main.tf 6.75 KB
Newer Older
Adam Robinson's avatar
Adam Robinson committed
1
locals {
Adam Robinson's avatar
Adam Robinson committed
2
    short_mcomm = lower(replace(split("@", var.mcomm_group_email)[0],".","-"))
3
4
5
6

    customer_service_account_suffix = "-${var.division}-tf"
    customer_service_account_prefix = substr(local.short_mcomm,0,30-length(local.customer_service_account_suffix))
    customer_service_account_id = "${local.customer_service_account_prefix}${local.customer_service_account_suffix}"
Adam Robinson's avatar
Adam Robinson committed
7
8
9
10
11
    division_folder_ids = {
        dev = {
            //its = ""
        }
        test = {
12
13
14
15
            its    = "folders/100600555387"
            campus = "folders/549439339393"
            mm     = "folders/783942636538"
            hipaa  = "folders/607376512236"
Adam Robinson's avatar
Adam Robinson committed
16
17
        }
        prod = {
18
19
20
21
            its    = "folders/666809107084"
            campus = "folders/1013928641872"            
            mm     = "folders/332243639992"
            hipaa  = "folders/293380204207"
Adam Robinson's avatar
Adam Robinson committed
22
23
24
25
        }
    }
    master_billing_account_id = {
        //dev  = ""
Adam Robinson's avatar
Adam Robinson committed
26
27
        test = "01D8BC-7D5855-0BC393"
        prod = "01D8BC-7D5855-0BC393"
Adam Robinson's avatar
Adam Robinson committed
28
29
30
    }
    database_function_url = {
        //dev = ""
Kenny Moore's avatar
Kenny Moore committed
31
        test = "https://us-central1-gcp-at-um-db.cloudfunctions.net/customer_db" # Need a test DB
Adam Robinson's avatar
Adam Robinson committed
32
        prod = "https://us-central1-gcp-at-um-db.cloudfunctions.net/customer_db"
Adam Robinson's avatar
Adam Robinson committed
33
34
35
36
37
38
39
40
41
    }
    curl_body = {
        kind              = "billing"
        billingAccountId  = google_billing_subaccount.customer_subaccount.billing_account_id
        billing_contact   = var.billing_contact
        mcomm_group_email = var.mcomm_group_email
        shortcode         = var.shortcode
    }
    
Kenny Moore's avatar
Kenny Moore committed
42
43
44
45
46
47
}

module "audit" {
    count                   = var.division == "hipaa" ? 1: 0
    source                  = "./modules/terraform-google-gcp-at-um-customer-audit/"
    division                = var.division
48
    billing_id              = google_billing_subaccount.customer_subaccount.billing_account_id
Kenny Moore's avatar
Kenny Moore committed
49
50
51
52
    folder_id               = google_folder.customer_folder.id
    mcomm_group_email       = var.mcomm_group_email
    database_function_url   = local.database_function_url[var.environment]
    shortcode               = var.shortcode
Kenny Moore's avatar
Kenny Moore committed
53
54
    environment             = var.environment
    audit_logs_access       = var.audit_logs_access     
Adam Robinson's avatar
Adam Robinson committed
55
56
}

Adam Robinson's avatar
Adam Robinson committed
57
resource "google_folder" "customer_folder" {
58
    display_name = var.folder_display_name == "" ? local.short_mcomm : var.folder_display_name
Adam Robinson's avatar
Adam Robinson committed
59
    parent = local.division_folder_ids[var.environment][var.division]
Adam Robinson's avatar
Adam Robinson committed
60
61
62
63
64
65
66
67
68
69
70
}

data "google_iam_policy" "customer_folder_policy" {
    binding {
        role = "roles/browser"
        members = [
            "group:${var.mcomm_group_email}",
        ]
    }

    binding {
71
        role = "organizations/715302536254/roles/GCP_at_UM_Customer_Folder_Viewer"
Adam Robinson's avatar
Adam Robinson committed
72
73
74
75
76
        members = [
            "group:${var.mcomm_group_email}",
        ]
    }

77
78
    dynamic "binding" {
        for_each = var.customer_is_shared_vpc_admin ? ["roles/compute.xpnAdmin"] : []
Kenny Moore's avatar
Kenny Moore committed
79
        content {
80
            role = binding.value
Kenny Moore's avatar
Kenny Moore committed
81
82
83
84
            members = [
                "group:${var.mcomm_group_email}",
            ]
        }
85
86
    }

Adam Robinson's avatar
Adam Robinson committed
87
88
89
    binding {
        role = "roles/resourcemanager.projectCreator"
        members = [
Adam Robinson's avatar
Adam Robinson committed
90
91
92
93
            "serviceAccount:${google_service_account.customer_service_account.email}",
        ]
    }

94
    binding {
Adam Robinson's avatar
Adam Robinson committed
95
96
97
        role = "roles/resourcemanager.folderEditor"
        members = [
            "serviceAccount:${var.provisioning_service_account_email}",
Adam Robinson's avatar
Adam Robinson committed
98
99
100
101
102
        ]
    }
}

resource "google_folder_iam_policy" "customer_folder_policy" {
Adam Robinson's avatar
Adam Robinson committed
103
  folder      = google_folder.customer_folder.name
Adam Robinson's avatar
Adam Robinson committed
104
105
106
107
108
109
110
111
112
113
114
115
116
  policy_data = data.google_iam_policy.customer_folder_policy.policy_data
}

resource "random_id" "customer_bucket_id" {
    byte_length = 2
}

resource "google_storage_bucket" "customer_bucket" {
    project = var.customer_bucket_project_id
    name = "gcp-at-um-${local.short_mcomm}-${random_id.customer_bucket_id.hex}"
    location = "US"
    storage_class = "STANDARD"

Kenny Moore's avatar
Kenny Moore committed
117
    uniform_bucket_level_access = true
Adam Robinson's avatar
Adam Robinson committed
118
119
120
121
122
123
124

    versioning {
        enabled = true
    }
}

resource "google_service_account" "customer_service_account" {
125
126
    project     = var.customer_service_account_project_id
    account_id  = local.customer_service_account_id
Adam Robinson's avatar
Adam Robinson committed
127
128
129
    description = "${local.short_mcomm} Terraform Service Account"
}

Adam Robinson's avatar
Adam Robinson committed
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
data "google_iam_policy" "customer_service_account_policy" {
  binding {
    role = "roles/iam.serviceAccountKeyAdmin"

    members = [
        "group:${var.mcomm_group_email}",
    ]
  }
}

resource "google_service_account_iam_policy" "customer_service_account_policy" {
  service_account_id = google_service_account.customer_service_account.name
  policy_data        = data.google_iam_policy.customer_service_account_policy.policy_data
}

Adam Robinson's avatar
Adam Robinson committed
145
146
147
148
data "google_iam_policy" "customer_bucket_policy" {
    binding {
        role = "roles/storage.legacyBucketWriter"
        members = [
Adam Robinson's avatar
Adam Robinson committed
149
            "serviceAccount:${google_service_account.customer_service_account.email}",
Adam Robinson's avatar
Adam Robinson committed
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
        ]
    }

    binding {
        role = "roles/storage.objectViewer"
        members = [
            "group:${var.mcomm_group_email}",
        ]
    }
}

resource "google_storage_bucket_iam_policy" "customer_bucket_policy" {
    bucket = google_storage_bucket.customer_bucket.name
    policy_data = data.google_iam_policy.customer_bucket_policy.policy_data
}

166
data "google_service_account_id_token" "customer_db_token" {
Adam Robinson's avatar
Adam Robinson committed
167
    target_audience = local.database_function_url[var.environment]
168
169
170
171
}

resource "null_resource" "customer_database" {
    triggers = {
Adam Robinson's avatar
Adam Robinson committed
172
173
        billingAccountId  = google_billing_subaccount.customer_subaccount.billing_account_id
        billing_contact   = var.billing_contact
174
        mcomm_group_email = var.mcomm_group_email
Adam Robinson's avatar
Adam Robinson committed
175
        shortcode         = var.shortcode
176
    }
Adam Robinson's avatar
Adam Robinson committed
177

178
    provisioner "local-exec" {
Adam Robinson's avatar
Adam Robinson committed
179
        command = "curl ${local.database_function_url[var.environment]} -H \"Authorization: Bearer ${data.google_service_account_id_token.customer_db_token.id_token}\" -H \"Content-Type: application/json\" -d '${jsonencode(local.curl_body)}'"
180
181
182
183
    }
}

// Need to make a customer Git repo
Adam Robinson's avatar
Adam Robinson committed
184

185
resource "google_billing_subaccount" "customer_subaccount" {
Adam Robinson's avatar
Adam Robinson committed
186
    display_name           = local.short_mcomm
187
188
189
190
191
192
193
194
195
196
197
198
199
200
    master_billing_account = local.master_billing_account_id[var.environment]
    deletion_policy        = "RENAME_ON_DESTROY"
}

resource "google_billing_account_iam_policy" "customer_billing_account_policy" {
    billing_account_id = google_billing_subaccount.customer_subaccount.billing_account_id
    policy_data        = data.google_iam_policy.customer_billing_account_policy.policy_data
}

data "google_iam_policy" "customer_billing_account_policy" {
    binding {
        role = "roles/billing.user"

        members = [
201
            "serviceAccount:${google_service_account.customer_service_account.email}",
202
203
204
205
206
207
208
209
210
211
212
        ]
    }

    binding {
        role = "organizations/715302536254/roles/UM_billingUser"

        members = [
            "group:${var.mcomm_group_email}",
        ]
    }
}