Skip to content

Google Cloud KMS Module#

This module manages a KMS keyring and its keys. It is a wrapper around the official Google Cloud Foundation Fabric KMS module.

It also supports creating a binary authorization attestor and an associated container analysis note.

Compatibility#

This module has been tested using Terraform v1.12.2

Usage#

Example with Binary Authorization Attestor#

module "kms" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-kms?ref=vX.Y.Z"

  project_id = "acme-prod-shared-vpc"
  keyring = {
    location = "me-west1"
    name     = "kms-module-00001"
  }
  create_attestor = true
  keys = {
    "sign-images-00001" = {
      purpose = "ASYMMETRIC_SIGN"
      version_template = {
        algorithm        = "EC_SIGN_P256_SHA256"
        protection_level = "SOFTWARE"
      }
    }
  }
}

Basic Example#

module "kms" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-kms?ref=vX.Y.Z"

  project_id = "your-gcp-project-id"
  keyring = {
    name     = "my-keyring"
    location = "global"
  }
  keys = {
    "my-key" = {
      rotation_period = "86400s"
    }
  }
}

Software#

The following dependencies must be available:

Service Account#

User or service account credentials with the following roles must be used to provision the resources of this module:

  • Cloud KMS Admin: roles/cloudkms.admin

APIs#

A project with the following APIs enabled must be used to host the resources of this module:

  • Cloud Key Management Service (KMS) API: cloudkms.googleapis.com
  • Binary Authorization API: binaryauthorization.googleapis.com (if using binary authorization attestor)
  • Container Analysis API: containeranalysis.googleapis.com (if using binary authorization attestor)

License#

This module is covered by a commercial license. Please see LICENSE for details.

Support#

This module is developed and maintained by MyOps Limited. For any support inquiries, please contact us at info@myops.co.il.

Requirements#

Name Version
terraform ~> 1
google >= 6.28.0, < 7.0.0
time >= 0.9.1

Providers#

Name Version
google >= 6.28.0, < 7.0.0
time >= 0.9.1

Modules#

Name Source Version
kms github.com/GoogleCloudPlatform/cloud-foundation-fabric//modules/kms v42.0.0

Resources#

Name Type
google_binary_authorization_attestor.attestor resource
google_container_analysis_note.note resource
time_sleep.wait_for_key_version resource
google_kms_crypto_key_version.version data source

Inputs#

Name Description Type Default Required
create_attestor Whether to create binary authorization attestor or not bool false no
iam Keyring IAM bindings in {ROLE => [MEMBERS]} format. map(list(string)) {} no
iam_bindings Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. 
map(object({
 members = list(string)
 role = string
 condition = optional(object({
 expression = string
 title = string
 description = optional(string)
 }))
 }))
 {} no
iam_bindings_additive Keyring individual additive IAM bindings. Keys are arbitrary. 
map(object({
 member = string
 role = string
 condition = optional(object({
 expression = string
 title = string
 description = optional(string)
 }))
 }))
 {} no
import_job Keyring import job attributes. 
object({
 id = string
 import_method = string
 protection_level = string
 })
 null no
keyring Keyring attributes. 
object({
 location = string
 name = string
 })
 n/a yes
keyring_create Set to false to manage keys and IAM bindings in an existing keyring. bool true no
keys Key names and base attributes. Set attributes to null if not needed. 
map(object({
 destroy_scheduled_duration = optional(string)
 rotation_period = optional(string)
 labels = optional(map(string))
 purpose = optional(string, "ENCRYPT_DECRYPT")
 skip_initial_version_creation = optional(bool, false)
 version_template = optional(object({
 algorithm = string
 protection_level = optional(string, "SOFTWARE")
 }))
 iam = optional(map(list(string)), {})
 iam_bindings = optional(map(object({
 members = list(string)
 role = string
 condition = optional(object({
 expression = string
 title = string
 description = optional(string)
 }))
 })), {})
 iam_bindings_additive = optional(map(object({
 member = string
 role = string
 condition = optional(object({
 expression = string
 title = string
 description = optional(string)
 }))
 })), {})
 }))
 {} no
project_id Project id where the keyring will be created. string n/a yes
tag_bindings Tag bindings for this keyring, in key => tag value id format. map(string) {} no

Outputs#

Name Description
attestor n/a
attestor_public_key n/a
kms KMS Outputs