Bucket module

gcp/cmek_bucket/main.tf

@@ -0,0 +1,30 @@
+# Let's retrieve the default GCS Service account
+data "google_storage_project_service_account" "gcs_account" {
+  project    = var.project_id
+  depends_on = [module.project-services]
+}
+
+# The gcs default service account must be given access to the KMS Key.
+resource "google_kms_crypto_key_iam_member" "gcs_default_sa" {
+  crypto_key_id = var.kms_key_path
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+
+  member     = "serviceAccount:${data.google_storage_project_service_account.gcs_account.email_address}"
+  depends_on = [module.project-services]
+}
+
+resource "google_storage_bucket" "main" {
+  name     = var.name
+  project  = var.project_id
+  location = var.region
+
+  uniform_bucket_level_access = true
+
+  encryption {
+    default_kms_key_name = var.kms_key_path
+  }
+
+  # Ensure the KMS crypto-key IAM binding for the service account exists prior to the
+  # bucket attempting to utilise the crypto-key.
+  depends_on = [google_kms_crypto_key_iam_member.gcs_default_sa, module.project-services]
+}

gcp/cmek_bucket/outputs.tf

@@ -0,0 +1,7 @@
+output "id" {
+  value = google_storage_bucket.main.id
+}
+
+output "name" {
+  value = google_storage_bucket.main.name
+}

gcp/cmek_bucket/terraform.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = "1.3.7"
+
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = ">=5.11.0"
+    }
+  }
+}

gcp/cmek_bucket/variables.tf

@@ -0,0 +1,20 @@
+variable "name" {
+  type        = string
+  description = "Name of storage bucket"
+}
+
+variable "project_id" {
+  description = "Id of the project"
+  type        = string
+}
+
+variable "region" {
+  description = "Region where to deploy the bucket. Default to Frankfurt."
+  default     = "europe-west3"
+  type        = string
+}
+
+variable "kms_key_path" {
+  description = "The Customer Managed Encryption Key used to encrypt the data. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]"
+  type        = string
+}