Skip to content

Commit 1ba6a68

Browse files
PengyuanZhaoPengyuanZhao
authored
fix: use correct roles when folders_to_include is set (#104)
1 parent 3ff9cae commit 1ba6a68

File tree

2 files changed

+94
-116
lines changed

2 files changed

+94
-116
lines changed

‎README.md‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -82,21 +82,23 @@ policyanalyzer.googleapis.com
8282

8383
| Name | Type |
8484
|------|------|
85-
| [google_folder_iam_member.for_lacework_service_account](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/folder_iam_member) | resource |
86-
| [google_organization_iam_custom_role.lacework_custom_organization_role](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_custom_role) | resource |
87-
| [google_organization_iam_member.for_lacework_service_account](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_member) | resource |
88-
| [google_organization_iam_member.lacework_custom_organization_role_binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_member) | resource |
89-
| [google_project_iam_custom_role.lacework_custom_project_role](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_custom_role) | resource |
90-
| [google_project_iam_member.for_lacework_service_account](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource |
91-
| [google_project_iam_member.for_lacework_service_account_root_projects](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource |
92-
| [google_project_iam_member.lacework_custom_project_role_binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource |
85+
| [google_folder_iam_member.lacework_folder_custom_role_binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/folder_iam_member) | resource |
86+
| [google_folder_iam_member.lacework_folder_roles_binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/folder_iam_member) | resource |
87+
| [google_organization_iam_custom_role.lacework_organization_custom_role](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_custom_role) | resource |
88+
| [google_organization_iam_member.lacework_organization_custom_role_binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_member) | resource |
89+
| [google_organization_iam_member.lacework_organization_roles_binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_member) | resource |
90+
| [google_project_iam_custom_role.lacework_project_custom_role](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_custom_role) | resource |
91+
| [google_project_iam_member.lacework_project_custom_role_binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource |
92+
| [google_project_iam_member.lacework_project_roles_binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource |
93+
| [google_project_iam_member.lacework_root_project_custom_role_binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource |
94+
| [google_project_iam_member.lacework_root_project_roles_binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource |
9395
| [google_project_service.required_apis](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_service) | resource |
9496
| [lacework_integration_gcp_cfg.default](https://registry.terraform.io/providers/lacework/lacework/latest/docs/resources/integration_gcp_cfg) | resource |
9597
| [random_id.uniq](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
9698
| [time_sleep.wait_time](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
97-
| [google_folders.my-org-folders](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/folders) | data source |
99+
| [google_folders.org_folders](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/folders) | data source |
98100
| [google_project.selected](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |
99-
| [google_projects.my-org-projects](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/projects) | data source |
101+
| [google_projects.org_projects](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/projects) | data source |
100102
| [lacework_metric_module.lwmetrics](https://registry.terraform.io/providers/lacework/lacework/latest/docs/data-sources/metric_module) | data source |
101103

102104
## Inputs

‎main.tf‎

Lines changed: 82 additions & 106 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,8 @@
11
locals {
2-
resource_level = var.org_integration ? "ORGANIZATION" : "PROJECT"
3-
resource_id = var.org_integration ? var.organization_id : module.lacework_cfg_svc_account.project_id
4-
project_id = length(var.project_id) > 0 ? var.project_id : data.google_project.selected[0].project_id
2+
project_id = length(var.project_id) > 0 ? var.project_id : data.google_project.selected[0].project_id
53

6-
exclude_folders = length(var.folders_to_exclude) != 0
7-
explicit_folders = length(var.folders_to_include) != 0
4+
exclude_folders = length(var.folders_to_exclude) != 0
5+
include_folders = length(var.folders_to_include) != 0
86

97
service_account_name = var.use_existing_service_account ? (
108
var.service_account_name
@@ -20,75 +18,33 @@ locals {
2018

2119
skip_iam_grants = var.use_existing_service_account && var.skip_iam_grants
2220

23-
default_project_roles = local.skip_iam_grants ? [] : [
21+
default_roles = [
2422
"roles/browser",
2523
"roles/iam.securityReviewer",
2624
"roles/cloudasset.viewer",
2725
"roles/policyanalyzer.activityAnalysisViewer"
2826
]
2927

30-
default_organization_roles = local.skip_iam_grants ? [] : [
31-
"roles/browser",
32-
"roles/iam.securityReviewer",
33-
"roles/cloudasset.viewer",
34-
"roles/policyanalyzer.activityAnalysisViewer"
28+
custom_role_permissions = [
29+
"bigquery.datasets.get",
30+
"compute.projects.get",
31+
"pubsub.topics.get",
32+
"storage.buckets.get",
33+
"compute.sslPolicies.get"
3534
]
3635

37-
// if org_integration is false, project_roles = local.default_project_roles
38-
project_roles = var.org_integration ? [] : local.default_project_roles
39-
40-
// if org_integration is true, organization_roles = local.default_organization_roles
41-
organization_roles = local.skip_iam_grants ? [] : (
42-
(var.org_integration && !(local.exclude_folders || local.explicit_folders)) ? (
43-
local.default_organization_roles
44-
) : (
45-
(var.org_integration && (local.exclude_folders || local.explicit_folders)) ? (
46-
["roles/resourcemanager.organizationViewer"]
47-
) : (
48-
[]
49-
)
50-
)
51-
)
52-
53-
default_folder_roles = local.skip_iam_grants ? [] : (
54-
(var.org_integration && (local.exclude_folders || local.explicit_folders)) ? (
55-
[
56-
"roles/browser",
57-
"roles/iam.securityReviewer",
58-
"roles/cloudasset.viewer",
59-
"roles/policyanalyzer.activityAnalysisViewer",
60-
google_organization_iam_custom_role.lacework_custom_organization_role.0.name
61-
]
62-
) : (
63-
[]
64-
)
65-
)
36+
folders = var.org_integration ? (
37+
local.exclude_folders ? setsubtract(data.google_folders.org_folders[0].folders[*].name, var.folders_to_exclude) :
38+
local.include_folders ? var.folders_to_include : []
39+
) : []
6640

67-
folders = [
68-
(var.org_integration && local.exclude_folders) ? (
69-
setsubtract(data.google_folders.my-org-folders[0].folders[*].name, var.folders_to_exclude)
70-
) : (
71-
var.org_integration && local.explicit_folders) ? (
72-
var.folders_to_include
73-
) : (
74-
toset([])
75-
)]
76-
77-
root_projects = [
78-
(var.org_integration && local.exclude_folders && var.include_root_projects) ? toset(data.google_projects.my-org-projects[0].projects[*].project_id) : toset([])
79-
]
41+
root_projects = (var.org_integration && local.exclude_folders && var.include_root_projects) ? (
42+
data.google_projects.org_projects[0].projects[*].project_id
43+
) : []
8044

81-
folder_roles = (var.org_integration && (local.exclude_folders || local.explicit_folders)) ? (
82-
setproduct(local.folders[0][*], local.default_folder_roles)
83-
) : (
84-
[]
85-
)
45+
folder_roles_product = tolist(setproduct(local.folders, local.default_roles))
8646

87-
root_project_roles = (var.org_integration && var.include_root_projects) ? (
88-
setproduct(local.root_projects[0][*], local.default_folder_roles)
89-
) : (
90-
[]
91-
)
47+
root_project_roles_product = tolist(setproduct(local.root_projects, local.default_roles))
9248

9349
version_file = "${abspath(path.module)}/VERSION"
9450
module_name = "terraform-gcp-config"
@@ -111,79 +67,93 @@ module "lacework_cfg_svc_account" {
11167
project_id = local.project_id
11268
}
11369

114-
// Roles for a PROJECT level integration
115-
resource "google_project_iam_custom_role" "lacework_custom_project_role" {
70+
resource "google_project_iam_custom_role" "lacework_project_custom_role" {
71+
count = (!local.skip_iam_grants && !var.org_integration) ? 1 : 0
11672
project = local.project_id
11773
role_id = "lwComplianceRole_${random_id.uniq.hex}"
11874
title = "Lacework Compliance Role"
11975
description = "Lacework Compliance Role"
120-
permissions = ["bigquery.datasets.get", "compute.projects.get", "pubsub.topics.get", "storage.buckets.get", "compute.sslPolicies.get"]
121-
count = local.skip_iam_grants ? 0 : (local.resource_level == "PROJECT" ? 1 : 0)
76+
permissions = local.custom_role_permissions
12277
}
12378

124-
125-
resource "google_project_iam_member" "lacework_custom_project_role_binding" {
79+
resource "google_project_iam_member" "lacework_project_custom_role_binding" {
80+
count = (!local.skip_iam_grants && !var.org_integration) ? 1 : 0
12681
project = local.project_id
127-
role = google_project_iam_custom_role.lacework_custom_project_role.0.name
82+
role = google_project_iam_custom_role.lacework_project_custom_role.0.name
12883
member = "serviceAccount:${local.service_account_json_key.client_email}"
129-
depends_on = [google_project_iam_custom_role.lacework_custom_project_role]
130-
count = local.resource_level == "PROJECT" ? 1 : 0
84+
depends_on = [google_project_iam_custom_role.lacework_project_custom_role]
13185
}
13286

133-
resource "google_project_iam_member" "for_lacework_service_account" {
134-
for_each = toset(local.project_roles)
135-
project = local.project_id
136-
role = each.value
137-
member = "serviceAccount:${local.service_account_json_key.client_email}"
87+
resource "google_project_iam_member" "lacework_project_roles_binding" {
88+
for_each = toset((!local.skip_iam_grants && !var.org_integration) ? local.default_roles : [])
89+
project = local.project_id
90+
role = each.value
91+
member = "serviceAccount:${local.service_account_json_key.client_email}"
92+
depends_on = [google_project_iam_custom_role.lacework_project_custom_role]
13893
}
13994

140-
// Roles for an ORGANIZATION level integration
141-
142-
data "google_folders" "my-org-folders" {
95+
data "google_folders" "org_folders" {
14396
count = (var.org_integration && local.exclude_folders) ? 1 : 0
14497
parent_id = "organizations/${var.organization_id}"
14598
}
14699

147-
data "google_projects" "my-org-projects" {
100+
data "google_projects" "org_projects" {
148101
count = (local.exclude_folders && var.include_root_projects) ? 1 : 0
149102
filter = "parent.id=${var.organization_id}"
150103
}
151104

152-
resource "google_organization_iam_custom_role" "lacework_custom_organization_role" {
105+
resource "google_organization_iam_custom_role" "lacework_organization_custom_role" {
106+
count = (!local.skip_iam_grants && var.org_integration) ? 1 : 0
153107
role_id = "lwOrgComplianceRole_${random_id.uniq.hex}"
154108
org_id = var.organization_id
155109
title = "Lacework Org Compliance Role"
156110
description = "Lacework Org Compliance Role"
157-
permissions = ["bigquery.datasets.get", "compute.projects.get", "pubsub.topics.get", "storage.buckets.get", "compute.sslPolicies.get"]
158-
count = local.skip_iam_grants ? 0 : (local.resource_level == "ORGANIZATION" ? 1 : 0)
111+
permissions = local.custom_role_permissions
159112
}
160113

161-
resource "google_organization_iam_member" "lacework_custom_organization_role_binding" {
114+
resource "google_organization_iam_member" "lacework_organization_custom_role_binding" {
115+
count = (!local.skip_iam_grants && var.org_integration) ? 1 : 0
162116
org_id = var.organization_id
163-
role = google_organization_iam_custom_role.lacework_custom_organization_role.0.name
117+
role = google_organization_iam_custom_role.lacework_organization_custom_role.0.name
164118
member = "serviceAccount:${local.service_account_json_key.client_email}"
165-
depends_on = [google_organization_iam_custom_role.lacework_custom_organization_role]
166-
count = local.skip_iam_grants ? 0 : (local.resource_level == "ORGANIZATION" ? 1 : 0)
119+
depends_on = [google_organization_iam_custom_role.lacework_organization_custom_role]
167120
}
168121

169-
resource "google_organization_iam_member" "for_lacework_service_account" {
170-
for_each = toset(local.organization_roles)
171-
org_id = var.organization_id
172-
role = each.value
173-
member = "serviceAccount:${local.service_account_json_key.client_email}"
122+
resource "google_organization_iam_member" "lacework_organization_roles_binding" {
123+
for_each = toset((!local.skip_iam_grants && var.org_integration) ? local.default_roles : [])
124+
org_id = var.organization_id
125+
role = each.value
126+
member = "serviceAccount:${local.service_account_json_key.client_email}"
127+
depends_on = [google_organization_iam_custom_role.lacework_organization_custom_role]
128+
}
129+
130+
resource "google_folder_iam_member" "lacework_folder_custom_role_binding" {
131+
for_each = toset(!local.skip_iam_grants ? local.folders : [])
132+
folder = each.value
133+
role = google_organization_iam_custom_role.lacework_organization_custom_role.0.name
134+
member = "serviceAccount:${local.service_account_json_key.client_email}"
135+
depends_on = [google_organization_iam_custom_role.lacework_organization_custom_role]
136+
}
137+
138+
resource "google_folder_iam_member" "lacework_folder_roles_binding" {
139+
count = !local.skip_iam_grants ? length(local.folder_roles_product) : 0
140+
folder = local.folder_roles_product[count.index][0]
141+
role = local.folder_roles_product[count.index][1]
142+
member = "serviceAccount:${local.service_account_json_key.client_email}"
143+
depends_on = [google_organization_iam_custom_role.lacework_organization_custom_role]
174144
}
175145

176-
resource "google_folder_iam_member" "for_lacework_service_account" {
177-
count = length(local.folder_roles)
178-
folder = local.folder_roles[count.index][0]
179-
role = local.folder_roles[count.index][1]
180-
member = "serviceAccount:${local.service_account_json_key.client_email}"
146+
resource "google_project_iam_member" "lacework_root_project_custom_role_binding" {
147+
for_each = toset(!local.skip_iam_grants ? local.root_projects : [])
148+
project = each.value
149+
role = google_organization_iam_custom_role.lacework_organization_custom_role.0.name
150+
member = "serviceAccount:${local.service_account_json_key.client_email}"
181151
}
182152

183-
resource "google_project_iam_member" "for_lacework_service_account_root_projects" {
184-
count = length(local.root_project_roles)
185-
project = local.root_project_roles[count.index][0]
186-
role = local.root_project_roles[count.index][1]
153+
resource "google_project_iam_member" "lacework_root_project_roles_binding" {
154+
count = !local.skip_iam_grants ? length(local.root_project_roles_product) : 0
155+
project = local.root_project_roles_product[count.index][0]
156+
role = local.root_project_roles_product[count.index][1]
187157
member = "serviceAccount:${local.service_account_json_key.client_email}"
188158
}
189159

@@ -202,15 +172,21 @@ resource "time_sleep" "wait_time" {
202172
depends_on = [
203173
module.lacework_cfg_svc_account,
204174
google_project_service.required_apis,
205-
google_organization_iam_member.for_lacework_service_account,
206-
google_project_iam_member.for_lacework_service_account
175+
google_organization_iam_member.lacework_organization_custom_role_binding,
176+
google_organization_iam_member.lacework_organization_roles_binding,
177+
google_project_iam_member.lacework_project_custom_role_binding,
178+
google_project_iam_member.lacework_project_roles_binding,
179+
google_folder_iam_member.lacework_folder_custom_role_binding,
180+
google_folder_iam_member.lacework_folder_roles_binding,
181+
google_project_iam_member.lacework_root_project_custom_role_binding,
182+
google_project_iam_member.lacework_root_project_roles_binding
207183
]
208184
}
209185

210186
resource "lacework_integration_gcp_cfg" "default" {
211187
name = var.lacework_integration_name
212-
resource_id = local.resource_id
213-
resource_level = local.resource_level
188+
resource_id = var.org_integration ? var.organization_id : module.lacework_cfg_svc_account.project_id
189+
resource_level = var.org_integration ? "ORGANIZATION" : "PROJECT"
214190
credentials {
215191
client_id = local.service_account_json_key.client_id
216192
private_key_id = local.service_account_json_key.private_key_id

0 commit comments

Comments
 (0)