From 965762387adbb96ca404f3474578ee18f3811b91 Mon Sep 17 00:00:00 2001 From: Scott McDonald Date: Fri, 28 Aug 2026 17:47:15 +0000 Subject: [PATCH] fix(0-bootstrap): declare billing_override, fix the assured_workload output, align the prefix limit Three small consistency fixes in the bootstrap stage: - templates/providers.tf.tpl renders four references to var.billing_override into every generated providers file, including 0-bootstrap-providers.tf, but stage 0 never declared the variable (stages 1, 2 and 3 do). Terraform only rejects the reference once a resource uses the google.billing alias, so the stage works today by accident; declare the variable with the same shape and default as the other stages so the generated file is self-consistent. - output assured_workload wrapped module.no-compliance-folder[0].folder.id in "folders/" although google_folder.id already carries that prefix, producing "folders/folders/NNN" whenever assured_workloads.regime is COMPLIANCE_REGIME_UNSPECIFIED. organization.tf uses the bare id for the same folder; the output now uses the module's fully qualified id. - var.prefix is validated to 7 characters or fewer, but its description, the tfvars sample and the README all said 9. The validation is the behaviour; the text now matches it. Signed-off-by: Scott McDonald --- fast/stages-aw/0-bootstrap/README.md | 4 ++-- fast/stages-aw/0-bootstrap/outputs.tf | 2 +- fast/stages-aw/0-bootstrap/terraform.tfvars.sample | 2 +- fast/stages-aw/0-bootstrap/variables.tf | 11 ++++++++++- 4 files changed, 14 insertions(+), 5 deletions(-) diff --git a/fast/stages-aw/0-bootstrap/README.md b/fast/stages-aw/0-bootstrap/README.md index 3615e4a65..babb90a5a 100644 --- a/fast/stages-aw/0-bootstrap/README.md +++ b/fast/stages-aw/0-bootstrap/README.md @@ -130,7 +130,7 @@ We are intentionally not supporting random prefix/suffixes for names, as that is What is implemented here is a fairly common convention, composed of tokens ordered by relative importance -- an Google Cloud Organization level static prefix less or equal to 9 characters (e.g. `myco` or `myco-gcp`) +- an Google Cloud Organization level static prefix less or equal to 7 characters (e.g. `myco` or `myco-gcp`) - an environment identifier (e.g. `prod`) - a team/owner identifier (e.g. `sec` for Security) - a context identifier (e.g. `core` or `kms`) @@ -380,7 +380,7 @@ The `fast_features` variable consists of 4 toggles | [billing_budget_amount](variables.tf#L44) | Budget configuration for the AW folder. Includes amount and optional threshold rules (defaults to 0.5, 0.75, 0.9). If null, no budget will be created. | object({…}) | | null | | [bootstrap_project](variables.tf#L44) | Bootstrap project ID. | string | ✓ | | | [organization](variables.tf#L260) | Organization details. | object({…}) | ✓ | | -| [prefix](variables.tf#L275) | Prefix used for resources that need unique names. Use 9 characters or less. | string | ✓ | | +| [prefix](variables.tf#L275) | Prefix used for resources that need unique names. Use 7 characters or less. | string | ✓ | | | [assured_workloads](variables.tf#L21) | Configuration for Assured Workloads. | object({…}) | | {…} | | [bootstrap_user](variables.tf#L49) | Email of the nominal user running this stage for the first time. | string | | null | | [cicd_repositories](variables.tf#L55) | CI/CD repository configuration. Identity providers reference keys in the `federated_identity_providers` variable. Set to null to disable, or set individual repositories to null if not needed. | object({…}) | | null | diff --git a/fast/stages-aw/0-bootstrap/outputs.tf b/fast/stages-aw/0-bootstrap/outputs.tf index d6608960b..64bc9e362 100644 --- a/fast/stages-aw/0-bootstrap/outputs.tf +++ b/fast/stages-aw/0-bootstrap/outputs.tf @@ -128,7 +128,7 @@ output "alert_email" { output "assured_workload" { description = "Assured Workload folder for the deployment." - value = var.assured_workloads.regime != "COMPLIANCE_REGIME_UNSPECIFIED" ? "folders/${google_assured_workloads_workload.primary[0].resources[0].resource_id}" : "folders/${module.no-compliance-folder[0].folder.id}" + value = var.assured_workloads.regime != "COMPLIANCE_REGIME_UNSPECIFIED" ? "folders/${google_assured_workloads_workload.primary[0].resources[0].resource_id}" : module.no-compliance-folder[0].id } output "automation" { diff --git a/fast/stages-aw/0-bootstrap/terraform.tfvars.sample b/fast/stages-aw/0-bootstrap/terraform.tfvars.sample index 4abe2f434..fb4b6779e 100644 --- a/fast/stages-aw/0-bootstrap/terraform.tfvars.sample +++ b/fast/stages-aw/0-bootstrap/terraform.tfvars.sample @@ -27,7 +27,7 @@ outputs_location = "~/fast-config" # Retention period (in days) for organization logging buckets (defaults to 365 days for compliance) # logging_bucket_retention = 365 -# use something unique and no longer than 9 characters +# use something unique and no longer than 7 characters prefix = "abcd" # Default log routing is set to "logging" (Cloud Logging buckets with 30-day default retention) # To use long-term storage, change type to "storage" (GCS) or "bigquery" diff --git a/fast/stages-aw/0-bootstrap/variables.tf b/fast/stages-aw/0-bootstrap/variables.tf index 54769f26e..c60d7aba4 100644 --- a/fast/stages-aw/0-bootstrap/variables.tf +++ b/fast/stages-aw/0-bootstrap/variables.tf @@ -50,6 +50,15 @@ variable "billing_budget_amount" { default = null } +variable "billing_override" { + description = "Optional billing override configuration. If set, disables service account impersonation for project billing linkage and runs under the user account using the specified quota projects." + type = object({ + project = string + billing_project = string + }) + default = null +} + variable "bootstrap_project" { description = "Bootstrap project ID." type = string @@ -295,7 +304,7 @@ variable "outputs_location" { } variable "prefix" { - description = "Prefix used for resources that need unique names. Use 9 characters or less." + description = "Prefix used for resources that need unique names. Use 7 characters or less." type = string validation { condition = try(length(var.prefix), 0) <= 7