main.tf 2.87 KB
Newer Older
1
2
# Still need:
# billing
Kenny Moore's avatar
Kenny Moore committed
3
# ip_space - get from bluecat provider (terraform)
4
5
# VPN (BGP)
# write to DB
6
# ADD PROJECT IAM (EDITOR)
Kenny Moore's avatar
Kenny Moore committed
7

Kenny Moore's avatar
Kenny Moore committed
8
9
10
11
12
13
14
15
resource "random_id" "id" {
    byte_length = 2
}

locals{
    project_name_string = substr(lower(replace(var.project_name, "/\\s/", "-")), 0, 25) 
}

16
resource "google_project" "gcp_project" {    
Kenny Moore's avatar
Kenny Moore committed
17
18
19
20
    name = "${var.project_name}"        
    project_id = var.project_id == "" ? "${local.project_name_string}-${random_id.id.hex}" : var.project_id
    folder_id = local.folder[var.division]    
    billing_account = var.billing_id
Kenny Moore's avatar
Kenny Moore committed
21
    auto_create_network = false
22
    labels = {
Kenny Moore's avatar
Kenny Moore committed
23
        "shortcode" = var.shortcode 
24
25
26
    } 
}

27
28
29
30
31
32
33
resource "google_project_iam_member" "project_iam" {
    project = "${google_project.gcp_project.project_id}"
    role    = "roles/editor"
    member  = "group:${var.project_mcomm}"
}           


34
locals{        
Kenny Moore's avatar
Kenny Moore committed
35
36
    # filter_string = "resource.type=\"project\"\nresource.labels.project_id=\"${google_project.gcp_project.project_id}\" \nlogName=\"projects/${google_project.gcp_project.project_id}/logs/cloudaudit.googleapis.com%2Factivity\"" 
    filter_string = "logName=\"projects/${google_project.gcp_project.project_id}/logs/cloudaudit.googleapis.com%2Factivity\"" 
Kenny Moore's avatar
Kenny Moore committed
37
38
39
40
41
42
}

resource "google_logging_project_sink" "log_export" {
    project = "${google_project.gcp_project.project_id}"
    name = "${google_project.gcp_project.project_id}-log-export"
    destination = "${var.log_export_destination}"
43
    # filter = "projects/${google_project.gcp_project.project_id}/logs/cloudaudit.googleapis.com%2Factivity" # Need this
Kenny Moore's avatar
Kenny Moore committed
44
    filter = local.filter_string
Kenny Moore's avatar
Kenny Moore committed
45
    unique_writer_identity = true    
Kenny Moore's avatar
Kenny Moore committed
46
47
}

Kenny Moore's avatar
Kenny Moore committed
48
# Give unique writer permission to publish/write to pub/sub topic
49
50
resource google_pubsub_topic_iam_member "publisher" {
    project = "vci-mcloud-service" # should make this a var    
Kenny Moore's avatar
Kenny Moore committed
51
    topic = "${var.log_export_destination}"    
52
53
54
55
    role = "roles/pubsub.publisher"
    member = google_logging_project_sink.log_export.writer_identity      
}

Kenny Moore's avatar
Kenny Moore committed
56
57
58
59
resource "google_project_service" "compute-api" {
  project = "${google_project.gcp_project.project_id}"
  service = "compute.googleapis.com"
  # disable_dependent_services = true
Kenny Moore's avatar
Kenny Moore committed
60
}
Kenny Moore's avatar
Kenny Moore committed
61
62
63
64
locals {
    default_cidr = "10.255.0.0/16"
    default_regions = ["us-central1", "us-east1", "us-east4", "us-west1"]
    default_subnets = {for x in local.default_regions : x => cidrsubnet(local.default_cidr,4,index(local.default_regions, x))}
Kenny Moore's avatar
Kenny Moore committed
65
66
}

Kenny Moore's avatar
Kenny Moore committed
67
resource "google_compute_network" "default_vpc" {
68
    project = "${google_project.gcp_project.project_id}"
Kenny Moore's avatar
Kenny Moore committed
69
    name = "${var.prefix}-default-vpc"
Kenny Moore's avatar
Kenny Moore committed
70
    routing_mode = "GLOBAL"
71
72
73
    auto_create_subnetworks = false    
}

Kenny Moore's avatar
Kenny Moore committed
74
75
resource "google_compute_subnetwork" "default_subnet" {
    for_each = local.default_subnets
76
    project = "${google_project.gcp_project.project_id}"
Kenny Moore's avatar
Kenny Moore committed
77
    name = "default-${each.key}"
Kenny Moore's avatar
Kenny Moore committed
78
79
    region = each.key
    ip_cidr_range = each.value
Kenny Moore's avatar
Kenny Moore committed
80
81
    network = google_compute_network.default_vpc.self_link
}