terraform-google-iam

The mode variable determines how the module interacts with existing IAM policies on the target resource:

additive (Default)

• Behavior: Adds the specified members to the existing roles. It does not delete existing members from those roles.
• Control: The module fully controls the members listed in the module. If you remove a member from the bindings map in your Terraform code, the module will remove that member from the role in GCP.

authoritative

• Behavior: Sets the role's members to exactly what is defined in the module. Any members currently in that role who are not listed in the module will be removed.
• Scope: Only the roles explicitly listed in the bindings map are affected. Unlisted roles on the resource remain untouched.
• Warning: Use this mode with caution as it can strip access from users or service accounts not managed by this module.

module "storage_buckets_iam_bindings" {
  source  = "terraform-google-modules/iam/google//modules/storage_buckets_iam"
  version = "~> 8.0"

  storage_buckets = ["my-storage-bucket"]
  mode            = "authoritative"

  bindings = {
    "roles/storage.legacyBucketReader" = [
      "user:josemanuelt@google.com",
    ]
  }
}

Use this module to manage IAM policy bindings for one or more Artifact Registry repositories. You can specify multiple repositories and assign roles to various member types (service accounts, groups, or users) using either additive or authoritative modes.

Modes:

• additive (default): Adds the specified bindings to the existing IAM policy without removing existing permissions.
• authoritative: Replaces the existing IAM policy for the repositories with the bindings provided in this module.

module "artifact-registry-repository-iam-bindings" {
  source  = "terraform-google-modules/iam/google//modules/artifact_registry_iam"
  version = "~> 8.2"

  project      = "my-project"
  repositories = ["my-project_one", "my-project_two"]
  location     = "us-central1"
  mode         = "additive"

  bindings = {
    "roles/artifactregistry.writer" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
  }
}

The audit_config module is an optional component used to configure Google Cloud audit log configurations at the project level. You provide a list of configurations specifying the service, the type of log to capture, and any members that should be exempted from logging.

module "audit_log_config" {
  source  = "terraform-google-modules/iam/google//modules/audit_config"
  version = "~> 8.2"

  project          = "my-project"
  audit_log_config = [
    {
      service          = "pubsub.googleapis.com"
      log_type         = "DATA_READ"
      exempted_members = [
            "group:my-group@my-org.com",
            "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
            "user:my-user@my-org.com"
          ]
    },
    {
      service          = "storage.googleapis.com"
      log_type         = "DATA_WRITE"
      exempted_members = [
            "group:my-group@my-org.com",
            "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
            "user:my-user@my-org.com"
          ]
    }
  ]
}

Use the folders_iam module to assign IAM roles to specific Google Cloud folders. You can specify multiple folders, define standard role-to-member bindings, and apply conditional bindings (IAM Conditions) for time-based or attribute-based access control.

To use this module, provide a list of folders, a mode (either additive or authoritative), and a bindings map. You can also use conditional_bindings to add roles that are only active under specific conditions, such as an expiration timestamp.

module "folder-iam" {
  source  = "terraform-google-modules/iam/google//modules/folders_iam"
  version = "~> 8.2"

  folders = ["my-folder-name"]

  mode = "additive"

  bindings = {
    "roles/resourcemanager.folderEditor" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
    ]

    "roles/resourcemanager.folderViewer" = [
      "user:my-user@my-org.com",
    ]
  }

  conditional_bindings = [
    {
      role = "roles/editor"
      title = "expires_after_2019_12_31"
      description = "Expiring at midnight of 2019-12-31"
      expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")"
      members = ["user:my-user@my-org.com"]
    }
  ]
}

Use the secure_source_manager_instance_iam submodule to manage IAM roles for Secure Source Manager (SSM) instances. You can specify roles and members (users, service accounts, or groups) and choose between additive or authoritative modes.

Modes:

• additive: Adds the specified bindings to the existing IAM policy without removing existing ones.
• authoritative: Sets the IAM policy to exactly match the provided bindings, potentially removing existing access.

Note on Entity IDs: The module uses an entity_ids object to target specific resources. You can provide a list of instance_ids, repository_ids, or both.

module "ssm_instance_iam_binding" {
  source    = "terraform-google-modules/iam/google//modules/secure_source_manager_instance_iam"
  version   = "~> 8.0"

  project   = var.project_id
  location  = "us-central1"

  entity_ids = {
    instance_ids = [google_secure_source_manager_instance.default.instance_id]
  }
  mode = "additive"

  bindings = {
    "roles/securesourcemanager.instanceAccessor" = [
      "serviceAccount:${var.sa_email}",
      "group:${var.group_email}",
      "user:${var.user_email}",
    ]
    "roles/securesourcemanager.instanceManager" = [
      "serviceAccount:${var.sa_email}",
      "group:${var.group_email}",
      "user:${var.user_email}",
    ]
  }
}

The subnets_iam module is an optional component used to assign IAM roles to specific Google Cloud subnets. It supports both standard IAM bindings and conditional IAM bindings, allowing you to restrict access based on attributes like request time.

module "subnet-iam-bindings" {
  source = "terraform-google-modules/iam/google//modules/subnets_iam"
  version = "~> 8.2"

  subnets        = ["my-subnet_one", "my-subnet_two"]
  subnets_region = "my-region"
  project        = "my-project"
  mode           = "authoritative"
  bindings = {
    "roles/compute.networkUser" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
    "roles/compute.networkViewer" = [
      "serviceAccount:my-sa@my-project.iam.gserviceaccount.com",
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
  }
  conditional_bindings = [
    {
      role = "roles/compute.networkAdmin"
      title = "expires_after_2019_12_31"
      description = "Expiring at midnight of 2019-12-31"
      expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")"
      members = ["user:my-user@my-org.com"]
    }
  ]
}