
10+
| key\_project\_id | The ID of the project in which kms keyrings and keys will be provisioned by the Autokey. | `string` | n/a | yes |
1311

1412
## Outputs
1513

1614
| Name | Description |
1715
|------|-------------|
1816
| autokey\_config\_id | An Autokey configuration identifier. |
19-
| autokey\_keyhandles | A map of KeyHandles created. |
20-
| random\_suffix | Random 4 digits suffix used in Autokey submodule. |
2117

2218
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/autokey/iam.tf

+2-8
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,11 @@
1515
*/
1616

1717
data "google_project" "kms_project" {
18-
project_id = var.project_id
18+
project_id = var.key_project_id
1919
}
2020

2121
#Create KMS Service Agent
2222
resource "google_project_service_identity" "kms_service_agent" {
23-
count = var.autokey_handles != null ? 1 : 0
2423
provider = google-beta
2524

2625
service = "cloudkms.googleapis.com"
@@ -29,27 +28,22 @@ resource "google_project_service_identity" "kms_service_agent" {
2928

3029
# Wait delay after creating service agent.
3130
resource "time_sleep" "wait_service_agent" {
32-
count = var.autokey_handles != null ? 1 : 0
33-
3431
create_duration = "10s"
3532
depends_on = [google_project_service_identity.kms_service_agent]
3633
}
3734

3835
#Grant the KMS Service Agent the Cloud KMS Admin role
3936
resource "google_project_iam_member" "autokey_project_admin" {
40-
count = var.autokey_handles != null ? 1 : 0
4137
provider = google-beta
4238

43-
project = var.project_id
39+
project = var.key_project_id
4440
role = "roles/cloudkms.admin"
4541
member = "serviceAccount:service-${data.google_project.kms_project.number}@gcp-sa-cloudkms.iam.gserviceaccount.com"
4642
depends_on = [time_sleep.wait_service_agent]
4743
}
4844

4945
# Wait delay after granting IAM permissions
5046
resource "time_sleep" "wait_srv_acc_permissions" {
51-
count = var.autokey_handles != null ? 1 : 0
52-
5347
create_duration = "10s"
5448
depends_on = [google_project_iam_member.autokey_project_admin]
5549
}

‎modules/autokey/main.tf

+2-23
Original file line numberDiff line numberDiff line change
@@ -18,27 +18,6 @@ resource "google_kms_autokey_config" "primary" {
1818
provider = google-beta
1919

2020
folder = var.autokey_folder_number
21-
key_project = "projects/${var.project_id}"
22-
}
23-
24-
resource "random_string" "suffix" {
25-
length = 4
26-
special = false
27-
upper = false
28-
}
29-
30-
resource "google_kms_key_handle" "primary" {
31-
for_each = var.autokey_handles != null ? var.autokey_handles : tomap({})
32-
provider = google-beta
33-
34-
project = each.value.project
35-
name = "${each.value.name}-${random_string.suffix.result}"
36-
location = each.value.location
37-
resource_type_selector = each.value.resource_type_selector
38-
39-
lifecycle {
40-
ignore_changes = [name]
41-
}
42-
43-
depends_on = [time_sleep.wait_srv_acc_permissions]
21+
key_project = "projects/${var.key_project_id}"
22+
depends_on = [time_sleep.wait_srv_acc_permissions]
4423
}

‎modules/autokey/outputs.tf

-10
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,3 @@ output "autokey_config_id" {
1818
description = "An Autokey configuration identifier."
1919
value = google_kms_autokey_config.primary.id
2020
}
21-
22-
output "autokey_keyhandles" {
23-
description = "A map of KeyHandles created."
24-
value = var.autokey_handles != null ? google_kms_key_handle.primary : {}
25-
}
26-
27-
output "random_suffix" {
28-
description = "Random 4 digits suffix used in Autokey submodule."
29-
value = random_string.suffix.result
30-
}

‎modules/autokey/variables.tf

+3-19
Original file line numberDiff line numberDiff line change
@@ -14,29 +14,13 @@
1414
* limitations under the License.
1515
*/
1616

17-
variable "project_id" {
18-
description = "Project id where the Autokey configuration and KeyHandles will be created."
17+
variable "key_project_id" {
18+
description = "The ID of the project in which kms keyrings and keys will be provisioned by the Autokey."
1919
type = string
2020
}
2121

2222
variable "autokey_folder_number" {
2323
type = string
24-
description = "The Autokey folder number used by Autokey config resource. Required when using Autokey."
24+
description = "The folder number on which autokey will be configured and enabled. Required when using Autokey."
2525
}
2626

27-
variable "autokey_handles" {
28-
type = map(object({
29-
name = string
30-
resource_type_selector = string
31-
location = string
32-
project = string
33-
}))
34-
description = <<-EOF
35-
(Optional) A KeyHandle is a resource used by Autokey to auto-provision CryptoKeys for CMEK for a particular service.
36-
- name: The resource name for the KeyHandle.
37-
- resource_type_selector: Indicates the resource type that the resulting CryptoKey is meant to protect, in the following format: {SERVICE}.googleapis.com/{TYPE}. For example, storage.googleapis.com/Bucket. All Cloud KMS Autokey compatible services available at https://cloud.google.com/kms/docs/autokey-overview#compatible-services.
38-
- location: The location for the KeyHandle. A full list of valid locations can be found by running gcloud kms locations list.
39-
- project: The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
40-
EOF
41-
default = null
42-
}

‎scripts/create_autokey_tfvars_file.sh

-64
This file was deleted.

‎scripts/export_autokey_env_vars.sh

-89
This file was deleted.

‎scripts/import_autokey_state.sh

-43
This file was deleted.

‎scripts/unset_autokey_env_vars.sh

-31
This file was deleted.

‎test/fixtures/autokey_setup_fixture/main.tf

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
module "autokey_setup_fixture" {
17+
source = "../../../examples/autokey_setup"
18+
key_project_id = var.project_id
19+
folder_id = var.folder_id
20+
}

‎examples/autokey_example/outputs.tf ‎test/fixtures/autokey_setup_fixture/outputs.tf

+3-8
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,10 @@
1616

1717
output "autokey_config_id" {
1818
description = "An Autokey configuration identifier."
19-
value = module.autokey.autokey_config_id != null ? module.autokey.autokey_config_id : ""
19+
value = module.autokey_setup_fixture.autokey_config_id
2020
}
2121

22-
output "autokey_keyhandles" {
23-
description = "A map of KeyHandles created."
24-
value = module.autokey.autokey_keyhandles != null ? module.autokey.autokey_keyhandles : {}
25-
}
26-
27-
output "autokey_project_id" {
28-
description = "Project used for autokey."
22+
output "key_project_id" {
23+
description = "The ID of the project in which KMS keyring and KMS keys will be provisioned by autokey."
2924
value = var.project_id
3025
}

‎examples/autokey_example/variables.tf ‎test/fixtures/autokey_setup_fixture/variables.tf

+3-8
Original file line numberDiff line numberDiff line change
@@ -15,17 +15,12 @@
1515
*/
1616

1717
variable "project_id" {
18-
description = "The ID of the project in which to provision Autokey resources (autokey keyring and keyHandle keys)."
19-
type = string
20-
}
21-
22-
variable "autokey_resource_project_id" {
23-
description = "The ID of the project for Autokey to be used (e.g: a storage project which expects to use Autokey as CMEK)."
18+
description = "The ID of the project in which KMS keyring and KMS keys will be provisioned by autokey."
2419
type = string
2520
}
2621

2722
variable "folder_id" {
23+
description = "The ID of the folder for which to configure and enable Autokey feature."
2824
type = string
29-
description = "The Autokey folder number used by Autokey config resource. Required when using Autokey."
30-
}
3125

26+
}

‎test/fixtures/bucket_setup_using_autokey_fixture/main.tf

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
module "bucket_setup_using_autokey_fixture" {
17+
source = "../../../examples/bucket_setup_using_autokey"
18+
key_project_id = var.project_id
19+
folder_id = var.folder_id
20+
resource_project_id = var.resource_project_id
21+
bucket_location = var.bucket_location
22+
}

‎test/fixtures/bucket_setup_using_autokey_fixture/outputs.tf

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "bucket_keyhandle" {
18+
description = "Keyhandle configuration created for the bucket."
19+
value = module.bucket_setup_using_autokey_fixture.bucket_keyhandle
20+
}
21+
22+
output "bucket_name" {
23+
description = "Name of the bucket created."
24+
value = module.bucket_setup_using_autokey_fixture.bucket_name
25+
}

‎test/fixtures/bucket_setup_using_autokey_fixture/variables.tf

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The ID of the project in which KMS keyring and KMS keys will be provisioned by autokey."
19+
type = string
20+
}
21+
22+
variable "folder_id" {
23+
type = string
24+
description = "The ID of the folder for which to configure and enable Autokey feature."
25+
}
26+
27+
variable "resource_project_id" {
28+
description = "The ID of the project in which to provision cloud storage bucket resources."
29+
type = string
30+
}
31+
32+
variable "bucket_location" {
33+
type = string
34+
description = "The GCP location where storage bucket will be created"
35+
default = "us-central1"
36+
}

‎test/integration/autokey_example/autokey_example_test.go ‎test/integration/autokey_setup/autokey_setup_test.go

+6-25
Original file line numberDiff line numberDiff line change
@@ -12,36 +12,27 @@
1212
// See the License for the specific language governing permissions and
1313
// limitations under the License.
1414

15-
package autokey_example
15+
package autokey_setup
1616

1717
import (
1818
"context"
1919
"fmt"
2020
"io"
21-
"regexp"
2221
"testing"
2322

24-
"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/gcloud"
2523
"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/tft"
2624
"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/utils"
2725
"github.com/stretchr/testify/assert"
2826
"golang.org/x/oauth2/google"
2927
)
3028

31-
func validateKeyHandleVersion(input string, projectId string, autokeyResource string) bool {
32-
pattern := fmt.Sprintf(`^projects/%s/locations/us-central1/keyRings/autokey/cryptoKeys/%s-(bigquery-dataset|compute-disk|storage-bucket)-.*?/cryptoKeyVersions/1$`, projectId, autokeyResource)
33-
regex := regexp.MustCompile(pattern)
34-
return regex.MatchString(input)
35-
}
36-
37-
func TestAutokeyExample(t *testing.T) {
38-
bpt := tft.NewTFBlueprintTest(t)
29+
func TestAutokeySetup(t *testing.T) {
30+
bpt := tft.NewTFBlueprintTest(t, tft.WithTFDir("../../fixtures/autokey_setup_fixture"))
3931
bpt.DefineVerify(func(assert *assert.Assertions) {
4032
bpt.DefaultVerify(assert)
4133

42-
projectId := bpt.GetStringOutput("autokey_project_id")
34+
kmsProjectId := bpt.GetStringOutput("key_project_id")
4335
autokeyConfig := bpt.GetStringOutput("autokey_config_id")
44-
autokeyResourceProjectNumber := bpt.GetTFSetupJsonOutput("autokey_resource_project_number")
4536

4637
// Autokey config doesn't have a gcloud command yet. That's why we need to hit the API.
4738
autokeyConfigUrl := fmt.Sprintf("https://cloudkms.googleapis.com/v1/%s", autokeyConfig)
@@ -65,19 +56,9 @@ func TestAutokeyExample(t *testing.T) {
6556

6657
result := utils.ParseJSONResult(t, string(body))
6758

68-
// Asserting if Autokey configuration was created
59+
// Asserting if Autokey configuration was enabled with correct kms project id
6960
autokeyConfigProject := result.Get("keyProject").String()
70-
assert.Equal(autokeyConfigProject, fmt.Sprintf("projects/%s", projectId), "autokey expected for project %s", projectId)
71-
72-
// Asserting if Autokey keyring was created
73-
op := gcloud.Runf(t, "--project=%s kms keyrings list --location us-central1 --filter name:autokey", projectId).Array()[0].Get("name")
74-
assert.Contains(op.String(), fmt.Sprintf("projects/%s/locations/us-central1/keyRings/autokey", projectId), "Contains Autokey KeyRing")
75-
76-
// Asserting if Autokey keyHandles were created
77-
op1 := gcloud.Runf(t, "kms keys list --project=%s --keyring autokey --location us-central1", projectId).Array()
78-
for _, element := range op1 {
79-
assert.True(validateKeyHandleVersion(element.Get("primary").Map()["name"].Str, projectId, autokeyResourceProjectNumber.Str), "Contains KeyHandles")
80-
}
61+
assert.Equal(autokeyConfigProject, fmt.Sprintf("projects/%s", kmsProjectId), "autokey expected for project %s", kmsProjectId)
8162
})
8263

8364
bpt.Test()

‎test/integration/bucket_setup_using_autokey/bucket_setup_using_autokey_test.go

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
// Copyright 2024 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package bucket_setup_using_autokey
16+
17+
import (
18+
"testing"
19+
20+
"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/gcloud"
21+
"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/tft"
22+
"github.com/stretchr/testify/assert"
23+
)
24+
25+
func TestBucketSetupUsingAutokey(t *testing.T) {
26+
bpt := tft.NewTFBlueprintTest(t, tft.WithTFDir("../../fixtures/bucket_setup_using_autokey_fixture"))
27+
bpt.DefineVerify(func(assert *assert.Assertions) {
28+
bpt.DefaultVerify(assert)
29+
30+
bucketKeyHandle := bpt.GetJsonOutput("bucket_keyhandle")
31+
bucketName := bpt.GetStringOutput("bucket_name")
32+
33+
keyHandleKmsKey := bucketKeyHandle.Get("kms_key").String()
34+
op1 := gcloud.Runf(t, "storage buckets describe gs://%s", bucketName).Array()
35+
bucketKmsKey := op1[0].Map()["default_kms_key"].Str
36+
assert.True(keyHandleKmsKey != "", "Invalid KMS Key generated for bucket keyhandle")
37+
assert.True(bucketKmsKey == keyHandleKmsKey, "KMS Key generated for bucket keyhandle %s is not matching with kms key used in bucket %s", keyHandleKmsKey, bucketKmsKey)
38+
})
39+
40+
bpt.Test()
41+
}

‎test/setup/outputs.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,11 @@ output "project_id" {
1818
value = module.project_ci_kms.project_id
1919
}
2020

21-
output "autokey_resource_project_id" {
21+
output "resource_project_id" {
2222
value = module.autokey_resource_project.project_id
2323
}
2424

25-
output "autokey_resource_project_number" {
25+
output "resource_project_number" {
2626
value = module.autokey_resource_project.project_number
2727
}
2828

0 commit comments

Comments
 (0)
Please sign in to comment.