feat: Add support for configuring pubsub object notifications

README.md

@@ -60,6 +60,7 @@ Functional examples are included in the
 | names | Bucket name suffixes. | list(string) | n/a | yes |
 | prefix | Prefix used to generate the bucket name. | string | n/a | yes |
 | project\_id | Bucket project id. | string | n/a | yes |
+| pubsub\_topics | Map of bucket=>topic to configure pubsub notifications. | map(string) | `<map>` | no |
 | set\_admin\_roles | Grant roles/storage.objectAdmin role to admins and bucket_admins. | bool | `"false"` | no |
 | set\_creator\_roles | Grant roles/storage.objectCreator role to creators and bucket_creators. | bool | `"false"` | no |
 | set\_viewer\_roles | Grant roles/storage.objectViewer role to viewers and bucket_viewers. | bool | `"false"` | no |

main.tf

@@ -123,3 +123,21 @@ resource "google_storage_bucket_iam_binding" "viewers" {
     ),
   )
 }
+
+locals {
+  bucket_names = zipmap(var.names, slice(google_storage_bucket.buckets[*].name, 0, length(var.names)))
+  notification_configs = {
+    for name, topic in var.pubsub_topics :
+    name => {
+      bucket = local.bucket_names[name]
+      topic  = topic
+    }
+  }
+}
+
+module "notifications" {
+  source = "./modules/notifications"
+
+  project_id     = var.project_id
+  bucket_configs = local.notification_configs
+}

modules/notifications/main.tf

@@ -0,0 +1,55 @@
+/**
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+locals {
+  # [for o in var.list : o.interfaces[0].name]
+  topics = [for o in var.bucket_configs : o.topic]
+}
+
+# Create the notifications
+resource "google_storage_notification" "notifications" {
+  for_each = var.bucket_configs
+
+  # project_id = var.project_id
+  bucket         = lookup(each.value, "bucket")
+  payload_format = "JSON_API_V1"
+
+  topic       = lookup(each.value, "topic")
+  event_types = var.event_types
+
+  depends_on = [module.pubsub-iam-bindings.members]
+}
+
+# Enable IAM
+data "google_storage_project_service_account" "gcs_account" {
+  project = var.project_id
+}
+
+module "pubsub-iam-bindings" {
+  source  = "terraform-google-modules/iam/google//modules/pubsub_topics_iam"
+  version = "~> 5.0"
+
+  project = var.project_id
+
+  pubsub_topics = local.topics
+  mode          = "additive"
+
+  bindings = {
+    "roles/pubsub.publisher" = [
+      "serviceAccount:${data.google_storage_project_service_account.gcs_account.email_address}"
+    ]
+  }
+}

modules/notifications/variables.tf

@@ -0,0 +1,35 @@
+/**
+ * Copyright 2018 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "project_id" {
+  description = "Bucket project id."
+  type        = string
+}
+
+variable "bucket_configs" {
+  type = map(object({
+    bucket = string
+    topic  = string
+  }))
+  description = "Map of buckets to the notification configs they should use."
+  default     = {}
+}
+
+variable "event_types" {
+  type        = list(string)
+  description = "Event types to configure notifications for. Default all."
+  default     = null
+}

outputs.tf

@@ -36,7 +36,7 @@ output "buckets" {
 
 output "names" {
   description = "Bucket names."
-  value       = zipmap(var.names, slice(google_storage_bucket.buckets[*].name, 0, length(var.names)))
+  value       = local.bucket_names
 }
 
 output "urls" {

variables.tf

@@ -138,3 +138,9 @@ variable "lifecycle_rules" {
   description = "List of lifecycle rules to configure. Format is the same as described in provider documentation https://www.terraform.io/docs/providers/google/r/storage_bucket.html#lifecycle_rule except condition.matches_storage_class should be a comma delimited string."
   default     = []
 }
+
+variable "pubsub_topics" {
+  type        = map(string)
+  description = "Map of bucket=>topic to configure pubsub notifications."
+  default     = {}
+}