如何使用Terraform在GCP中控制对共享VPC中子网的访问权限

huangapple
go评论111阅读模式
英文:

How control access to subnets in a shared VPC using Terraform in GCP

问题

我尝试让只有特定的项目能访问生产子网，我该如何做？我只能通过策略来限制访问吗？我知道在GUI/仪表板/网站上，我们可以选择我想要在共享VPC中共享的子网，是否有一种通过terraform来做这个的方法？

设置如下：

  1. # 共享网络
  2. resource "google_compute_network" "vpc-network" {
  3.   name                   = "vpc-network"
  4.   auto_create_subnetworks = false
  5.   project                = var.host-project
  6. }
  8. # 共享子网
  9. resource "google_compute_subnetwork" "development" {
  10.   name          = "development"
  11.   network       = google_compute_network.vpc-network.self_link
  12.   ip_cidr_range = ""
  13.   region        = ""
  14. }
  16. resource "google_compute_subnetwork" "production" {
  17.   name          = "production"
  18.   network       = google_compute_network.vpc-network.self_link
  19.   ip_cidr_range = ""
  20.   region        = ""
  21. }
  23. # 在主机项目中启用共享VPC
  24. resource "google_compute_shared_vpc_host_project" "host" {
  25.   project = var.host-project
  26. }
  28. # 将服务项目附加到主机项目
  29. resource "google_compute_shared_vpc_service_project" "services" {
  30.   for_each = var.service-projects
  32.   depends_on      = [google_compute_shared_vpc_host_project.host]
  33.   host_project    = google_compute_shared_vpc_host_project.host.project
  34.   service_project = each.key
  35. }
  37. # 路由器
  38. resource "google_compute_router" "router" {
  39.   name    = "shared-router"
  40.   network = google_compute_network.vpc-network.id
  41. }
  43. # 云NAT网关
  44. resource "google_compute_router_nat" "nat_gateway" {
  45.   name                  = "shared-nat-gateway"
  46.   region                = ""
  47.   router                = google_compute_router.router.name
  48.   nat_ip_allocate_option = "AUTO_ONLY"
  50.   source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
  52.   log_config {
  53.     enable = true
  54.     filter = "ERRORS_ONLY"
  55.   }
  56. }
英文:

I am trying have it so that only certain projects can access the production subnet, how do I do this? Can I only limit access through policies? I know using the GUI/dashboard/website we can pick which subnet I want to share in my shared VPC, is there a way to do it through terraform?

The setup

  1.     # Shared Network to attach 
  2. resource "google_compute_network" "vpc-network" {
  3. name    = "vpc-network"
  4. auto_create_subnetworks = false
  5. project = var.host-project
  6. }
  7. # Shared Sub-Networks to attach 
  8. resource "google_compute_subnetwork" "development" {
  9. name    = "development"
  10. network       = google_compute_network.vpc-network.self_link
  11. ip_cidr_range = ""
  12. region        = ""
  13. }
  14. resource "google_compute_subnetwork" "production" {
  15. name    = "production"
  16. network       = google_compute_network.vpc-network.self_link
  17. ip_cidr_range = ""
  18. region        = ""
  19. }
  20. # Enable A Shared VPC in the host project
  21. resource "google_compute_shared_vpc_host_project" "host" {
  22. project = var.host-project 
  23. }
  24. # Attach service projects with host project 
  25. resource "google_compute_shared_vpc_service_project" "services" {
  26. for_each = var.service-projects
  27. depends_on = [ google_compute_shared_vpc_host_project.host ]
  28. host_project    = google_compute_shared_vpc_host_project.host.project
  29. service_project = each.key
  30. }
  31. #Router
  32. resource "google_compute_router" "router" {
  33. name    = "shared-router"
  34. network = google_compute_network.vpc-network.id
  35. }
  36. #Cloud NAT Gateway
  37. resource "google_compute_router_nat" "nat_gateway" {
  38. name                  = "shared-nat-gateway"
  39. region                = ""
  40. router                = google_compute_router.router.name
  41. nat_ip_allocate_option = "AUTO_ONLY"
  42. source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
  43. log_config {
  44. enable = true
  45. filter = "ERRORS_ONLY"
  46. }
  47. }

答案1

得分: 0

根据文档（https://cloud.google.com/vpc/docs/shared-vpc）：

> 您可以在项目、文件夹或组织级别指定服务项目可以访问的共享 VPC 子网。此约束适用于在指定子网中创建新资源时，不影响现有资源。

所以是的，您需要使用组织策略，但它们可以应用在低于组织节点的级别。

Terraform 组织策略的文档应该会有所帮助：
https://registry.terraform.io/modules/terraform-google-modules/org-policy/google/latest

英文:

As per the documentation (https://cloud.google.com/vpc/docs/shared-vpc):

> You can specify the Shared VPC subnets that a service project can access at the project, folder, or organization level. The constraint applies when you create new resources in the specified subnets and doesn't affect existing resources.

So yes, you need to use org policies, but they can be applied at lower levels than the organization node.

The terraform documentation for org policies should help:
https://registry.terraform.io/modules/terraform-google-modules/org-policy/google/latest

huangapple
  • 本文由 发表于 2023年7月20日 10:58:25
  • 转载请务必保留本文链接：https://go.coder-hub.com/76726405.html
  • google-cloud-platform
  • terraform
  • terraform-provider-gcp
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定