Google Cloud Organization Policy Terraform Module

This Terraform module makes it easier to manage organization policies for your Google Cloud environment, particularly when you want to have exclusion rules. This module will allow you to set a top-level org policy and then disable it on individual projects or folders easily.

Compatibility

This module is meant for use with Terraform 0.13+ and tested using Terraform 1.0+. If you find incompatibilities using Terraform >=0.13, please open an issue. If you haven't upgraded and need a Terraform 0.12.x-compatible version of this module, the last released version intended for Terraform 0.12.x is v4.0.0.

Usage

Many examples are included in the examples folder, but simple usage is as follows:

module "org-policy" {
  source            = "terraform-google-modules/org-policy/google"
  version           = "~> 3.0.2"

  constraint        = "constraints/serviceuser.services"
  policy_type       = "list"
  organization_id   = "123456789"
  enforce           = true
  exclude_folders   = ["folders/folder-1-id", "folders/folder-2-id"]
  exclude_projects  = ["project3", "project4"]
}

Variables

To control module's behavior, change variables' values regarding the following:

• constraint: set this variable with the constraint value in the form constraints/{constraint identifier}. For example, constraints/serviceuser.services
• policy_type: Specify either boolean for boolean policies or list for list policies. (default list)
• Policy Root: set one of the following values to determine where the policy is applied:
  • organization_id
  • project_id
  • folder_id
• exclude_folders: a list of folder IDs to be excluded from this policy. These folders must be lower in the hierarchy than the policy root.
• exclude_projects: a list of project IDs to be excluded from this policy. They must be lower in the hierarchy than the policy root.
• Boolean policies (with policy_type: "boolean") can set the following variables:
  • enforce: if true or null then the policy is enforced at the root; if false then policy is not enforced at the root. (default null)
• List policies (with policy_type: "list") can set one of the following variables. Only one may be set.
  • enforce: if true or null then policy will deny all; if false then policy will allow all (default null)
  • allow: list of values to include in the policy with ALLOW behavior. Set enforce to null to use it.
  • deny: list of values to include in the policy with DENY behavior. Set enforce to null to use it.
• List policies with allow or deny values require the length to be set (a workaround for this terraform issue)
  • allow_list_length
  • deny_list_length

Inputs

[
  ""
]

[
  ""
]

Outputs

No output.

Requirements

Terraform plugins

• Terraform >= 0.13.0
• terraform-provider-google >= v2.5.0

Permissions

In order to execute this module, the Service Account you run as must have the Organization Policy Administrator (roles/orgpolicy.PolicyAdmin) role.

Install

Terraform

Be sure you have the correct Terraform version (0.12.x), you can choose the binary here:

• https://releases.hashicorp.com/terraform/

Terraform plugins

• terraform-provider-google >= v2.5.0

Fast install (optional)

For a fast install, please configure the variables on init_centos.sh or init_debian.sh script and then launch it.

The script will do:

• Environment variables setting
• Installation of base packages like wget, curl, unzip, gcloud, etc.