kms

src/files_gcp.go

@@ -27,3 +27,9 @@ var googleProjectIamCustomRole []byte
 
 //go:embed mapping/gcp/resource/iam/google_sevice_account.json
 var googleServiceAccount []byte
+
+//go:embed mapping/gcp/resource/cloudkms/google_kms_key_ring.json
+var googleKmsKeyRing []byte
+
+//go:embed  mapping/gcp/resource/cloudkms/google_kms_crypto_key.json
+var googleKmsCryptoKey []byte

src/files_gcp_datasource.go

@@ -18,3 +18,9 @@ var dataGoogleComputeZones []byte
 
 //go:embed mapping/gcp/data/resourcemanager/google_project.json
 var dataGoogleProject []byte
+
+//go:embed mapping/gcp/data/cloudkms/google_kms_key_ring.json
+var dataGoogleKmsKeyRing []byte
+
+//go:embed  mapping/gcp/data/cloudkms/google_kms_crypto_key.json
+var dataGoogleKmsCryptoKey []byte

src/gcp.go

@@ -27,6 +27,8 @@ func GetGCPResourcePermissions(result ResourceV2) []string {
 		"google_compute_firewall":        googleComputeFirewall,
 		"google_project_iam_custom_role": googleProjectIamCustomRole,
 		"google_service_account":         googleServiceAccount,
+		"google_kms_crypto_key":          googleKmsCryptoKey,
+		"google_kms_key_ring":            googleKmsKeyRing,
 	}
 
 	var Permissions []string

src/gcp_data_source.go

@@ -14,6 +14,8 @@ func GetGCPDataPermissions(result ResourceV2) []string {
 		"google_project":            dataGoogleProject,
 		"google_iam_policy":         placeholder,
 		"google_iam_role":           placeholder,
+		"google_kms_crypto_key":     dataGoogleKmsCryptoKey,
+		"google_kms_key_ring":       dataGoogleKmsKeyRing,
 	}
 
 	var Permissions []string

src/mapping/gcp/data/cloudkms/google_kms_crypto_key.json

@@ -0,0 +1,13 @@
+[
+  {
+    "apply": [],
+    "attributes": {
+      "tags": []
+    },
+    "destroy": [],
+    "modify": [],
+    "plan": [
+      "cloudkms.cryptoKeys.get"
+    ]
+  }
+]

src/mapping/gcp/data/cloudkms/google_kms_key_ring.json

@@ -0,0 +1,13 @@
+[
+  {
+    "apply": [],
+    "attributes": {
+      "tags": []
+    },
+    "destroy": [],
+    "modify": [],
+    "plan": [
+      "cloudkms.keyRings.get"
+    ]
+  }
+]

src/mapping/gcp/resource/cloudkms/google_kms_crypto_key.json

@@ -0,0 +1,21 @@
+[
+  {
+    "apply": [
+      "cloudkms.cryptoKeys.create",
+      "cloudkms.cryptoKeys.get",
+      "cloudkms.cryptoKeyVersions.list",
+      "cloudkms.cryptoKeyVersions.destroy",
+      "cloudkms.cryptoKeys.update"
+    ],
+    "attributes": {
+      "tags": []
+    },
+    "destroy": [
+      "cloudkms.cryptoKeyVersions.destroy"
+    ],
+    "modify": [
+      "cloudkms.cryptoKeys.update"
+    ],
+    "plan": []
+  }
+]

src/mapping/gcp/resource/cloudkms/google_kms_key_ring.json

@@ -0,0 +1,14 @@
+[
+  {
+    "apply": [
+      "cloudkms.keyRings.create",
+      "cloudkms.keyRings.get"
+    ],
+    "attributes": {
+      "tags": []
+    },
+    "destroy": [],
+    "modify": [],
+    "plan": []
+  }
+]

terraform/gcp/backup/data.google_kms_crypto_key.tf

@@ -0,0 +1,8 @@
+data "google_kms_crypto_key" "pike" {
+  name     = "pike-key-keep"
+  key_ring = "projects/pike-361314/locations/europe-west1/keyRings/pike"
+}
+
+output "pike-key" {
+  value = data.google_kms_crypto_key.pike
+}

terraform/gcp/backup/data.google_kms_key_ring.tf

@@ -0,0 +1,9 @@
+
+data "google_kms_key_ring" "pike" {
+  name     = "pike"
+  location = "europe-west1"
+}
+
+output "ring" {
+  value = data.google_kms_key_ring.pike
+}

terraform/gcp/backup/google_kms_crypto_key.tf

@@ -0,0 +1,16 @@
+resource "google_kms_crypto_key" "pike" {
+  name            = "pike-key-keep"
+  key_ring        = "projects/pike-361314/locations/europe-west1/keyRings/pike"
+  rotation_period = "100000s"
+
+  purpose = "ENCRYPT_DECRYPT"
+  labels = {
+    "pike" = "permissions"
+    update = "possible"
+  }
+  # destroy_scheduled_duration = "86400s"
+
+  # lifecycle {
+  #   prevent_destroy = true
+  # }
+}

terraform/gcp/backup/google_kms_key_ring.tf

@@ -0,0 +1,7 @@
+resource "google_kms_key_ring" "pike" {
+  name     = "pike"
+  location = "europe-west1"
+}
+
+# key rings cannot be deleted
+# terraform import google_kms_key_ring.pike projects/pike-361314/locations/europe-west1/keyRings/pike

terraform/gcp/role/google_project_iam_custom_role.tf

@@ -4,9 +4,6 @@ resource "google_project_iam_custom_role" "pike" {
   title       = "pike terraform user"
   description = "A user with least privileges"
   permissions = [
-    "iam.serviceAccounts.create",
-    "iam.serviceAccounts.get",
-    "iam.serviceAccounts.delete",
-    "iam.serviceAccounts.update"
+    "cloudkms.cryptoKeys.get"
   ]
 }

todo_gcp.md

@@ -13,23 +13,13 @@
  google_compute_subnetwork not implemented
  google_container_cluster not implemented
  google_container_node_pool not implemented
- google_kms_crypto_key not implemented
- google_kms_key_ring not implemented
  google_project_iam_binding not implemented
  google_project_iam_binding not implemented
  google_project_iam_binding not implemented
  google_project_iam_binding not implemented
  google_project_iam_binding not implemented
  google_project_iam_binding not implemented
  google_project_iam_member not implemented
- google_project_service not implemented
- google_project_service not implemented
- google_project_service not implemented
- google_project_service not implemented
- google_project_service not implemented
- google_project_service not implemented
- google_project_service not implemented
- google_project_service not implemented
  google_service_account_iam_policy not implemented
  google_service_account_key not implemented
  google_service_networking_connection not implemented