{"id":13491199,"url":"https://github.com/terraform-google-modules/terraform-google-bootstrap","last_synced_at":"2025-11-09T08:30:32.840Z","repository":{"id":37252427,"uuid":"204996581","full_name":"terraform-google-modules/terraform-google-bootstrap","owner":"terraform-google-modules","description":"Bootstraps Terraform usage and related CI/CD in a new Google Cloud organization","archived":false,"fork":false,"pushed_at":"2025-02-11T00:26:13.000Z","size":1179,"stargazers_count":215,"open_issues_count":8,"forks_count":147,"subscribers_count":39,"default_branch":"main","last_synced_at":"2025-02-11T01:25:00.718Z","etag":null,"topics":["cft-terraform","developer-tools","operations"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/terraform-google-modules/bootstrap/google","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/terraform-google-modules.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-08-28T18:22:57.000Z","updated_at":"2025-02-05T10:45:27.000Z","dependencies_parsed_at":"2023-11-06T08:24:19.297Z","dependency_job_id":"1b01f458-2fc1-4798-b314-0a3cf8985d1b","html_url":"https://github.com/terraform-google-modules/terraform-google-bootstrap","commit_stats":null,"previous_names":[],"tags_count":45,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-google-modules%2Fterraform-google-bootstrap","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-google-modules%2Fterraform-google-bootstrap/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-google-modules%2Fterraform-google-bootstrap/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-google-modules%2Fterraform-google-bootstrap/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/terraform-google-modules","download_url":"https://codeload.github.com/terraform-google-modules/terraform-google-bootstrap/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239571542,"owners_count":19661164,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cft-terraform","developer-tools","operations"],"created_at":"2024-07-31T19:00:54.486Z","updated_at":"2025-11-09T08:30:32.808Z","avatar_url":"https://github.com/terraform-google-modules.png","language":"HCL","funding_links":[],"categories":["HCL"],"sub_categories":[],"readme":"# terraform-google-bootstrap\n\nThe purpose of this module is to help bootstrap a GCP organization, creating all the required GCP resources \u0026 permissions to start using the Cloud Foundation Toolkit (CFT). For users who want to use Cloud Build \u0026 Cloud Source Repos for foundations code, there is also a submodule to help bootstrap all the required resources to do this.\n\n## Usage\n\nBasic usage of this module is as follows:\n\n```hcl\nmodule \"bootstrap\" {\n  source  = \"terraform-google-modules/bootstrap/google\"\n  version = \"~\u003e 11.0\"\n\n  org_id               = \"\u003cORGANIZATION_ID\u003e\"\n  billing_account      = \"\u003cBILLING_ACCOUNT_ID\u003e\"\n  group_org_admins     = \"gcp-organization-admins@example.com\"\n  group_billing_admins = \"gcp-billing-admins@example.com\"\n  default_region       = \"australia-southeast1\"\n}\n```\n\nFunctional examples are included in the\n[examples](./examples/) directory.\n\n## Features\n\nThe Organization Bootstrap module will take the following actions:\n\n1. Create a new GCP seed project using `project_prefix`. Use `project_id` if you need to use custom project ID.\n1. Enable APIs in the seed project using `activate_apis`\n1. Create a new service account for terraform in seed project\n1. Create GCS bucket for Terraform state and grant access to service account\n1. Grant IAM permissions required for CFT modules \u0026 Organization setup\n    1. Overwrite organization wide project creator and billing account creator roles\n    1. Grant Organization permissions to service account using `sa_org_iam_permissions`\n    1. Grant access to billing account for service account\n    1. Grant Organization permissions to `group_org_admins` using `org_admins_org_iam_permissions`\n    1. Grant billing permissions to `group_billing_admins`\n    1. (optional) Permissions required for service account impersonation using `sa_enable_impersonation`\n\nFor the cloudbuild submodule, see the README [cloudbuild](./modules/cloudbuild).\n\n\n\u003c!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| activate\\_apis | List of APIs to enable in the seed project. | `list(string)` | \u003cpre\u003e[\u003cbr\u003e  \"serviceusage.googleapis.com\",\u003cbr\u003e  \"servicenetworking.googleapis.com\",\u003cbr\u003e  \"compute.googleapis.com\",\u003cbr\u003e  \"logging.googleapis.com\",\u003cbr\u003e  \"bigquery.googleapis.com\",\u003cbr\u003e  \"cloudresourcemanager.googleapis.com\",\u003cbr\u003e  \"cloudbilling.googleapis.com\",\u003cbr\u003e  \"iam.googleapis.com\",\u003cbr\u003e  \"admin.googleapis.com\",\u003cbr\u003e  \"appengine.googleapis.com\",\u003cbr\u003e  \"storage-api.googleapis.com\",\u003cbr\u003e  \"monitoring.googleapis.com\"\u003cbr\u003e]\u003c/pre\u003e | no |\n| billing\\_account | The ID of the billing account to associate projects with. | `string` | n/a | yes |\n| create\\_terraform\\_sa | If the Terraform service account should be created. | `bool` | `true` | no |\n| default\\_region | Default region to create resources where applicable. | `string` | `\"us-central1\"` | no |\n| encrypt\\_gcs\\_bucket\\_tfstate | Encrypt bucket used for storing terraform state files in seed project. | `bool` | `false` | no |\n| folder\\_id | The ID of a folder to host this project | `string` | `\"\"` | no |\n| force\\_destroy | If supplied, the state bucket will be deleted even while containing objects. | `bool` | `false` | no |\n| grant\\_billing\\_user | Grant roles/billing.user role to CFT service account | `bool` | `true` | no |\n| group\\_billing\\_admins | Google Group for GCP Billing Administrators | `string` | n/a | yes |\n| group\\_org\\_admins | Google Group for GCP Organization Administrators | `string` | n/a | yes |\n| key\\_protection\\_level | The protection level to use when creating a version based on this template. Default value: \"SOFTWARE\" Possible values: [\"SOFTWARE\", \"HSM\"] | `string` | `\"SOFTWARE\"` | no |\n| key\\_rotation\\_period | The rotation period of the key. | `string` | `null` | no |\n| kms\\_prevent\\_destroy | Set the prevent\\_destroy lifecycle attribute on keys. | `bool` | `true` | no |\n| org\\_admins\\_org\\_iam\\_permissions | List of permissions granted to the group supplied in group\\_org\\_admins variable across the GCP organization. | `list(string)` | \u003cpre\u003e[\u003cbr\u003e  \"roles/billing.user\",\u003cbr\u003e  \"roles/resourcemanager.organizationAdmin\"\u003cbr\u003e]\u003c/pre\u003e | no |\n| org\\_id | GCP Organization ID | `string` | n/a | yes |\n| org\\_project\\_creators | Additional list of members to have project creator role accross the organization. Prefix of group: user: or serviceAccount: is required. | `list(string)` | `[]` | no |\n| parent\\_folder | GCP parent folder ID in the form folders/{id} | `string` | `\"\"` | no |\n| project\\_auto\\_create\\_network | Create the default network for the project created. | `bool` | `false` | no |\n| project\\_deletion\\_policy | The deletion policy for the project created. | `string` | `\"PREVENT\"` | no |\n| project\\_id | Custom project ID to use for project created. If not supplied, the default id is {project\\_prefix}-seed-{random suffix}. | `string` | `\"\"` | no |\n| project\\_labels | Labels to apply to the project. | `map(string)` | `{}` | no |\n| project\\_prefix | Name prefix to use for projects created. | `string` | `\"cft\"` | no |\n| random\\_suffix | Appends a 4 character random suffix to project ID and GCS bucket name. | `bool` | `true` | no |\n| sa\\_enable\\_impersonation | Allow org\\_admins group to impersonate service account \u0026 enable APIs required. | `bool` | `false` | no |\n| sa\\_org\\_iam\\_permissions | List of permissions granted to Terraform service account across the GCP organization. | `list(string)` | \u003cpre\u003e[\u003cbr\u003e  \"roles/billing.user\",\u003cbr\u003e  \"roles/compute.networkAdmin\",\u003cbr\u003e  \"roles/compute.xpnAdmin\",\u003cbr\u003e  \"roles/iam.securityAdmin\",\u003cbr\u003e  \"roles/iam.serviceAccountAdmin\",\u003cbr\u003e  \"roles/logging.configWriter\",\u003cbr\u003e  \"roles/orgpolicy.policyAdmin\",\u003cbr\u003e  \"roles/resourcemanager.folderAdmin\",\u003cbr\u003e  \"roles/resourcemanager.organizationViewer\"\u003cbr\u003e]\u003c/pre\u003e | no |\n| state\\_bucket\\_name | Custom state bucket name. If not supplied, the default name is {project\\_prefix}-tfstate-{random suffix}. | `string` | `\"\"` | no |\n| storage\\_bucket\\_labels | Labels to apply to the storage bucket. | `map(string)` | `{}` | no |\n| tf\\_service\\_account\\_id | ID of service account for terraform in seed project | `string` | `\"org-terraform\"` | no |\n| tf\\_service\\_account\\_name | Display name of service account for terraform in seed project | `string` | `\"CFT Organization Terraform Account\"` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| gcs\\_bucket\\_tfstate | Bucket used for storing terraform state for foundations pipelines in seed project. |\n| seed\\_project\\_id | Project where service accounts and core APIs will be enabled. |\n| terraform\\_sa\\_email | Email for privileged service account for Terraform. |\n| terraform\\_sa\\_name | Fully qualified name for privileged service account for Terraform. |\n\n\u003c!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n\n## Requirements\n\n### Software\n\n-   [gcloud sdk](https://cloud.google.com/sdk/install) \u003e= 206.0.0\n-   [Terraform](https://www.terraform.io/downloads.html) \u003e= 1.3\n-   [terraform-provider-google] plugin 3.50.x\n\n### Permissions\n\n- `roles/resourcemanager.organizationAdmin` on GCP Organization\n- `roles/orgpolicy.policyAdmin` on GCP Organization\n- `roles/billing.admin` on supplied billing account\n- Account running terraform should be a member of group provided in `group_org_admins` variable, otherwise they will loose `roles/resourcemanager.projectCreator` access. Additional members can be added by using the `org_project_creators` variable.\n\n### Credentials\n\nFor users interested in using service account impersonation which this module helps enable with `sa_enable_impersonation`, please see this [blog post](https://cloud.google.com/blog/topics/developers-practitioners/using-google-cloud-service-account-impersonation-your-terraform-code) which explains how it works.\n\n### APIs\n\nA project with the following APIs enabled must be used to host the\nresources of this module:\n\n- Google Cloud Resource Manager API: `cloudresourcemanager.googleapis.com`\n- Google Cloud Billing API: `cloudbilling.googleapis.com`\n- Google Cloud IAM API: `iam.googleapis.com`\n- Google Cloud Storage API `storage-api.googleapis.com`\n- Google Cloud Service Usage API: `serviceusage.googleapis.com`\n\nThis API can be enabled in the default project created during establishing an organization.\n\n## Contributing\n\nRefer to the [contribution guidelines](./CONTRIBUTING.md) for\ninformation on contributing to this module.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fterraform-google-modules%2Fterraform-google-bootstrap","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fterraform-google-modules%2Fterraform-google-bootstrap","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fterraform-google-modules%2Fterraform-google-bootstrap/lists"}