Support project creation in different universes (GoogleCloudPlatform#2848)

* Support project creation in different universes

* Fix typo

* Revert prefix validation

* Add test

* Call new test

* Do not override project name

Author: juliocc

modules/project/README.md

@@ -1621,7 +1621,8 @@ alerts:
 | [skip_delete](variables.tf#L240) | Deprecated. Use deletion_policy. | <code>bool</code> |  | <code>null</code> |
 | [tag_bindings](variables-tags.tf#L81) | Tag bindings for this project, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
 | [tags](variables-tags.tf#L88) | Tags by key name. If `id` is provided, key or value creation is skipped. The `iam` attribute behaves like the similarly named one at module level. | <code title="map&#40;object&#40;&#123;&#10;  description &#61; optional&#40;string, &#34;Managed by the Terraform project module.&#34;&#41;&#10;  iam         &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10;    members &#61; list&#40;string&#41;&#10;    role    &#61; string&#10;    condition &#61; optional&#40;object&#40;&#123;&#10;      expression  &#61; string&#10;      title       &#61; string&#10;      description &#61; optional&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10;    member &#61; string&#10;    role   &#61; string&#10;    condition &#61; optional&#40;object&#40;&#123;&#10;      expression  &#61; string&#10;      title       &#61; string&#10;      description &#61; optional&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;  id &#61; optional&#40;string&#41;&#10;  values &#61; optional&#40;map&#40;object&#40;&#123;&#10;    description &#61; optional&#40;string, &#34;Managed by the Terraform project module.&#34;&#41;&#10;    iam         &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;    iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10;      members &#61; list&#40;string&#41;&#10;      role    &#61; string&#10;      condition &#61; optional&#40;object&#40;&#123;&#10;        expression  &#61; string&#10;        title       &#61; string&#10;        description &#61; optional&#40;string&#41;&#10;      &#125;&#41;&#41;&#10;    &#125;&#41;&#41;, &#123;&#125;&#41;&#10;    iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10;      member &#61; string&#10;      role   &#61; string&#10;      condition &#61; optional&#40;object&#40;&#123;&#10;        expression  &#61; string&#10;        title       &#61; string&#10;        description &#61; optional&#40;string&#41;&#10;      &#125;&#41;&#41;&#10;    &#125;&#41;&#41;, &#123;&#125;&#41;&#10;    id &#61; optional&#40;string&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [vpc_sc](variables.tf#L252) | VPC-SC configuration for the project, use when `ignore_changes` for resources is set in the VPC-SC module. | <code title="object&#40;&#123;&#10;  perimeter_name    &#61; string&#10;  perimeter_bridges &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;  is_dry_run        &#61; optional&#40;bool, false&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
+| [universe](variables.tf#L252) | GCP universe where deploy the project. This will be prepended to the project id. | <code>string</code> |  | <code>&#34;&#34;</code> |
+| [vpc_sc](variables.tf#L259) | VPC-SC configuration for the project, use when `ignore_changes` for resources is set in the VPC-SC module. | <code title="object&#40;&#123;&#10;  perimeter_name    &#61; string&#10;  perimeter_bridges &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;  is_dry_run        &#61; optional&#40;bool, false&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
 
 ## Outputs
 

modules/project/main.tf

@@ -15,6 +15,7 @@
  */
 
 locals {
+  # descriptive_name cannot contain colons, so we omit the universe from the default
   descriptive_name = (
     var.descriptive_name != null ? var.descriptive_name : "${local.prefix}${var.name}"
   )
@@ -25,6 +26,7 @@ locals {
   parent_type = var.parent == null ? null : split("/", var.parent)[0]
   parent_id   = var.parent == null ? null : split("/", var.parent)[1]
   prefix      = var.prefix == null ? "" : "${var.prefix}-"
+  project_id  = "${local.universe}${local.prefix}${var.name}"
   project = (
     var.project_create ?
     {
@@ -33,23 +35,24 @@ locals {
       name       = try(google_project.project[0].name, null)
     }
     : {
-      project_id = "${local.prefix}${var.name}"
+      project_id = local.project_id
       number     = try(data.google_project.project[0].number, null)
       name       = try(data.google_project.project[0].name, null)
     }
   )
+  universe = var.universe == "" ? "" : "${var.universe}:"
 }
 
 data "google_project" "project" {
   count      = var.project_create ? 0 : 1
-  project_id = "${local.prefix}${var.name}"
+  project_id = local.project_id
 }
 
 resource "google_project" "project" {
   count               = var.project_create ? 1 : 0
   org_id              = local.parent_type == "organizations" ? local.parent_id : null
   folder_id           = local.parent_type == "folders" ? local.parent_id : null
-  project_id          = "${local.prefix}${var.name}"
+  project_id          = local.project_id
   name                = local.descriptive_name
   billing_account     = var.billing_account
   auto_create_network = var.auto_create_network

modules/project/outputs.tf

@@ -28,7 +28,7 @@ output "custom_role_id" {
     for k, v in google_project_iam_custom_role.roles :
     # build the string manually so that role IDs can be used as map
     # keys (useful for folder/organization/project-level iam bindings)
-    (k) => "projects/${local.prefix}${var.name}/roles/${local.custom_roles[k].name}"
+    (k) => "projects/${local.project_id}/roles/${local.custom_roles[k].name}"
   }
 }
 
@@ -47,7 +47,7 @@ output "default_service_accounts" {
 
 output "id" {
   description = "Project id."
-  value       = "${local.prefix}${var.name}"
+  value       = local.project_id
   depends_on = [
     google_project.project,
     data.google_project.project,

modules/project/variables.tf

@@ -249,6 +249,13 @@ variable "skip_delete" {
   # }
 }
 
+variable "universe" {
+  description = "GCP universe where deploy the project. This will be prepended to the project id."
+  type        = string
+  default     = ""
+  nullable    = false
+}
+
 variable "vpc_sc" {
   description = "VPC-SC configuration for the project, use when `ignore_changes` for resources is set in the VPC-SC module."
   type = object({

tests/modules/project/tftest.yaml

@@ -27,3 +27,4 @@ tests:
   org_policies_list:
   org_policies_boolean:
   iam_by_principals_additive:
+  universe:

tests/modules/project/universe.tfvars

@@ -0,0 +1,2 @@
+prefix   = "foo"
+universe = "alpha"

tests/modules/project/universe.yaml

@@ -0,0 +1,26 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+values:
+  google_project.project[0]:
+    name: foo-my-project
+    project_id: alpha:foo-my-project
+
+counts:
+  google_project: 1
+
+outputs:
+  id: alpha:foo-my-project
+  name: foo-my-project
+  project_id: foo-my-project