Skip to content

fix(TPG >= 4.68)!: added missing features for egress policies #131

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Feb 13, 2024
Merged

fix(TPG >= 4.68)!: added missing features for egress policies #131

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
24eb5cc
added missing attributes for egress policies
cmalpe Jan 30, 2024
89ab382
updated terraform versions
cmalpe Jan 30, 2024
084cdd1
Merge pull request #1 from terraform-google-modules/master
cmalpe Feb 7, 2024
637bba3
added requested changes
cmalpe Feb 7, 2024
5bdddeb
added corrections for iterator
cmalpe Feb 8, 2024
a5ef64d
corrected resources variable name for status
cmalpe Feb 9, 2024
4ec7390
removed resources attribute from status block
cmalpe Feb 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 8 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,14 @@
This module handles opinionated VPC Service Controls and Access Context Manager configuration and deployments.

## Compatibility
This module is meant for use with Terraform 0.13+ and tested using Terraform 1.0+. If you find incompatibilities using Terraform >=0.13, please open an issue.
If you haven't
[upgraded](https://www.terraform.io/upgrade-guides/0-13.html) and need a Terraform
0.12.x-compatible version of this module, the last released version
intended for Terraform 0.12.x is [v2.1.0](https://registry.terraform.io/modules/terraform-google-modules/-vpc-service-controls/google/v2.1.0).
This module is meant for use with Terraform 1.3+ and tested using Terraform 1.3+. If you find incompatibilities using Terraform >=1.3, please open an issue.

## Version

Current version is 5.X. Upgrade guides:

- [3.X -> 4.0.](/docs/upgrading_to_v4.0.md)
- [4.X -> 6.0.](/docs/upgrading_to_v6.0.md)

## Usage
The root module only handles the configuration of the [access_context_manager_policy resource](https://www.terraform.io/docs/providers/google/r/access_context_manager_access_policy.html). For examples on how to use the root module with along with other submodules to configure all of VPC Service Controls and Access Context Manager resources, see the [examples](./examples/) folder and the [modules](./modules/) folder
Expand Down
5 changes: 5 additions & 0 deletions docs/upgrading_to_v6.0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
# Upgrading to v6.x

The v6.x release contains backwards-incompatible changes.

This update requires upgrading the minimum provider version to `4.68`.
39 changes: 29 additions & 10 deletions modules/regular_service_perimeter/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,13 +28,15 @@ resource "google_access_context_manager_service_perimeter" "regular_service_peri

status {
restricted_services = var.restricted_services
resources = [for item in var.resources : can(regex("global/networks", item)) ? format("//compute.googleapis.com/%s", item) : format("projects/%s", item)]
Copy link
Contributor

@g-awmalik g-awmalik Feb 9, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is adding the resource i.e. the project to the perimeter and then google_access_context_manager_service_perimeter_resource below tries to add it again leading to:

STDERR: Error: Unable to create ServicePerimeterResource, existing object already found: map[resource:projects/838237599229]

  with module.example.module.regular_service_perimeter_1.google_access_context_manager_service_perimeter_resource.service_perimeter_resource["838237599229"],
  on ../../../modules/regular_service_perimeter/main.tf line 229, in resource "google_access_context_manager_service_perimeter_resource" "service_perimeter_resource":
 229: resource "google_access_context_manager_service_perimeter_resource" "service_perimeter_resource" {
---- End output of terraform apply -auto-approve -lock=true -lock-timeout=0s -input=false -no-color -paral

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@cmalpe can u plz remove resource = ....

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change is done @imrannayer

access_levels = formatlist(
"accessPolicies/${var.policy}/accessLevels/%s",
var.access_levels
)

dynamic "ingress_policies" {
for_each = var.ingress_policies
iterator = ingress_policies
content {
ingress_from {
dynamic "sources" {
Expand Down Expand Up @@ -72,10 +74,18 @@ resource "google_access_context_manager_service_perimeter" "regular_service_peri
}
dynamic "egress_policies" {
for_each = var.egress_policies
iterator = egress_policies
content {
egress_from {
identity_type = lookup(egress_policies.value["from"], "identity_type", null)
identities = lookup(egress_policies.value["from"], "identities", null)
dynamic "sources" {
for_each = { for k, v in lookup(egress_policies.value["from"]["sources"], "access_levels", []) : v => "access_level" }
content {
access_level = sources.value == "access_level" ? sources.key != "*" ? "accessPolicies/${var.policy}/accessLevels/${sources.key}" : "*" : null
}
}
source_restriction = egress_policies.value["from"]["sources"] != null ? "SOURCE_RESTRICTION_ENABLED" : null
}
egress_to {
resources = lookup(egress_policies.value["to"], "resources", ["*"])
Expand Down Expand Up @@ -120,25 +130,26 @@ resource "google_access_context_manager_service_perimeter" "regular_service_peri

dynamic "ingress_policies" {
for_each = var.ingress_policies_dry_run
iterator = ingress_policies_dry_run
content {
ingress_from {
dynamic "sources" {
for_each = merge(
{ for k, v in lookup(ingress_policies.value["from"]["sources"], "resources", []) : v => "resource" },
{ for k, v in lookup(ingress_policies.value["from"]["sources"], "access_levels", []) : v => "access_level" })
{ for k, v in lookup(ingress_policies_dry_run.value["from"]["sources"], "resources", []) : v => "resource" },
{ for k, v in lookup(ingress_policies_dry_run.value["from"]["sources"], "access_levels", []) : v => "access_level" })
content {
resource = sources.value == "resource" ? sources.key : null
access_level = sources.value == "access_level" ? sources.key != "*" ? "accessPolicies/${var.policy}/accessLevels/${sources.key}" : "*" : null
}
}
identity_type = lookup(ingress_policies.value["from"], "identity_type", null)
identities = lookup(ingress_policies.value["from"], "identities", null)
identity_type = lookup(ingress_policies_dry_run.value["from"], "identity_type", null)
identities = lookup(ingress_policies_dry_run.value["from"], "identities", null)
}

ingress_to {
resources = lookup(ingress_policies.value["to"], "resources", ["*"])
resources = lookup(ingress_policies_dry_run.value["to"], "resources", ["*"])
dynamic "operations" {
for_each = ingress_policies.value["to"]["operations"]
for_each = ingress_policies_dry_run.value["to"]["operations"]
content {
service_name = operations.key
dynamic "method_selectors" {
Expand All @@ -157,15 +168,23 @@ resource "google_access_context_manager_service_perimeter" "regular_service_peri
}
dynamic "egress_policies" {
for_each = var.egress_policies_dry_run
iterator = egress_policies_dry_run
content {
egress_from {
identity_type = lookup(egress_policies.value["from"], "identity_type", null)
identities = lookup(egress_policies.value["from"], "identities", null)
identity_type = lookup(egress_policies_dry_run.value["from"], "identity_type", null)
identities = lookup(egress_policies_dry_run.value["from"], "identities", null)
dynamic "sources" {
for_each = { for k, v in lookup(egress_policies_dry_run.value["from"]["sources"], "access_levels", []) : v => "access_level" }
content {
access_level = sources.value == "access_level" ? sources.key != "*" ? "accessPolicies/${var.policy}/accessLevels/${sources.key}" : "*" : null
}
}
source_restriction = egress_policies_dry_run.value["from"]["sources"] != null ? "SOURCE_RESTRICTION_ENABLED" : null
}
egress_to {
resources = lookup(egress_policies.value["to"], "resources", ["*"])
resources = lookup(egress_policies_dry_run.value["to"], "resources", ["*"])
dynamic "operations" {
for_each = lookup(egress_policies.value["to"], "operations", [])
for_each = lookup(egress_policies_dry_run.value["to"], "operations", [])
content {
service_name = operations.key
dynamic "method_selectors" {
Expand Down
4 changes: 2 additions & 2 deletions modules/regular_service_perimeter/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,12 @@
*/

terraform {
required_version = ">= 0.13"
required_version = ">= 1.3.0"
required_providers {

google = {
source = "hashicorp/google"
version = ">= 3.50, < 6"
version = ">= 4.68, < 6"
}
}

Expand Down