Feat/ssm integration

fast/stages-aw/0-bootstrap/IAM.md

@@ -35,7 +35,7 @@ Legend: <code>+</code> additive, <code>•</code> conditional.
 |<b>prod-bootstrap-0r</b><br><small><i>serviceAccount</i></small>|organizations/[organization #0]/roles/storageViewer <br>[roles/viewer](https://cloud.google.com/iam/docs/understanding-roles#viewer) |
 |<b>prod-bootstrap-1</b><br><small><i>serviceAccount</i></small>|[roles/logging.logWriter](https://cloud.google.com/iam/docs/understanding-roles#logging.logWriter) <code>+</code>|
 |<b>prod-bootstrap-1r</b><br><small><i>serviceAccount</i></small>|[roles/logging.logWriter](https://cloud.google.com/iam/docs/understanding-roles#logging.logWriter) <code>+</code>|
-|<b>prod-resman-0</b><br><small><i>serviceAccount</i></small>|[roles/cloudbuild.builds.editor](https://cloud.google.com/iam/docs/understanding-roles#cloudbuild.builds.editor) <br>[roles/iam.serviceAccountAdmin](https://cloud.google.com/iam/docs/understanding-roles#iam.serviceAccountAdmin) <br>[roles/iam.workloadIdentityPoolAdmin](https://cloud.google.com/iam/docs/understanding-roles#iam.workloadIdentityPoolAdmin) <br>[roles/source.admin](https://cloud.google.com/iam/docs/understanding-roles#source.admin) <br>[roles/storage.admin](https://cloud.google.com/iam/docs/understanding-roles#storage.admin) <br>[roles/resourcemanager.projectIamAdmin](https://cloud.google.com/iam/docs/understanding-roles#resourcemanager.projectIamAdmin) <code>•</code><br>[roles/serviceusage.serviceUsageConsumer](https://cloud.google.com/iam/docs/understanding-roles#serviceusage.serviceUsageConsumer) <code>+</code>|
-|<b>prod-resman-0r</b><br><small><i>serviceAccount</i></small>|organizations/[organization #0]/roles/storageViewer <br>[roles/browser](https://cloud.google.com/iam/docs/understanding-roles#browser) <br>[roles/cloudbuild.builds.viewer](https://cloud.google.com/iam/docs/understanding-roles#cloudbuild.builds.viewer) <br>[roles/iam.serviceAccountViewer](https://cloud.google.com/iam/docs/understanding-roles#iam.serviceAccountViewer) <br>[roles/iam.workloadIdentityPoolViewer](https://cloud.google.com/iam/docs/understanding-roles#iam.workloadIdentityPoolViewer) <br>[roles/source.reader](https://cloud.google.com/iam/docs/understanding-roles#source.reader) <br>[roles/viewer](https://cloud.google.com/iam/docs/understanding-roles#viewer) <br>[roles/serviceusage.serviceUsageViewer](https://cloud.google.com/iam/docs/understanding-roles#serviceusage.serviceUsageViewer) <code>+</code>|
+|<b>prod-resman-0</b><br><small><i>serviceAccount</i></small>|[roles/cloudbuild.builds.editor](https://cloud.google.com/iam/docs/understanding-roles#cloudbuild.builds.editor) <br>[roles/iam.serviceAccountAdmin](https://cloud.google.com/iam/docs/understanding-roles#iam.serviceAccountAdmin) <br>[roles/iam.workloadIdentityPoolAdmin](https://cloud.google.com/iam/docs/understanding-roles#iam.workloadIdentityPoolAdmin) <br>[roles/securesourcemanager.instanceAccessor](https://cloud.google.com/iam/docs/understanding-roles#securesourcemanager.instanceAccessor) <br>[roles/storage.admin](https://cloud.google.com/iam/docs/understanding-roles#storage.admin) <br>[roles/resourcemanager.projectIamAdmin](https://cloud.google.com/iam/docs/understanding-roles#resourcemanager.projectIamAdmin) <code>•</code><br>[roles/serviceusage.serviceUsageConsumer](https://cloud.google.com/iam/docs/understanding-roles#serviceusage.serviceUsageConsumer) <code>+</code>|
+|<b>prod-resman-0r</b><br><small><i>serviceAccount</i></small>|organizations/[organization #0]/roles/storageViewer <br>[roles/browser](https://cloud.google.com/iam/docs/understanding-roles#browser) <br>[roles/cloudbuild.builds.viewer](https://cloud.google.com/iam/docs/understanding-roles#cloudbuild.builds.viewer) <br>[roles/iam.serviceAccountViewer](https://cloud.google.com/iam/docs/understanding-roles#iam.serviceAccountViewer) <br>[roles/iam.workloadIdentityPoolViewer](https://cloud.google.com/iam/docs/understanding-roles#iam.workloadIdentityPoolViewer) <br>[roles/securesourcemanager.instanceAccessor](https://cloud.google.com/iam/docs/understanding-roles#securesourcemanager.instanceAccessor) <br>[roles/viewer](https://cloud.google.com/iam/docs/understanding-roles#viewer) <br>[roles/serviceusage.serviceUsageViewer](https://cloud.google.com/iam/docs/understanding-roles#serviceusage.serviceUsageViewer) <code>+</code>|
 |<b>prod-resman-1</b><br><small><i>serviceAccount</i></small>|[roles/logging.logWriter](https://cloud.google.com/iam/docs/understanding-roles#logging.logWriter) <code>+</code>|
 |<b>prod-resman-1r</b><br><small><i>serviceAccount</i></small>|[roles/logging.logWriter](https://cloud.google.com/iam/docs/understanding-roles#logging.logWriter) <code>+</code>|

fast/stages-aw/0-bootstrap/README.md

@@ -325,7 +325,7 @@ cicd_repositories = {
 }
 ```
 
-The `type` attribute can be set to one of the supported repository types: `github`, `gitlab`, or `sourcerepo`.
+The `type` attribute can be set to one of the supported repository types: `github`, `gitlab`, or `ssm`.
 
 Once the stage is applied the generated output files will contain pre-configured workflow files for each repository, that will use Workload Identity Federation via a dedicated service account for each repository to impersonate the automation service account for the stage.
 

fast/stages-aw/0-bootstrap/automation.tf

@@ -74,10 +74,8 @@ module "automation-project" {
     "roles/iam.workloadIdentityPoolViewer" = [
       module.automation-tf-resman-r-sa.iam_email
     ]
-    "roles/source.admin" = [
-      module.automation-tf-resman-sa.iam_email
-    ]
-    "roles/source.reader" = [
+    "roles/securesourcemanager.instanceAccessor" = [
+      module.automation-tf-resman-sa.iam_email,
       module.automation-tf-resman-r-sa.iam_email
     ]
     "roles/storage.admin" = [
@@ -145,6 +143,7 @@ module "automation-project" {
       "iamcredentials.googleapis.com",
       "orgpolicy.googleapis.com",
       "pubsub.googleapis.com",
+      "securesourcemanager.googleapis.com",
       "servicenetworking.googleapis.com",
       "serviceusage.googleapis.com",
       "stackdriver.googleapis.com",

fast/stages-aw/0-bootstrap/cicd.tf

@@ -37,7 +37,7 @@ locals {
       v != null
       &&
       (
-        try(v.type, null) == "sourcerepo"
+        try(v.type, null) == "ssm"
         ||
         contains(
           keys(local.workload_identity_providers),
@@ -65,44 +65,58 @@ locals {
   }
 }
 
-# source repository
+# secure source manager instance and repository
 
 module "automation-tf-cicd-repo" {
-  source = "../../../modules/source-repository"
+  source = "../../../modules/secure-source-manager-instance"
   for_each = {
-    for k, v in local.cicd_repositories : k => v if v.type == "sourcerepo"
+    for k, v in local.cicd_repositories : k => v if v.type == "ssm"
   }
-  project_id = module.automation-project.project_id
-  name       = each.value.name
-  iam = {
-    "roles/source.admin" = [
-      each.key == "bootstrap"
-      ? module.automation-tf-bootstrap-sa.iam_email
-      : module.automation-tf-resman-sa.iam_email
-    ]
-    "roles/source.reader" = concat(
-      [module.automation-tf-cicd-sa[each.key].iam_email],
-      each.key == "bootstrap"
-      ? [module.automation-tf-bootstrap-r-sa.iam_email]
-      : [module.automation-tf-resman-r-sa.iam_email]
-    )
-  }
-  triggers = {
-    "fast-0-${each.key}" = {
-      filename        = ".cloudbuild/workflow.yaml"
-      included_files  = ["**/*tf", ".cloudbuild/workflow.yaml"]
-      service_account = module.automation-tf-cicd-sa[each.key].id
-      substitutions   = {}
-      template = {
-        project_id  = null
-        branch_name = each.value.branch
-        repo_name   = each.value.name
-        tag_name    = null
+  project_id      = module.automation-project.project_id
+  location        = var.regions.primary
+  instance_id     = "${each.key}-repo-instance"
+  instance_create = true
+  repositories = {
+    (each.value.name) = {
+      description = "FAST Secure Source Manager repository for ${each.key} stage."
+      initial_config = {
+        default_branch = coalesce(each.value.branch, "main")
+      }
+      iam = {
+        "roles/securesourcemanager.repoAdmin" = [
+          each.key == "bootstrap"
+          ? module.automation-tf-bootstrap-sa.iam_email
+          : module.automation-tf-resman-sa.iam_email
+        ]
+        "roles/securesourcemanager.repoReader" = concat(
+          [module.automation-tf-cicd-sa[each.key].iam_email],
+          each.key == "bootstrap"
+          ? [module.automation-tf-bootstrap-r-sa.iam_email]
+          : [module.automation-tf-resman-r-sa.iam_email]
+        )
       }
     }
   }
 }
 
+resource "google_cloudbuild_trigger" "automation-tf-cicd-trigger" {
+  for_each = {
+    for k, v in local.cicd_repositories : k => v if v.type == "ssm"
+  }
+  project = module.automation-project.project_id
+  name    = "fast-0-${each.key}"
+
+  repository_event_config {
+    repository = module.automation-tf-cicd-repo[each.key].repositories[each.value.name].id
+    push {
+      branch = "^${coalesce(each.value.branch, "main")}$"
+    }
+  }
+
+  filename        = ".cloudbuild/workflow.yaml"
+  service_account = module.automation-tf-cicd-sa[each.key].id
+}
+
 # SAs used by CI/CD workflows to impersonate automation SAs
 
 module "automation-tf-cicd-sa" {
@@ -113,7 +127,7 @@ module "automation-tf-cicd-sa" {
   display_name = "Terraform CI/CD ${each.key} service account."
   prefix       = local.prefix
   iam = (
-    each.value.type == "sourcerepo"
+    each.value.type == "ssm"
     # used directly from the cloud build trigger for source repos
     ? {}
     # impersonated via workload identity federation for external repos
@@ -150,7 +164,7 @@ module "automation-tf-cicd-r-sa" {
   display_name = "Terraform CI/CD ${each.key} service account (read-only)."
   prefix       = local.prefix
   iam = (
-    each.value.type == "sourcerepo"
+    each.value.type == "ssm"
     # build trigger for read-only SA is optionally defined by users
     ? {}
     # impersonated via workload identity federation for external repos

fast/stages-aw/0-bootstrap/terraform.tfvars.sample

@@ -75,3 +75,33 @@ assured_workloads = {
 bootstrap_project = "<bootstrap_project_id>"
 
 alert_email = "<alert_email>"
+
+# CI/CD repository configuration example
+# Option A: Secure Source Manager (SSM)
+# cicd_repositories = {
+#   bootstrap = {
+#     name   = "fast-bootstrap"
+#     type   = "ssm"
+#     branch = "main"
+#   }
+#   resman = {
+#     name   = "fast-resman"
+#     type   = "ssm"
+#     branch = "main"
+#   }
+# }
+# Option B: GitHub/GitLab (requires federated_identity_providers)
+# cicd_repositories = {
+#   bootstrap = {
+#     identity_provider = "github"
+#     name              = "my-org/my-bootstrap-repo"
+#     type              = "github"
+#     branch            = "main"
+#   }
+#   resman = {
+#     identity_provider = "github"
+#     name              = "my-org/my-resman-repo"
+#     type              = "github"
+#     branch            = "main"
+#   }
+# }

fast/stages-aw/0-bootstrap/variables.tf

@@ -100,19 +100,19 @@ variable "cicd_repositories" {
       v == null || (
         try(v.identity_provider, null) != null
         ||
-        try(v.type, null) == "sourcerepo"
+        try(v.type, null) == "ssm"
       )
     ])
-    error_message = "Non-null repositories need a non-null provider unless type is 'sourcerepo'."
+    error_message = "Non-null repositories need a non-null provider unless type is 'ssm'."
   }
   validation {
     condition = alltrue([
       for k, v in coalesce(var.cicd_repositories, {}) :
       v == null || (
-        contains(["github", "gitlab", "sourcerepo"], coalesce(try(v.type, null), "null"))
+        contains(["github", "gitlab", "ssm"], coalesce(try(v.type, null), "null"))
       )
     ])
-    error_message = "Invalid repository type, supported types: 'github' 'gitlab' or 'sourcerepo'."
+    error_message = "Invalid repository type, supported types: 'github' 'gitlab' or 'ssm'."
   }
 }
 

fast/stages-aw/1-resman/cicd-data-platform.tf

@@ -21,7 +21,7 @@
 module "branch-dp-dev-cicd-repo" {
   source = "../../../modules/source-repository"
   for_each = (
-    try(local.cicd_repositories.data_platform_dev.type, null) == "sourcerepo"
+    try(local.cicd_repositories.data_platform_dev.type, null) == "ssm"
     ? { 0 = local.cicd_repositories.data_platform_dev }
     : {}
   )
@@ -57,7 +57,7 @@ module "branch-dp-dev-cicd-repo" {
 module "branch-dp-prod-cicd-repo" {
   source = "../../../modules/source-repository"
   for_each = (
-    try(local.cicd_repositories.data_platform_prod.type, null) == "sourcerepo"
+    try(local.cicd_repositories.data_platform_prod.type, null) == "ssm"
     ? { 0 = local.cicd_repositories.data_platform_prod }
     : {}
   )
@@ -100,7 +100,7 @@ module "branch-dp-dev-sa-cicd" {
   display_name = "Terraform CI/CD data platform development service account."
   prefix       = var.prefix
   iam = (
-    each.value.type == "sourcerepo"
+    each.value.type == "ssm"
     # used directly from the cloud build trigger for source repos
     ? {
       "roles/iam.serviceAccountUser" = local.automation_resman_sa_iam
@@ -143,7 +143,7 @@ module "branch-dp-prod-sa-cicd" {
   display_name = "Terraform CI/CD data platform production service account."
   prefix       = var.prefix
   iam = (
-    each.value.type == "sourcerepo"
+    each.value.type == "ssm"
     # used directly from the cloud build trigger for source repos
     ? {
       "roles/iam.serviceAccountUser" = local.automation_resman_sa_iam
@@ -188,7 +188,7 @@ module "branch-dp-dev-r-sa-cicd" {
   display_name = "Terraform CI/CD data platform development service account (read-only)."
   prefix       = var.prefix
   iam = (
-    each.value.type == "sourcerepo"
+    each.value.type == "ssm"
     # build trigger for read-only SA is optionally defined by users
     ? {}
     # impersonated via workload identity federation for external repos
@@ -222,7 +222,7 @@ module "branch-dp-prod-r-sa-cicd" {
   display_name = "Terraform CI/CD data platform production service account (read-only)."
   prefix       = var.prefix
   iam = (
-    each.value.type == "sourcerepo"
+    each.value.type == "ssm"
     # build trigger for read-only SA is optionally defined by users
     ? {}
     # impersonated via workload identity federation for external repos

fast/stages-aw/1-resman/cicd-gcve.tf

@@ -21,7 +21,7 @@
 module "branch-gcve-dev-cicd-repo" {
   source = "../../../modules/source-repository"
   for_each = (
-    try(local.cicd_repositories.gcve_dev.type, null) == "sourcerepo"
+    try(local.cicd_repositories.gcve_dev.type, null) == "ssm"
     ? { 0 = local.cicd_repositories.gcve_dev }
     : {}
   )
@@ -57,7 +57,7 @@ module "branch-gcve-dev-cicd-repo" {
 module "branch-gcve-prod-cicd-repo" {
   source = "../../../modules/source-repository"
   for_each = (
-    try(local.cicd_repositories.gcve_prod.type, null) == "sourcerepo"
+    try(local.cicd_repositories.gcve_prod.type, null) == "ssm"
     ? { 0 = local.cicd_repositories.gcve_prod }
     : {}
   )
@@ -100,7 +100,7 @@ module "branch-gcve-dev-sa-cicd" {
   display_name = "Terraform CI/CD GCVE development service account."
   prefix       = var.prefix
   iam = (
-    each.value.type == "sourcerepo"
+    each.value.type == "ssm"
     # used directly from the cloud build trigger for source repos
     ? {
       "roles/iam.serviceAccountUser" = local.automation_resman_sa_iam
@@ -143,7 +143,7 @@ module "branch-gcve-prod-sa-cicd" {
   display_name = "Terraform CI/CD GCVE production service account."
   prefix       = var.prefix
   iam = (
-    each.value.type == "sourcerepo"
+    each.value.type == "ssm"
     # used directly from the cloud build trigger for source repos
     ? {
       "roles/iam.serviceAccountUser" = local.automation_resman_sa_iam
@@ -188,7 +188,7 @@ module "branch-gcve-dev-r-sa-cicd" {
   display_name = "Terraform CI/CD GCVE development service account (read-only)."
   prefix       = var.prefix
   iam = (
-    each.value.type == "sourcerepo"
+    each.value.type == "ssm"
     # build trigger for read-only SA is optionally defined by users
     ? {}
     # impersonated via workload identity federation for external repos
@@ -222,7 +222,7 @@ module "branch-gcve-prod-r-sa-cicd" {
   display_name = "Terraform CI/CD GCVE production service account (read-only)."
   prefix       = var.prefix
   iam = (
-    each.value.type == "sourcerepo"
+    each.value.type == "ssm"
     # build trigger for read-only SA is optionally defined by users
     ? {}
     # impersonated via workload identity federation for external repos

fast/stages-aw/1-resman/cicd-gke.tf

@@ -21,7 +21,7 @@
 module "branch-gke-dev-cicd-repo" {
   source = "../../../modules/source-repository"
   for_each = (
-    try(local.cicd_repositories.gke_dev.type, null) == "sourcerepo"
+    try(local.cicd_repositories.gke_dev.type, null) == "ssm"
     ? { 0 = local.cicd_repositories.gke_dev }
     : {}
   )
@@ -57,7 +57,7 @@ module "branch-gke-dev-cicd-repo" {
 module "branch-gke-prod-cicd-repo" {
   source = "../../../modules/source-repository"
   for_each = (
-    try(local.cicd_repositories.gke_prod.type, null) == "sourcerepo"
+    try(local.cicd_repositories.gke_prod.type, null) == "ssm"
     ? { 0 = local.cicd_repositories.gke_prod }
     : {}
   )
@@ -100,7 +100,7 @@ module "branch-gke-dev-sa-cicd" {
   display_name = "Terraform CI/CD GKE development service account."
   prefix       = var.prefix
   iam = (
-    each.value.type == "sourcerepo"
+    each.value.type == "ssm"
     # used directly from the cloud build trigger for source repos
     ? {
       "roles/iam.serviceAccountUser" = local.automation_resman_sa_iam
@@ -143,7 +143,7 @@ module "branch-gke-prod-sa-cicd" {
   display_name = "Terraform CI/CD GKE production service account."
   prefix       = var.prefix
   iam = (
-    each.value.type == "sourcerepo"
+    each.value.type == "ssm"
     # used directly from the cloud build trigger for source repos
     ? {
       "roles/iam.serviceAccountUser" = local.automation_resman_sa_iam
@@ -188,7 +188,7 @@ module "branch-gke-dev-r-sa-cicd" {
   display_name = "Terraform CI/CD gke multitenant development service account (read-only)."
   prefix       = var.prefix
   iam = (
-    each.value.type == "sourcerepo"
+    each.value.type == "ssm"
     # build trigger for read-only SA is optionally defined by users
     ? {}
     # impersonated via workload identity federation for external repos
@@ -222,7 +222,7 @@ module "branch-gke-prod-r-sa-cicd" {
   display_name = "Terraform CI/CD gke multitenant production service account (read-only)."
   prefix       = var.prefix
   iam = (
-    each.value.type == "sourcerepo"
+    each.value.type == "ssm"
     # build trigger for read-only SA is optionally defined by users
     ? {}
     # impersonated via workload identity federation for external repos