refactor (GoogleCloudPlatform#2842)

Author: ludoo

modules/data-catalog-tag-template/README.md

@@ -2,25 +2,31 @@
 
 This module allows managing [Data Catalog Tag Templates](https://cloud.google.com/data-catalog/docs/tags-and-tag-templates).
 
-## Examples
+<!-- BEGIN TOC -->
+- [Simple Tag Template](#simple-tag-template)
+- [Tag Template with IAM](#tag-template-with-iam)
+- [Factory](#factory)
+- [Variables](#variables)
+- [Outputs](#outputs)
+<!-- END TOC -->
 
-### Simple Tag Template
+## Simple Tag Template
 
 ```hcl
 module "data-catalog-tag-template" {
   source     = "./fabric/modules/data-catalog-tag-template"
   project_id = "my-project"
+  region     = "europe-west1"
   tag_templates = {
     demo_var = {
-      region       = "europe-west1"
       display_name = "Demo Tag Template"
       fields = {
         source = {
           display_name = "Source of data asset"
+          is_required  = true
           type = {
             primitive_type = "STRING"
           }
-          is_required = true
         }
       }
     }
@@ -29,142 +35,68 @@ module "data-catalog-tag-template" {
 # tftest modules=1 resources=1
 ```
 
-### Tag Template with IAM
+## Tag Template with IAM
 
-```hcl
-module "data-catalog-tag-template" {
-  source     = "./fabric/modules/data-catalog-tag-template"
-  project_id = "my-project"
-  tag_templates = {
-    demo_var = {
-      region       = "europe-west1"
-      display_name = "Demo Tag Template"
-      fields = {
-        source = {
-          display_name = "Source of data asset"
-          type = {
-            primitive_type = "STRING"
-          }
-          is_required = true
-        }
-      }
-    }
-  }
-  iam = {
-    "roles/datacatalog.tagTemplateOwner" = ["group:[email protected]"]
-    "roles/datacatalog.tagTemplateUser"  = ["group:[email protected]"]
-  }
-}
-# tftest modules=1 resources=3
-```
+The module conforms to our standard IAM interface and implements the `iam`, `iam_bindings` and `iam_bindings_additive` variables.
 
 ```hcl
 module "data-catalog-tag-template" {
   source     = "./fabric/modules/data-catalog-tag-template"
-  project_id = var.project_id
-  tag_templates = {
-    demo_var = {
-      region       = "europe-west1"
-      display_name = "Demo Tag Template"
-      fields = {
-        source = {
-          display_name = "Source of data asset"
-          type = {
-            primitive_type = "STRING"
-          }
-          is_required = true
-        }
-      }
-    }
-  }
-  iam_bindings = {
-    admin-with-delegated_roles = {
-      role    = "roles/datacatalog.tagTemplateOwner"
-      members = ["group:[email protected]"]
-      condition = {
-        title = "delegated-role-grants"
-        expression = format(
-          "api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([%s])",
-          join(",", formatlist("'%s'",
-            [
-              "roles/datacatalog.tagTemplateOwner"
-            ]
-          ))
-        )
-      }
-    }
-  }
-}
-# tftest modules=1 resources=2
-```
-
-```hcl
-module "data-catalog-tag-template" {
-  source     = "./fabric/modules/data-catalog-tag-template"
-  project_id = var.project_id
+  project_id = "my-project"
+  region     = "europe-west1"
   tag_templates = {
     demo_var = {
-      region       = "europe-west1"
       display_name = "Demo Tag Template"
+      is_required  = true
       fields = {
         source = {
           display_name = "Source of data asset"
           type = {
             primitive_type = "STRING"
           }
-          is_required = true
         }
       }
-    }
-  }
-  iam_bindings_additive = {
-    admin-with-delegated_roles = {
-      role   = "roles/datacatalog.tagTemplateOwner"
-      member = "group:[email protected]"
-      condition = {
-        title = "delegated-role-grants"
-        expression = format(
-          "api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([%s])",
-          join(",", formatlist("'%s'",
-            [
-              "roles/datacatalog.tagTemplateOwner"
-            ]
-          ))
-        )
+      iam = {
+        "roles/datacatalog.tagTemplateOwner" = [
+          "group:[email protected]"
+        ]
+        "roles/datacatalog.tagTemplateUser" = [
+          "group:[email protected]"
+        ]
       }
     }
   }
 }
-# tftest modules=1 resources=2
+# tftest modules=1 resources=3
 ```
 
-### Factory
+## Factory
 
 Similarly to other modules, a rules factory (see [Resource Factories](../../blueprints/factories/)) is also included here to allow tag template management via descriptive configuration files.
 
-Factory configuration is via one optional attributes in the `factory_config_path` variable specifying the path where tag template files are stored.
+Factory configuration is done via a single optional attribute in the `factory_config_path` variable specifying the path where tag template files are stored.
 
-Factory tag templates are merged with rules declared in code, with the latter taking precedence where both use the same key.
+Factory tag templates are merged with rules declared in code, with the latter taking precedence if both use the same key.
 
-The name of the file will be used as `tag_template_id` field.
+The name of the file will be used as the `tag_template_id` field.
 
 This is an example of a simple factory:
 
 ```hcl
 module "data-catalog-tag-template" {
   source     = "./fabric/modules/data-catalog-tag-template"
   project_id = "my-project"
+  region     = "europe-west1"
   tag_templates = {
     demo_var = {
-      region       = "europe-west1"
       display_name = "Demo Tag Template"
       fields = {
         source = {
           display_name = "Source of data asset"
+          is_required  = true
           type = {
             primitive_type = "STRING"
           }
-          is_required = true
         }
       }
     }
@@ -179,18 +111,17 @@ module "data-catalog-tag-template" {
 ```yaml
 # tftest-file id=demo_tag path=data/demo.yaml
 
-region: europe-west2
 display_name: Demo Tag Template
 fields:
   source:
       display_name: Source of data asset
+      is_required: true
       type:
         primitive_type: STRING
-      is_required: true
   pii_type:
       display_name: PII type
       type:
-        enum_type:
+        enum_type_values:
           - EMAIL
           - SOCIAL SECURITY NUMBER
           - NONE
@@ -200,17 +131,15 @@ fields:
 
 | name | description | type | required | default |
 |---|---|:---:|:---:|:---:|
-| [project_id](variables.tf#L62) | Id of the project where Tag Templates will be created. | <code>string</code> | ✓ |  |
+| [project_id](variables.tf#L26) | Id of the project where Tag Templates will be created. | <code>string</code> | ✓ |  |
+| [region](variables.tf#L31) | Default region for tag templates. | <code>string</code> | ✓ |  |
 | [factories_config](variables.tf#L17) | Paths to data files and folders that enable factory functionality. | <code title="object&#40;&#123;&#10;  tag_templates &#61; optional&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [iam](variables.tf#L26) | IAM bindings in {ROLE => [MEMBERS]} format. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [iam_bindings](variables.tf#L32) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code title="map&#40;object&#40;&#123;&#10;  members &#61; list&#40;string&#41;&#10;  role    &#61; string&#10;  condition &#61; optional&#40;object&#40;&#123;&#10;    expression  &#61; string&#10;    title       &#61; string&#10;    description &#61; optional&#40;string&#41;&#10;  &#125;&#41;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [iam_bindings_additive](variables.tf#L47) | Individual additive IAM bindings. Keys are arbitrary. | <code title="map&#40;object&#40;&#123;&#10;  member &#61; string&#10;  role   &#61; string&#10;  condition &#61; optional&#40;object&#40;&#123;&#10;    expression  &#61; string&#10;    title       &#61; string&#10;    description &#61; optional&#40;string&#41;&#10;  &#125;&#41;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [tag_templates](variables.tf#L67) | Tag templates definitions in the form {TAG_TEMPLATE_ID => TEMPLATE_DEFINITION}. | <code title="map&#40;object&#40;&#123;&#10;  display_name &#61; optional&#40;string&#41;&#10;  force_delete &#61; optional&#40;bool, false&#41;&#10;  region       &#61; string&#10;  fields &#61; map&#40;object&#40;&#123;&#10;    display_name &#61; optional&#40;string&#41;&#10;    description  &#61; optional&#40;string&#41;&#10;    type &#61; object&#40;&#123;&#10;      primitive_type &#61; optional&#40;string&#41;&#10;      enum_type &#61; optional&#40;list&#40;object&#40;&#123;&#10;        allowed_values &#61; object&#40;&#123;&#10;          display_name &#61; string&#10;        &#125;&#41;&#10;      &#125;&#41;&#41;, null&#41;&#10;    &#125;&#41;&#10;    is_required &#61; optional&#40;bool, false&#41;&#10;    order       &#61; optional&#40;number&#41;&#10;  &#125;&#41;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [tag_templates](variables.tf#L36) | Tag templates definitions in the form {TAG_TEMPLATE_ID => TEMPLATE_DEFINITION}. | <code title="map&#40;object&#40;&#123;&#10;  display_name &#61; optional&#40;string&#41;&#10;  force_delete &#61; optional&#40;bool, false&#41;&#10;  region       &#61; optional&#40;string&#41;&#10;  fields &#61; map&#40;object&#40;&#123;&#10;    display_name &#61; optional&#40;string&#41;&#10;    description  &#61; optional&#40;string&#41;&#10;    is_required  &#61; optional&#40;bool, false&#41;&#10;    order        &#61; optional&#40;number&#41;&#10;    type &#61; object&#40;&#123;&#10;      primitive_type   &#61; optional&#40;string&#41;&#10;      enum_type_values &#61; optional&#40;list&#40;string&#41;&#41;&#10;    &#125;&#41;&#10;  &#125;&#41;&#41;&#10;  iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10;    members &#61; list&#40;string&#41;&#10;    role    &#61; string&#10;    condition &#61; optional&#40;object&#40;&#123;&#10;      expression  &#61; string&#10;      title       &#61; string&#10;      description &#61; optional&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10;    member &#61; string&#10;    role   &#61; string&#10;    condition &#61; optional&#40;object&#40;&#123;&#10;      expression  &#61; string&#10;      title       &#61; string&#10;      description &#61; optional&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 
 ## Outputs
 
 | name | description | sensitive |
 |---|---|:---:|
 | [data_catalog_tag_template_ids](outputs.tf#L17) | Data catalog tag template ids. |  |
-| [data_catalog_tag_templates](outputs.tf#L22) | Data catalog tag templates. |  |
+| [data_catalog_tag_templates](outputs.tf#L25) | Data catalog tag templates. |  |
 <!-- END TFDOC -->

modules/data-catalog-tag-template/iam.tf

@@ -17,57 +17,52 @@
 # tfdoc:file:description IAM bindings
 
 locals {
-  iam_template_map = {
-    for binding in flatten([
-      for role, members in var.iam : [
-        for template_k, template_v in google_data_catalog_tag_template.tag_template : {
-          template = template_v,
-          role     = role,
-          members  = members
-        }
-      ]
-    ]) : "${binding.template.tag_template_id}-${binding.role}" => binding
-  }
-
-  iam_bindings_template_map = {
-    for binding in flatten([
-      for iam_bindings_k, iam_bindings_v in var.iam_bindings : [
-        for template_k, template_v in google_data_catalog_tag_template.tag_template : {
-          template         = template_v,
-          iam_bindings_key = iam_bindings_k,
-          role             = iam_bindings_v.role,
-          member           = iam_bindings_v.members,
-          condition        = iam_bindings_v.condition
-        }
-      ]
-    ]) : "${binding.template.tag_template_id}-${binding.iam_bindings_key}" => binding
-  }
-
-  iam_bindings_additive_template_map = {
-    for binding in flatten([
-      for iam_bindings_k, iam_bindings_v in var.iam_bindings_additive : [
-        for template_k, template_v in google_data_catalog_tag_template.tag_template : {
-          template       = template_v,
-          iam_bindings_k = iam_bindings_k,
-          role           = iam_bindings_v.role,
-          member         = iam_bindings_v.member,
-          condition      = iam_bindings_v.condition
-        }
-      ]
-    ]) : "${binding.template.tag_template_id}-${binding.iam_bindings_k}" => binding
-  }
+  tt_iam = flatten([
+    for k, v in local.tag_templates : [
+      for role, members in v.iam : {
+        key     = k
+        role    = role
+        members = members
+      }
+    ]
+  ])
+  tt_iam_bindings = merge([
+    for k, v in local.tag_templates : {
+      for binding_key, data in v.iam_bindings :
+      binding_key => {
+        key       = k
+        role      = data.role
+        members   = data.members
+        condition = data.condition
+      }
+    }
+  ]...)
+  tt_iam_bindings_additive = merge([
+    for k, v in local.tag_templates : {
+      for binding_key, data in v.iam_bindings_additive :
+      binding_key => {
+        key       = k
+        role      = data.role
+        member    = data.member
+        condition = data.condition
+      }
+    }
+  ]...)
 }
 
 resource "google_data_catalog_tag_template_iam_binding" "authoritative" {
-  for_each     = local.iam_template_map
-  tag_template = each.value.template.id
+  for_each = {
+    for binding in local.tt_iam :
+    "${binding.key}.${binding.role}" => binding
+  }
+  tag_template = google_data_catalog_tag_template.default[each.value.key].id
   role         = each.value.role
   members      = each.value.members
 }
 
 resource "google_data_catalog_tag_template_iam_binding" "bindings" {
-  for_each     = local.iam_bindings_template_map
-  tag_template = each.value.template.id
+  for_each     = local.tt_iam_bindings
+  tag_template = google_data_catalog_tag_template.default[each.value.key].id
   role         = each.value.role
   members      = each.value.member
   dynamic "condition" {
@@ -81,8 +76,8 @@ resource "google_data_catalog_tag_template_iam_binding" "bindings" {
 }
 
 resource "google_data_catalog_tag_template_iam_member" "bindings" {
-  for_each     = local.iam_bindings_additive_template_map
-  tag_template = each.value.template.id
+  for_each     = local.tt_iam_bindings_additive
+  tag_template = google_data_catalog_tag_template.default[each.value.key].id
   role         = each.value.role
   member       = each.value.member
   dynamic "condition" {