terraform-google-kms

A Terraform module for managing Cloud KMS keyrings, zero or more keys in keyrings, and IAM role bindings on individual keys. Google Cloud Platform (GCP).

This module supports Terraform version 1 and is compatible with the Terraform Google Provider version 4.

This module is part of our Infrastructure as Code (IaC) framework that enables our users and customers to easily deploy and manage reusable, secure, and production-grade cloud infrastructure.

• Module Features
• Getting Started
• Module Argument Reference
  • Top-level Arguments
    • Module Configuration
    • Main Resource Configuration
• Module Outputs
• External Documentation
  • Google Documentation
  • Terraform Google Provider Documentation:
• Module Versioning
  • Backwards compatibility in 0.0.z and 0.y.z version
• About Mineiros
• Reporting Issues
• Contributing
• Makefile Targets
• License

Module Features

This module implements the following terraform resources:

• google_kms_key_ring
• google_kms_crypto_key
• google_kms_crypto_key_iam_member

Getting Started

Most basic usage just setting required arguments:

module "terraform-google-kms" {
  source = "github.com/mineiros-io/terraform-google-kms?ref=v0.0.1"

  keyring  = "keyring-example"
  location = "global"
  project  = "my-project-id"
}

Module Argument Reference

See variables.tf and examples/ for details and use-cases.

Top-level Arguments

Module Configuration

• module_enabled: (Optional bool)

  Specifies whether resources in the module will be created.

  Default is true.

• module_depends_on: (Optional list(dependency))

  A list of dependencies. Any object can be assigned to this list to define a hidden external dependency.

  Example:

  module_depends_on = [
    google_network.network
  ]

Main Resource Configuration

• project: (Required string)

  The ID of the project in which the resources belong.

• location: (Required string)

  The location for the keyring. A full list of valid locations can be found by running gcloud kms locations list or in the docs: https://cloud.google.com/kms/docs/locations.

• keyring: (Required string)

  The resource name for the keyring.

• keys: (Optional list(key))

  A list of key objects describing how keys and IAM bindings are going to be created.

  Default is [].

  Example:

  keys = [{
    name       = "terraform-state-bucket-key"
    owners     = ["[email protected]"]
    encrypters = [
      "group:[email protected]",
      "group:[email protected]"
    ]
    decrypters = ["group:[email protected]"]
  }]

  Each key object in the list accepts the following attributes:

  • name: (Required string)

    The name of a specified key. It must belong to the specified keyring and matching the regular expression [a-zA-Z0-9_-]{1,63}

  • owners: (Optional string)

    Identities that will be granted the KMS crypto key owner privilege.

  • encrypters: (Optional string)

    Identities that will be granted the KMS crypto key encrypted privilege.

  • decrypters: (Optional string)

    Identities that will be granted the kms crypto key decrypters privilege.

• key_rotation_period: (Optional string)

  Every time this period passes, generate a new version of the key and set it as the primary. The first rotation will take place after the specified period. The rotation period has the format of a decimal number with up to 9 fractional digits, followed by the letter s (seconds).

  Default is "100000s".

• key_algorithm: (Optional string)

  The algorithm to use when creating a version based on this template. For possible inputs please see https://cloud.google.com/kms/docs/reference/rest/v1/CryptoKeyVersionAlgorithm.

  Default is "GOOGLE_SYMMETRIC_ENCRYPTION".

• key_protection_level: (Optional string)

  The protection level to use when creating a version based on this template. Possible values are SOFTWARE and HSM.

  Default is "SOFTWARE".

• labels: (Optional map(string))

  Labels with user-defined metadata to apply to this resource.

  Default is [].

Module Outputs

The following attributes are exported in the outputs of the module:

• module_enabled: (bool)

  Whether this module is enabled.

• key_ring: (object(key_ring))

  All outputs of the created google_kms_key_ring resource.

• keys: (list(key))

  All outputs of the created google_kms_crypto_key resources.

• encrypter_iam_members: (list(encrypter_iam_member))

  All outputs of all created google_kms_crypto_key_iam_member resources for members with encrypter permissions.

• decrypter_iam_members: (list(decrypter_iam_member))

  All outputs of all created google_kms_crypto_key_iam_member resources for members with decrypter permissions.

• owner_iam_members: (list(owner_iam_member))

  All outputs of all created google_kms_crypto_key_iam_member resources for members with owner permissions.

External Documentation

Google Documentation

• https://cloud.google.com/security-key-management

Terraform Google Provider Documentation:

• https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/kms_key_ring
• https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/kms_crypto_key

Module Versioning

This Module follows the principles of Semantic Versioning (SemVer).

Given a version number MAJOR.MINOR.PATCH, we increment the:

1. MAJOR version when we make incompatible changes,
2. MINOR version when we add functionality in a backwards compatible manner, and
3. PATCH version when we make backwards compatible bug fixes.

Backwards compatibility in 0.0.z and 0.y.z version

• Backwards compatibility in versions 0.0.z is not guaranteed when z is increased. (Initial development)
• Backwards compatibility in versions 0.y.z is not guaranteed when y is increased. (Pre-release)

About Mineiros

Mineiros is a remote-first company headquartered in Berlin, Germany that solves development, automation and security challenges in cloud infrastructure.

Our vision is to massively reduce time and overhead for teams to manage and deploy production-grade and secure cloud infrastructure.

We offer commercial support for all of our modules and encourage you to reach out if you have any questions or need help. Feel free to email us at [email protected] or join our Community Slack channel.

Reporting Issues

We use GitHub Issues to track community reported issues and missing features.

Contributing

Contributions are always encouraged and welcome! For the process of accepting changes, we use Pull Requests. If you'd like more information, please see our Contribution Guidelines.

Makefile Targets

This repository comes with a handy Makefile. Run make help to see details on each available target.

License

This module is licensed under the Apache License Version 2.0, January 2004. Please see LICENSE for full details.

Copyright © 2020-2022 Mineiros GmbH