GCP Project Module

This terraform module and code repository is intended to be used to deploy various types of GCP Projects.

The three types of projects deployed using this module are: VPC Host Projects, Service Projects, and GCP Projects (with self-contained, or no, VPCs).

Following the sequential build system that these modules are intended for, a VPC Host project needs to be created so that a Shared VPC (SVPC) can be created. Once the SVPC is created, then a Service Project can be created and attached to the SVPC accordingly. GCP Projects, without reliance on, or an intention of creating a SPVC, can be created at any time.

Required Permissions

The following permissions are required to be given to the service account, or user, being used to deploy this module for the following types of deployment.

Creating a project without an attached SVPC

The following permissions are required at the folder, or the organization level, depending on the parent of the project:

resourcemanager.organizations.get
resourcemanager.projects.create
orgpolicy.constraints.list
orgpolicy.policies.list
orgpolicy.policy.get
resourcemanager.folders.get
resourcemanager.folders.list
resourcemanager.projects.get
resourcemanager.projects.list

Alternatively, these permissions are contained within the predefined roles: Folder Viewer(roles/resourcemanager.folderViewer) and Project Creator(roles/resourcemanager.projectCreator).

Creating a project with an SVPC attachment

In addition to the permissions above, the service account, or user, will need the following permissions on the network, or the project hosting the network, in order to attach the project to the SVPC. These permissions are contained in the predefined role Network User(roles/compute.networkUser).

The permissions for Network User are extensive and can be found here

Creating a Project that will Host an SVPC

The service account, or user, deploying the code will need to have the permissions-equivalent of Project Creator(roles/resourcemanager.projectCreator) and the Network Admin(roles/compute.networkAdmin) predefined roles in order to maintain and manage the host-VPC. In addition to the Project Creator role.

The Network Admin specific permissions are extensive and can be found here.

Example GCP Project Deployment

This repository, like the other modules in the GCP Toolkit set of modules, is intended to be deployed via variable values declared in a .tfvars file in an environment folder. The below example represents a block of code for deploying a non-SVPC attached VPC with Compute, OsLogin, and Container APIs included to be activated when the project is deployed.

projects = {
  iap-project-template-v1 = {
    uses_vpc_host_project    = false
    is_vpc_host_project      = false
    default_srv_accnt_action = "DEPRIVILEGE" # Creates the Default API SVC Account but removes IAM Roles
    create_project_srv_accnt = true
    org_id                   = ""
    folder_id                = ""
    skip_delete              = false
    auto_create_network      = false
    activate_additional_apis = [
      "compute.googleapis.com"
    ]
    labels = {
      managed_by = "terraform"
      env        = "back-to-demo"
    }

    per_project_iam_roles = {
      "roles/compute.instanceAdmin.v1" = {
        members = ["user:ktibbs9413@gmail.com"]
      },
      "roles/compute.admin" = {
        members = ["serviceAccount:terraform-service-account@project_id.iam.gserviceaccount.com"]
      },
      "roles/iap.admin" = {
        members = ["serviceAccount:terraform-service-account@project_id.iam.gserviceaccount.com"]
      },
      "roles/storage.admin" = {
        members = ["serviceAccount:terraform-service-account@project_id.iam.gserviceaccount.com"]
      }
    }
  },
}

service_account = {
  "service_accounts" = {
    project_id = "iap-project-template-v1"
    service_account = {
      "gce-svc-acc" = {
        display_name = "GCE Service Account"
        members      = ["user:user@gmail.com"]
        role         = "roles/iam.serviceAccountUser"
      }
    }
  }
}

custom_vpc = {
  "iap-demo" = {
    project_id              = "iap-project-template-v1"
    auto_create_subnetworks = false
    subnets = {
      "iap-west" = {
        ip_cidr_range = "10.1.0.0/16"
        subnet_region = "us-west4"
      },
      "iap-centrl" = {
        ip_cidr_range = "10.2.0.0/16"
        subnet_region = "us-central1"
      },
    }
  }
}

firewall_rules = {
  "iap-demo-firewall" = {
    project_id = "iap-project-template-v1"
    firewall_rule = {
      "fw-999-allow-iap-tcp-forwarding" = {
        vpc_name = "iap-demo"
        allow = [{
          ports    = ["22"]
          protocol = "tcp"
        }]
        description = "Allows Google's IP to forward SSH traffic over HTTPS"
        direction   = "INGRESS"
        priority    = 999
        ranges      = ["35.235.240.0/20"]
      },
    }
  }
}

gce_instance = {
  "iap-demo" = {
    project_id                = "iap-project-template-v1"
    hostname                  = "iap-demo"
    region                    = "us-west4"
    zone                      = "us-west4-a"
    machine_type              = "e2-micro"
    gce_image                 = "debian-cloud/debian-10"
    gce_service_account_email = "gce-svc-acc@iap-project-template-v1.iam.gserviceaccount.com"
    tags                      = ["demo"]
    labels = {
      env = "demo"
    }
    network_interface = {
      "network" = {
        subnet_name = "iap-west"
      }
    }
  }
}

iap-iam = {
  "iap-tunnel-instance" = {
    instance   = "iap-demo"
    zone       = "us-west4-a"
    project_id = "iap-project-template-v1"
    role       = "roles/iap.tunnelResourceAccessor"
    members    = ["user:user@gmail.com"]
  }
}

Requirements

Name	Version
google-beta	>=4.41.0

Providers

No providers.

Modules

Name	Source	Version
gcp-projects	./modules/gcp-project	n/a
service-projects	./modules/gcp-project	n/a
vpc-host-projects	./modules/gcp-project	n/a

Resources

No resources.

Inputs

Name	Description	Type	Default	Required
environment	n/a	any	n/a	yes
iam_roles	n/a	map(object({ role = string members = list(string) }))	{}	no
project_id	terraform project.	any	n/a	yes
projects	List of project objects.	map(object({ uses_vpc_host_project = bool host_project_name = string is_vpc_host_project = bool default_srv_accnt_action = string create_project_srv_accnt = bool #either org_id or folder_id org_id = string folder_id = string billing_account = string skip_delete = bool auto_create_network = bool activate_apis = list(string) labels = map(string) }))	{}	no
service_projects	List of service project objects. these must be created after vpc host projects	map(any)	{}	no
vpc_host_projects	List of vpc host project objects. these must be created first	map(any)	{}	no

Outputs

Name	Description
gcp-projects_outputs	n/a
service-projects_outputs	n/a
vpc-host-projects_outputs	n/a