terraform-google-artifact-registry-repository-iam/main.tf at main · mineiros-io/terraform-google-artifact-registry-repository-iam · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
resource "google_artifact_registry_repository_iam_binding" "binding" {
  provider = google-beta
  count    = var.module_enabled && var.policy_bindings == null && var.authoritative ? 1 : 0

  repository = var.repository
  location   = var.location
  role       = var.role
  members    = [for m in var.members : try(var.computed_members_map[regex("^computed:(.*)", m)[0]], m)]

  dynamic "condition" {
    for_each = var.condition != null ? [var.condition] : []

    content {
      expression  = condition.value.expression
      title       = condition.value.title
      description = try(condition.value.description, null)
    }
  }

  project = var.project

  depends_on = [var.module_depends_on]
}

resource "google_artifact_registry_repository_iam_member" "member" {
  provider = google-beta
  for_each = var.module_enabled && var.policy_bindings == null && var.authoritative == false ? var.members : []

  repository = var.repository
  location   = var.location
  role       = var.role
  member     = try(var.computed_members_map[regex("^computed:(.*)", each.value)[0]], each.value)

  dynamic "condition" {
    for_each = var.condition != null ? [var.condition] : []

    content {
      expression  = condition.value.expression
      title       = condition.value.title
      description = try(condition.value.description, null)
    }
  }

  project = var.project

  depends_on = [var.module_depends_on]
}

resource "google_artifact_registry_repository_iam_policy" "policy" {
  provider = google-beta
  count    = var.module_enabled && var.policy_bindings != null ? 1 : 0

  repository  = var.repository
  location    = var.location
  policy_data = data.google_iam_policy.policy[0].policy_data
  project     = var.project

  depends_on = [var.module_depends_on]
}

data "google_iam_policy" "policy" {
  count = var.module_enabled && var.policy_bindings != null ? 1 : 0

  dynamic "binding" {
    for_each = var.policy_bindings

    content {
      role    = binding.value.role
      members = [for m in binding.value.members : try(var.computed_members_map[regex("^computed:(.*)", m)[0]], m)]

      dynamic "condition" {
        for_each = try([binding.value.condition], [])

        content {
          expression  = condition.value.expression
          title       = condition.value.title
          description = try(condition.value.description, null)
        }
      }
    }
  }
}