Skip to content

Latest commit

 

History

History
 
 

kms_key_rings_iam

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 
 
 
 
 
 
 
 
 

Module kms_key_ring IAM

This optional module is used to assign kms_key_ring roles

Example Usage

module "kms_key_ring-iam-bindings" {
  source        = "terraform-google-modules/iam/google//modules/kms_key_rings_iam"
  kms_key_rings = ["my-kms_key_ring_one", "my-kms_key_ring_two"]
  mode          = "additive"

  bindings = {
    "roles/cloudkms.cryptoKeyEncrypter" = [
      "user:[email protected]",
      "group:[email protected]",
    ]
    "roles/cloudkms.cryptoKeyDecrypter" = [
      "user:[email protected]",
      "group:[email protected]",
    ]
  }
  conditional_bindings = [
    {
      role = "roles/cloudkms.admin"
      title = "expires_after_2019_12_31"
      description = "Expiring at midnight of 2019-12-31"
      expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")"
      members = ["user:[email protected]"]
    }
  ]
}

Inputs

Name Description Type Default Required
bindings Map of role (key) and list of members (value) to add the IAM policies/bindings map(list(string)) {} no
conditional_bindings List of maps of role and respective conditions, and the members to add the IAM policies/bindings
list(object({
role = string
title = string
description = string
expression = string
members = list(string)
}))
[] no
kms_key_rings KMS Key Rings list to add the IAM policies/bindings list(string) [] no
mode Mode for adding the IAM policies/bindings, additive and authoritative string "additive" no

Outputs

Name Description
kms_key_rings KMS key rings which received bindings.
members Members which were bound to the KMS key rings.
roles Roles which were assigned to members.