fix!: update TPG version 3.62 and address tflint/CI (#90)

apeabody · web-flow · commit b33c20db9f23 · 2022-12-13T08:50:36.000-08:00
diff --git a/.kitchen.yml b/.kitchen.yml
@@ -16,6 +16,7 @@
 driver:
   name: "terraform"
   command_timeout: 1800
+  verify_version: false
 
 provisioner:
   name: "terraform"
diff --git a/Makefile b/Makefile
@@ -18,7 +18,7 @@
 # Make will use bash instead of sh
 SHELL := /usr/bin/env bash
 
-DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.0
+DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.10
 DOCKER_IMAGE_DEVELOPER_TOOLS := cft/developer-tools
 REGISTRY_URL := gcr.io/cloud-foundation-cicd
 
diff --git a/build/int.cloudbuild.yaml b/build/int.cloudbuild.yaml
@@ -75,4 +75,4 @@ tags:
 - 'integration'
 substitutions:
   _DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
-  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.0'
+  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.10'
diff --git a/build/lint.cloudbuild.yaml b/build/lint.cloudbuild.yaml
@@ -21,4 +21,4 @@ tags:
 - 'lint'
 substitutions:
   _DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
-  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.0'
+  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.10'
diff --git a/examples/bq-exfil-demo/README.md b/examples/bq-exfil-demo/README.md
@@ -64,7 +64,6 @@ terraform apply
 | folder\_id | Folder ID within the Organization: e.g. 1234567898765 | `string` | `""` | no |
 | members | List of members in the standard GCP form: user:{email}, serviceAccount:{email}, group:{email} | `list(string)` | `[]` | no |
 | org\_id | Organization ID. e.g. 1234567898765 | `string` | n/a | yes |
-| perimeter\_name | Name of the VPC SC perimeter | `string` | `"protect_the_daters"` | no |
 | region | Region where the bastion host will run | `string` | `"us-west1"` | no |
 | terraform\_service\_account | The Terraform service account email that should still be allowed in the perimeter to create buckets, datasets, etc. | `string` | n/a | yes |
 | zone | Zone where the bastion host will run | `string` | `"us-west1-a"` | no |
diff --git a/examples/bq-exfil-demo/variables.tf b/examples/bq-exfil-demo/variables.tf
@@ -40,12 +40,6 @@ variable "terraform_service_account" {
   description = "The Terraform service account email that should still be allowed in the perimeter to create buckets, datasets, etc."
 }
 
-variable "perimeter_name" {
-  type        = string
-  description = "Name of the VPC SC perimeter"
-  default     = "protect_the_daters"
-}
-
 variable "region" {
   description = "Region where the bastion host will run"
   type        = string
diff --git a/examples/onprem_demo/main.tf b/examples/onprem_demo/main.tf
@@ -15,7 +15,7 @@
  */
 
 provider "google" {
-  credentials = file("${var.credentials_path}")
+  credentials = file(var.credentials_path)
 }
 
 module "onprem_network" {
diff --git a/examples/onprem_demo/onprem_project/main.tf b/examples/onprem_demo/onprem_project/main.tf
@@ -283,7 +283,7 @@ resource "google_compute_route" "default_for_all" {
   dest_range  = "0.0.0.0/0"
   name        = "default-for-all"
   network     = google_compute_network.onprem-network.self_link
-  next_hop_ip = google_compute_instance.forward_proxy_instance.network_interface.0.network_ip
+  next_hop_ip = google_compute_instance.forward_proxy_instance.network_interface[0].network_ip
   priority    = "1000"
   project     = google_project.on_prem_network_project.project_id
 }
diff --git a/examples/onprem_demo/onprem_project/outputs.tf b/examples/onprem_demo/onprem_project/outputs.tf
@@ -20,6 +20,6 @@ output "ip_addr_onprem_vpn_router" {
 }
 
 output "windows_onprem_public_ip" {
-  value       = google_compute_instance.windows_jumphost.network_interface.0.access_config.0.nat_ip
+  value       = google_compute_instance.windows_jumphost.network_interface[0].access_config[0].nat_ip
   description = "Public IP address for the 'onprem' Windows jumphost"
 }
diff --git a/examples/onprem_demo/vpc_sc_project/main.tf b/examples/onprem_demo/vpc_sc_project/main.tf
@@ -272,7 +272,7 @@ module "regular_service_perimeter_1" {
   policy         = var.access_policy_name
   perimeter_name = "regular_perimeter_1"
   description    = "VPC Service Controls perimeter"
-  resources      = ["${google_project.vpc_sc_network_project.number}"]
+  resources      = [google_project.vpc_sc_network_project.number]
 
   restricted_services = ["bigquery.googleapis.com",
     "cloudkms.googleapis.com",
diff --git a/examples/onprem_demo/vpc_sc_project/outputs.tf b/examples/onprem_demo/vpc_sc_project/outputs.tf
@@ -20,6 +20,6 @@ output "ip_addr_cloud_vpn_router" {
 }
 
 output "windows_cloud_private_ip" {
-  value       = google_compute_instance.vpc_sc_windows_instance.network_interface.0.network_ip
+  value       = google_compute_instance.vpc_sc_windows_instance.network_interface[0].network_ip
   description = "Private IP address for the 'cloud-based' Windows instance"
 }
diff --git a/examples/simple_example_with_ingress_rule/main.tf b/examples/simple_example_with_ingress_rule/main.tf
@@ -84,6 +84,7 @@ module "regular_service_perimeter_1" {
 
 module "gcs_buckets" {
   source           = "terraform-google-modules/cloud-storage/google"
+  version          = "~> 3.4"
   project_id       = var.protected_project_ids["id"]
   names            = var.buckets_names
   randomize_suffix = true
diff --git a/modules/bridge_service_perimeter/main.tf b/modules/bridge_service_perimeter/main.tf
@@ -20,6 +20,7 @@ resource "google_access_context_manager_service_perimeter" "bridge_service_perim
   perimeter_type = "PERIMETER_TYPE_BRIDGE"
   name           = "accessPolicies/${var.policy}/servicePerimeters/${var.perimeter_name}"
   title          = var.perimeter_name
+  description    = var.description
 
   lifecycle {
     ignore_changes = [status]
diff --git a/modules/regular_service_perimeter/README.md b/modules/regular_service_perimeter/README.md
@@ -102,7 +102,7 @@ module "regular_service_perimeter_1" {
 | egress\_policies\_dry\_run | A list of all [egress policies](https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules#egress-rules-reference), each list object has a `from` and `to` value that describes egress\_from and egress\_to. Use same formatting as `egress_policies`. | <pre>list(object({<br>    from = any<br>    to   = any<br>  }))</pre> | `[]` | no |
 | ingress\_policies | A list of all [ingress policies](https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules#ingress-rules-reference), each list object has a `from` and `to` value that describes ingress\_from and ingress\_to.<br><br>Example: `[{ from={ sources={ resources=[], access_levels=[] }, identities=[], identity_type="ID_TYPE" }, to={ resources=[], operations={ "SRV_NAME"={ OP_TYPE=[] }}}}]`<br><br>Valid Values:<br>`ID_TYPE` = `null` or `IDENTITY_TYPE_UNSPECIFIED` (only allow indentities from list); `ANY_IDENTITY`; `ANY_USER_ACCOUNT`; `ANY_SERVICE_ACCOUNT`<br>`SRV_NAME` = "`*`" (allow all services) or [Specific Services](https://cloud.google.com/vpc-service-controls/docs/supported-products#supported_products)<br>`OP_TYPE` = [methods](https://cloud.google.com/vpc-service-controls/docs/supported-method-restrictions) or [permissions](https://cloud.google.com/vpc-service-controls/docs/supported-method-restrictions) | <pre>list(object({<br>    from = any<br>    to   = any<br>  }))</pre> | `[]` | no |
 | ingress\_policies\_dry\_run | A list of all [ingress policies](https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules#ingress-rules-reference), each list object has a `from` and `to` value that describes ingress\_from and ingress\_to. Use same formatting as `ingress_policies`. | <pre>list(object({<br>    from = any<br>    to   = any<br>  }))</pre> | `[]` | no |
-| perimeter\_name | Name of the perimeter. Should be one unified string. Must only be letters, numbers and underscores | `any` | n/a | yes |
+| perimeter\_name | Name of the perimeter. Should be one unified string. Must only be letters, numbers and underscores | `string` | n/a | yes |
 | policy | Name of the parent policy | `string` | n/a | yes |
 | resource\_keys | A list of keys to use for the Terraform state. The order should correspond to var.resources and the keys must not be dynamically computed. If `null`, var.resources will be used as keys. | `list(string)` | `null` | no |
 | resources | A list of GCP resources that are inside of the service perimeter. Currently only projects are allowed. | `list(string)` | `[]` | no |
diff --git a/modules/regular_service_perimeter/variables.tf b/modules/regular_service_perimeter/variables.tf
@@ -26,6 +26,7 @@ variable "description" {
 
 variable "perimeter_name" {
   description = "Name of the perimeter. Should be one unified string. Must only be letters, numbers and underscores"
+  type        = string
 }
 
 variable "restricted_services" {
diff --git a/test/integration/simple_example/controls/gcloud.rb b/test/integration/simple_example/controls/gcloud.rb
@@ -24,17 +24,16 @@
 ]
 
 control "big_query_vpc_positive_test" do
-  describe command("bq query --use_legacy_sql=false --project_id=#{protected_project_id} \'select * from `#{protected_project_id}.#{dataset_name}.example_table` limit 10\'" ) do
+  describe command("gcloud alpha bq tables show-rows --table=example_table --dataset=#{dataset_name} --limit=10 --project=#{protected_project_id}") do
     its(:exit_status) { should be 0 }
-
-    its(:stderr) { should include "Current status: DONE" }
+    its(:stderr) { should eq '' }
   end
 end
 
 control "big_query_vpc_negative_test" do
   describe command("bq query --use_legacy_sql=false --project_id=#{public_project_id} \'select * from `#{protected_project_id}.#{dataset_name}.example_table` limit 10\'" ) do
 
-    # exit_status should be 1 as this is intentionally trigerring an errror by accesing the BigQuery data from outside the perimeter.
+    # exit_status should be 1 as this is intentionally triggering an error by accessing the BigQuery data from outside the perimeter.
     its(:exit_status) { should be 1 }
     its(:stderr) { should eq '' }
     its(:stdout) { should include "Request is prohibited by organization's policy." }
diff --git a/versions.tf b/versions.tf
@@ -20,7 +20,7 @@ terraform {
 
     google = {
       source  = "hashicorp/google"
-      version = ">= 3.50, < 5.0"
+      version = ">= 3.62, < 5.0"
     }
   }
 

Original file line number	Diff line number	Diff line change
`@@ -15,7 +15,7 @@`
`15`	`15`	`*/`
`16`	`16`
`17`	`17`	`provider "google" {`
`18`		`- credentials = file("${var.credentials_path}")`
	`18`	`+ credentials = file(var.credentials_path)`
`19`	`19`	`}`
`20`	`20`
`21`	`21`	`module "onprem_network" {`
Original file line number	Diff line number	Diff line change
`@@ -283,7 +283,7 @@ resource "google_compute_route" "default_for_all" {`
`283`	`283`	`dest_range = "0.0.0.0/0"`
`284`	`284`	`name = "default-for-all"`
`285`	`285`	`network = google_compute_network.onprem-network.self_link`
`286`		`- next_hop_ip = google_compute_instance.forward_proxy_instance.network_interface.0.network_ip`
	`286`	`+ next_hop_ip = google_compute_instance.forward_proxy_instance.network_interface[0].network_ip`
`287`	`287`	`priority = "1000"`
`288`	`288`	`project = google_project.on_prem_network_project.project_id`
`289`	`289`	`}`
Original file line number	Diff line number	Diff line change
`@@ -20,6 +20,6 @@ output "ip_addr_onprem_vpn_router" {`
`20`	`20`	`}`
`21`	`21`
`22`	`22`	`output "windows_onprem_public_ip" {`
`23`		`- value = google_compute_instance.windows_jumphost.network_interface.0.access_config.0.nat_ip`
	`23`	`+ value = google_compute_instance.windows_jumphost.network_interface[0].access_config[0].nat_ip`
`24`	`24`	`description = "Public IP address for the 'onprem' Windows jumphost"`
`25`	`25`	`}`