@suss/terraform-gcp 0.31.2 → 0.33.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +22 -1
- package/dist/index.cjs +201 -3
- package/dist/index.js +201 -3
- package/package.json +3 -3
package/README.md
CHANGED
|
@@ -25,12 +25,25 @@ const summaries = terraformFileToSummaries("infra/terraform/monitoring", {
|
|
|
25
25
|
| --- | --- |
|
|
26
26
|
| `google_storage_bucket` | a store whose objects have no fields to compare against, under the name code passes to `bucket()` |
|
|
27
27
|
| `google_redis_instance` | a Redis store with no container to pair on; see below |
|
|
28
|
+
| `google_bigquery_dataset` | a BigQuery store; the dataset is a namespace rather than something a query addresses |
|
|
29
|
+
| `google_bigquery_table` | a BigQuery table in that dataset, with every column its `schema` states |
|
|
30
|
+
| `google_sql_database_instance` | a PostgreSQL, MySQL or SQL Server store, whichever its `database_version` picks; a version a variable supplies leaves the store with no engine on it |
|
|
31
|
+
| `google_spanner_database` | a Spanner store with no container to pair on |
|
|
32
|
+
| `google_firestore_database` | a Firestore store, when its `type` is `FIRESTORE_NATIVE` |
|
|
33
|
+
| `google_bigtable_table` | a Bigtable table, under the id code passes to `table()` |
|
|
34
|
+
| `google_pubsub_topic` | a channel |
|
|
35
|
+
| `google_pubsub_subscription` | a channel of its own, since a subscriber asks for the subscription |
|
|
28
36
|
| `google_logging_metric` | a metric, identified by the type Cloud Monitoring gives it, `logging.googleapis.com/user/<name>` |
|
|
29
37
|
| `google_monitoring_alert_policy` | one consumer of a metric per `condition_threshold`, identified by the `metric.type` its filter states |
|
|
38
|
+
| `google_cloud_run_v2_service` | a deployable per container, with that container's variables, secrets and image |
|
|
39
|
+
| `google_cloud_run_v2_job` | the same, with the containers one template deeper |
|
|
40
|
+
| `google_cloudfunctions2_function` | a deployable, with `service_config`'s variables and secrets and the entry point it calls |
|
|
30
41
|
|
|
31
42
|
Everything else a configuration declares is skipped.
|
|
32
43
|
|
|
33
|
-
A bucket pairs by name: `@suss/framework-gcs` records the bucket an access reaches, and the `name` attribute is the same string, so `suss check` compares the two sides. A Memorystore instance does not: code addresses Redis by key namespace, no attribute of the instance declares one, and a match on the instance's own name would be a coincidence, so the summary declares the store with no container name and the storage check claims no access for it. The `@suss/terraform-aws`
|
|
44
|
+
A bucket pairs by name: `@suss/framework-gcs` records the bucket an access reaches, and the `name` attribute is the same string, so `suss check` compares the two sides. A Memorystore instance does not: code addresses Redis by key namespace, no attribute of the instance declares one, and a match on the instance's own name would be a coincidence, so the summary declares the store with no container name and the storage check claims no access for it. The `@suss/terraform-aws` DESIGN walks through the same decision for ElastiCache. Spanner, Firestore and Cloud SQL are the same case: the tables or collections are inside the database, and nothing on the resource lists them.
|
|
45
|
+
|
|
46
|
+
A BigQuery table is the one resource here with a field contract, since a query against it reads named columns. A Cloud Run service, a job and a function each declare the environment their containers start with. A Pub/Sub topic and subscription pair with nothing yet, because no code pack records a publish or a subscribe. [What each entry decided](./DESIGN.md) says how each of those is read.
|
|
34
47
|
|
|
35
48
|
## The pair the provider refuses
|
|
36
49
|
|
|
@@ -70,6 +83,10 @@ A condition that states one of the percentile aligners is left alone, as is a co
|
|
|
70
83
|
- **A metric the platform publishes**, `run.googleapis.com/request_latencies` and everything like it, states its value type in Google's documentation rather than in any configuration. Judging a condition on one of those needs a catalog this does not ship.
|
|
71
84
|
- **A `BOOL`, `STRING`, or `MONEY` metric** is left out of the value-type table, because none of suss's words describe one, and a metric this pack says nothing about is compared against nothing.
|
|
72
85
|
- **`for_each` and `count`** state one block for many resources, and the reader takes the block as written.
|
|
86
|
+
- **`google_sql_database`**, the named database inside a Cloud SQL instance, states no engine of its own. Which store it is lives on the instance its `instance` attribute points at, and an entry has no way to read an attribute through a reference to another resource, so the database goes unread and the instance is what declares the store.
|
|
87
|
+
- **`google_monitoring_uptime_check_config`** is a probe rather than a reading: it makes its own requests on a schedule and publishes a result, so it never reads a metric type back and `checkMetric` has nothing to compare. It would fit a kind for a synthetic check, which suss does not have.
|
|
88
|
+
- **A Spanner database's `ddl`** statements state the tables, and reading SQL out of a Terraform attribute is a job for the SQL readers rather than for this pack.
|
|
89
|
+
- **A Firestore database in Datastore mode** speaks a different API from the Firestore one, so the entry's gate turns it down rather than reading it as something it may not be.
|
|
73
90
|
|
|
74
91
|
## How the identity is built
|
|
75
92
|
|
|
@@ -78,3 +95,7 @@ Cloud Monitoring puts every metric a project defines for itself under `logging.g
|
|
|
78
95
|
## Where it fits in suss
|
|
79
96
|
|
|
80
97
|
Depends on `@suss/contract-terraform` for the shape of an entry and on `@suss/behavioral-ir` for the words a translation table is allowed to use. The reader knows nothing about Google, and neither does the checker: Google's vocabulary starts and stops in the entries here.
|
|
98
|
+
|
|
99
|
+
## More
|
|
100
|
+
|
|
101
|
+
- [What each entry decided](./DESIGN.md), the provider versions it was written against, and the pages it came from
|
package/dist/index.cjs
CHANGED
|
@@ -26,6 +26,16 @@ __export(index_exports, {
|
|
|
26
26
|
module.exports = __toCommonJS(index_exports);
|
|
27
27
|
var CURRENT = ">=4 <8";
|
|
28
28
|
var METRIC_SYSTEM = "cloud-monitoring";
|
|
29
|
+
var BIGQUERY = "gcp.bigquery";
|
|
30
|
+
var SQL_VERSIONS = {
|
|
31
|
+
attribute: "database_version",
|
|
32
|
+
matches: "prefix",
|
|
33
|
+
means: {
|
|
34
|
+
POSTGRES_: "postgresql",
|
|
35
|
+
MYSQL_: "mysql",
|
|
36
|
+
SQLSERVER_: "mssql"
|
|
37
|
+
}
|
|
38
|
+
};
|
|
29
39
|
var VALUE_TYPES = {
|
|
30
40
|
INT64: "number",
|
|
31
41
|
DOUBLE: "number",
|
|
@@ -42,6 +52,33 @@ var ALIGNERS = {
|
|
|
42
52
|
ALIGN_PERCENTILE_50: "number",
|
|
43
53
|
ALIGN_PERCENTILE_05: "number"
|
|
44
54
|
};
|
|
55
|
+
var CONTAINER_ENV = {
|
|
56
|
+
style: "entries",
|
|
57
|
+
block: "env",
|
|
58
|
+
nameAttribute: "name",
|
|
59
|
+
valueAttribute: "value",
|
|
60
|
+
secretAttribute: "value_source.secret_key_ref.secret"
|
|
61
|
+
};
|
|
62
|
+
var CLOUD_RUN_SERVICE_ENV = [
|
|
63
|
+
"PORT",
|
|
64
|
+
"K_SERVICE",
|
|
65
|
+
"K_REVISION",
|
|
66
|
+
"K_CONFIGURATION"
|
|
67
|
+
];
|
|
68
|
+
var CLOUD_RUN_JOB_ENV = [
|
|
69
|
+
"CLOUD_RUN_JOB",
|
|
70
|
+
"CLOUD_RUN_EXECUTION",
|
|
71
|
+
"CLOUD_RUN_TASK_INDEX",
|
|
72
|
+
"CLOUD_RUN_TASK_ATTEMPT",
|
|
73
|
+
"CLOUD_RUN_TASK_COUNT"
|
|
74
|
+
];
|
|
75
|
+
var CLOUD_FUNCTION_ENV = [
|
|
76
|
+
"PORT",
|
|
77
|
+
"K_SERVICE",
|
|
78
|
+
"K_REVISION",
|
|
79
|
+
"FUNCTION_TARGET",
|
|
80
|
+
"FUNCTION_SIGNATURE_TYPE"
|
|
81
|
+
];
|
|
45
82
|
function googleTerraform() {
|
|
46
83
|
return {
|
|
47
84
|
name: "terraform-gcp",
|
|
@@ -60,6 +97,110 @@ function googleTerraform() {
|
|
|
60
97
|
fieldSet: "none"
|
|
61
98
|
}
|
|
62
99
|
},
|
|
100
|
+
{
|
|
101
|
+
resource: "google_bigquery_dataset",
|
|
102
|
+
providerVersions: CURRENT,
|
|
103
|
+
boundary: {
|
|
104
|
+
kind: "storage",
|
|
105
|
+
storageSystem: BIGQUERY,
|
|
106
|
+
// A dataset is the namespace a table is addressed through
|
|
107
|
+
// rather than something a query reads on its own.
|
|
108
|
+
declares: "store",
|
|
109
|
+
fieldSet: "none"
|
|
110
|
+
}
|
|
111
|
+
},
|
|
112
|
+
{
|
|
113
|
+
resource: "google_bigquery_table",
|
|
114
|
+
providerVersions: CURRENT,
|
|
115
|
+
boundary: {
|
|
116
|
+
kind: "storage",
|
|
117
|
+
storageSystem: BIGQUERY,
|
|
118
|
+
nameAttribute: "table_id",
|
|
119
|
+
scopeAttribute: "dataset_id",
|
|
120
|
+
// A schema written in the configuration is every column the
|
|
121
|
+
// table has; one a file or a variable supplies says nothing.
|
|
122
|
+
fieldSet: "none",
|
|
123
|
+
fieldsFromJson: {
|
|
124
|
+
attribute: "schema",
|
|
125
|
+
nameKey: "name",
|
|
126
|
+
typeKey: "type",
|
|
127
|
+
requires: { key: "mode", values: ["REQUIRED", "REPEATED"] }
|
|
128
|
+
}
|
|
129
|
+
}
|
|
130
|
+
},
|
|
131
|
+
{
|
|
132
|
+
resource: "google_spanner_database",
|
|
133
|
+
providerVersions: CURRENT,
|
|
134
|
+
boundary: {
|
|
135
|
+
kind: "storage",
|
|
136
|
+
storageSystem: "gcp.spanner",
|
|
137
|
+
// The tables are in the `ddl` statements rather than in an
|
|
138
|
+
// attribute, so the database declares the store and no more.
|
|
139
|
+
declares: "store",
|
|
140
|
+
fieldSet: "none"
|
|
141
|
+
}
|
|
142
|
+
},
|
|
143
|
+
{
|
|
144
|
+
resource: "google_firestore_database",
|
|
145
|
+
providerVersions: CURRENT,
|
|
146
|
+
// A database in Datastore mode speaks a different API, so it is
|
|
147
|
+
// not the store this entry describes.
|
|
148
|
+
appliesWhen: { attribute: "type", equals: ["FIRESTORE_NATIVE"] },
|
|
149
|
+
boundary: {
|
|
150
|
+
kind: "storage",
|
|
151
|
+
storageSystem: "gcp.firestore",
|
|
152
|
+
// Code addresses collections, which no attribute of the
|
|
153
|
+
// database lists.
|
|
154
|
+
declares: "store",
|
|
155
|
+
fieldSet: "none"
|
|
156
|
+
}
|
|
157
|
+
},
|
|
158
|
+
{
|
|
159
|
+
resource: "google_bigtable_table",
|
|
160
|
+
providerVersions: CURRENT,
|
|
161
|
+
boundary: {
|
|
162
|
+
kind: "storage",
|
|
163
|
+
storageSystem: "gcp.bigtable",
|
|
164
|
+
// A table id is what code passes to `instance.table()`, so
|
|
165
|
+
// the declared name and the accessed name meet.
|
|
166
|
+
nameAttribute: "name",
|
|
167
|
+
// Column families are not the fields of a row.
|
|
168
|
+
fieldSet: "none"
|
|
169
|
+
}
|
|
170
|
+
},
|
|
171
|
+
{
|
|
172
|
+
resource: "google_sql_database_instance",
|
|
173
|
+
providerVersions: CURRENT,
|
|
174
|
+
boundary: {
|
|
175
|
+
kind: "storage",
|
|
176
|
+
// Code addresses tables inside the database, which no
|
|
177
|
+
// attribute of the instance lists, so the entry declares the
|
|
178
|
+
// store and claims no access.
|
|
179
|
+
storageSystem: SQL_VERSIONS,
|
|
180
|
+
declares: "store",
|
|
181
|
+
fieldSet: "none"
|
|
182
|
+
}
|
|
183
|
+
},
|
|
184
|
+
{
|
|
185
|
+
resource: "google_pubsub_topic",
|
|
186
|
+
providerVersions: CURRENT,
|
|
187
|
+
boundary: {
|
|
188
|
+
kind: "message-bus",
|
|
189
|
+
messageBus: "gcp_pubsub",
|
|
190
|
+
nameAttribute: "name"
|
|
191
|
+
}
|
|
192
|
+
},
|
|
193
|
+
{
|
|
194
|
+
resource: "google_pubsub_subscription",
|
|
195
|
+
providerVersions: CURRENT,
|
|
196
|
+
boundary: {
|
|
197
|
+
kind: "message-bus",
|
|
198
|
+
messageBus: "gcp_pubsub",
|
|
199
|
+
// A subscriber asks for the subscription rather than the
|
|
200
|
+
// topic, so the subscription is its own channel.
|
|
201
|
+
nameAttribute: "name"
|
|
202
|
+
}
|
|
203
|
+
},
|
|
63
204
|
{
|
|
64
205
|
resource: "google_redis_instance",
|
|
65
206
|
providerVersions: CURRENT,
|
|
@@ -79,7 +220,6 @@ function googleTerraform() {
|
|
|
79
220
|
boundary: {
|
|
80
221
|
kind: "metric",
|
|
81
222
|
metricSystem: METRIC_SYSTEM,
|
|
82
|
-
nameAttribute: "name",
|
|
83
223
|
// Cloud Monitoring puts every metric a project defines for
|
|
84
224
|
// itself under this prefix, and an alert policy spells the
|
|
85
225
|
// whole string, so the whole string is the shared identity.
|
|
@@ -94,6 +234,61 @@ function googleTerraform() {
|
|
|
94
234
|
}
|
|
95
235
|
}
|
|
96
236
|
},
|
|
237
|
+
{
|
|
238
|
+
resource: "google_cloud_run_v2_service",
|
|
239
|
+
providerVersions: CURRENT,
|
|
240
|
+
boundary: {
|
|
241
|
+
kind: "deployable",
|
|
242
|
+
deploymentTarget: "container",
|
|
243
|
+
containers: { blocks: ["template", "containers"] },
|
|
244
|
+
env: [CONTAINER_ENV],
|
|
245
|
+
code: { imageAttribute: "image" },
|
|
246
|
+
platformEnvVars: CLOUD_RUN_SERVICE_ENV
|
|
247
|
+
}
|
|
248
|
+
},
|
|
249
|
+
{
|
|
250
|
+
resource: "google_cloud_run_v2_job",
|
|
251
|
+
providerVersions: CURRENT,
|
|
252
|
+
boundary: {
|
|
253
|
+
kind: "deployable",
|
|
254
|
+
deploymentTarget: "container",
|
|
255
|
+
// A job's containers sit one template deeper than a
|
|
256
|
+
// service's: an execution template around a task template.
|
|
257
|
+
containers: { blocks: ["template", "template", "containers"] },
|
|
258
|
+
env: [CONTAINER_ENV],
|
|
259
|
+
code: { imageAttribute: "image" },
|
|
260
|
+
platformEnvVars: CLOUD_RUN_JOB_ENV
|
|
261
|
+
}
|
|
262
|
+
},
|
|
263
|
+
{
|
|
264
|
+
resource: "google_cloudfunctions2_function",
|
|
265
|
+
providerVersions: CURRENT,
|
|
266
|
+
boundary: {
|
|
267
|
+
kind: "deployable",
|
|
268
|
+
// A second-generation function is deployed as a Cloud Run
|
|
269
|
+
// service, so it runs on the same medium as one.
|
|
270
|
+
deploymentTarget: "container",
|
|
271
|
+
runtimeAttribute: "build_config.runtime",
|
|
272
|
+
env: [
|
|
273
|
+
{ style: "map", attribute: "service_config.environment_variables" },
|
|
274
|
+
{
|
|
275
|
+
style: "entries",
|
|
276
|
+
block: "service_config.secret_environment_variables",
|
|
277
|
+
nameAttribute: "key",
|
|
278
|
+
secretAttribute: "secret"
|
|
279
|
+
}
|
|
280
|
+
],
|
|
281
|
+
// The entry point is an exported name and says nothing about
|
|
282
|
+
// which file it is in.
|
|
283
|
+
code: {
|
|
284
|
+
handler: {
|
|
285
|
+
attribute: "build_config.entry_point",
|
|
286
|
+
spelling: "name"
|
|
287
|
+
}
|
|
288
|
+
},
|
|
289
|
+
platformEnvVars: CLOUD_FUNCTION_ENV
|
|
290
|
+
}
|
|
291
|
+
},
|
|
97
292
|
{
|
|
98
293
|
resource: "google_monitoring_alert_policy",
|
|
99
294
|
providerVersions: CURRENT,
|
|
@@ -101,8 +296,11 @@ function googleTerraform() {
|
|
|
101
296
|
kind: "metric-reading",
|
|
102
297
|
metricSystem: METRIC_SYSTEM,
|
|
103
298
|
readingBlocks: ["conditions", "condition_threshold"],
|
|
104
|
-
|
|
105
|
-
|
|
299
|
+
identifies: {
|
|
300
|
+
from: "query",
|
|
301
|
+
attribute: "filter",
|
|
302
|
+
key: "metric.type"
|
|
303
|
+
},
|
|
106
304
|
comparesTo: { attribute: "threshold_value", whenSet: "number" },
|
|
107
305
|
reducesTo: {
|
|
108
306
|
attribute: "aggregations.per_series_aligner",
|
package/dist/index.js
CHANGED
|
@@ -1,6 +1,16 @@
|
|
|
1
1
|
// src/index.ts
|
|
2
2
|
var CURRENT = ">=4 <8";
|
|
3
3
|
var METRIC_SYSTEM = "cloud-monitoring";
|
|
4
|
+
var BIGQUERY = "gcp.bigquery";
|
|
5
|
+
var SQL_VERSIONS = {
|
|
6
|
+
attribute: "database_version",
|
|
7
|
+
matches: "prefix",
|
|
8
|
+
means: {
|
|
9
|
+
POSTGRES_: "postgresql",
|
|
10
|
+
MYSQL_: "mysql",
|
|
11
|
+
SQLSERVER_: "mssql"
|
|
12
|
+
}
|
|
13
|
+
};
|
|
4
14
|
var VALUE_TYPES = {
|
|
5
15
|
INT64: "number",
|
|
6
16
|
DOUBLE: "number",
|
|
@@ -17,6 +27,33 @@ var ALIGNERS = {
|
|
|
17
27
|
ALIGN_PERCENTILE_50: "number",
|
|
18
28
|
ALIGN_PERCENTILE_05: "number"
|
|
19
29
|
};
|
|
30
|
+
var CONTAINER_ENV = {
|
|
31
|
+
style: "entries",
|
|
32
|
+
block: "env",
|
|
33
|
+
nameAttribute: "name",
|
|
34
|
+
valueAttribute: "value",
|
|
35
|
+
secretAttribute: "value_source.secret_key_ref.secret"
|
|
36
|
+
};
|
|
37
|
+
var CLOUD_RUN_SERVICE_ENV = [
|
|
38
|
+
"PORT",
|
|
39
|
+
"K_SERVICE",
|
|
40
|
+
"K_REVISION",
|
|
41
|
+
"K_CONFIGURATION"
|
|
42
|
+
];
|
|
43
|
+
var CLOUD_RUN_JOB_ENV = [
|
|
44
|
+
"CLOUD_RUN_JOB",
|
|
45
|
+
"CLOUD_RUN_EXECUTION",
|
|
46
|
+
"CLOUD_RUN_TASK_INDEX",
|
|
47
|
+
"CLOUD_RUN_TASK_ATTEMPT",
|
|
48
|
+
"CLOUD_RUN_TASK_COUNT"
|
|
49
|
+
];
|
|
50
|
+
var CLOUD_FUNCTION_ENV = [
|
|
51
|
+
"PORT",
|
|
52
|
+
"K_SERVICE",
|
|
53
|
+
"K_REVISION",
|
|
54
|
+
"FUNCTION_TARGET",
|
|
55
|
+
"FUNCTION_SIGNATURE_TYPE"
|
|
56
|
+
];
|
|
20
57
|
function googleTerraform() {
|
|
21
58
|
return {
|
|
22
59
|
name: "terraform-gcp",
|
|
@@ -35,6 +72,110 @@ function googleTerraform() {
|
|
|
35
72
|
fieldSet: "none"
|
|
36
73
|
}
|
|
37
74
|
},
|
|
75
|
+
{
|
|
76
|
+
resource: "google_bigquery_dataset",
|
|
77
|
+
providerVersions: CURRENT,
|
|
78
|
+
boundary: {
|
|
79
|
+
kind: "storage",
|
|
80
|
+
storageSystem: BIGQUERY,
|
|
81
|
+
// A dataset is the namespace a table is addressed through
|
|
82
|
+
// rather than something a query reads on its own.
|
|
83
|
+
declares: "store",
|
|
84
|
+
fieldSet: "none"
|
|
85
|
+
}
|
|
86
|
+
},
|
|
87
|
+
{
|
|
88
|
+
resource: "google_bigquery_table",
|
|
89
|
+
providerVersions: CURRENT,
|
|
90
|
+
boundary: {
|
|
91
|
+
kind: "storage",
|
|
92
|
+
storageSystem: BIGQUERY,
|
|
93
|
+
nameAttribute: "table_id",
|
|
94
|
+
scopeAttribute: "dataset_id",
|
|
95
|
+
// A schema written in the configuration is every column the
|
|
96
|
+
// table has; one a file or a variable supplies says nothing.
|
|
97
|
+
fieldSet: "none",
|
|
98
|
+
fieldsFromJson: {
|
|
99
|
+
attribute: "schema",
|
|
100
|
+
nameKey: "name",
|
|
101
|
+
typeKey: "type",
|
|
102
|
+
requires: { key: "mode", values: ["REQUIRED", "REPEATED"] }
|
|
103
|
+
}
|
|
104
|
+
}
|
|
105
|
+
},
|
|
106
|
+
{
|
|
107
|
+
resource: "google_spanner_database",
|
|
108
|
+
providerVersions: CURRENT,
|
|
109
|
+
boundary: {
|
|
110
|
+
kind: "storage",
|
|
111
|
+
storageSystem: "gcp.spanner",
|
|
112
|
+
// The tables are in the `ddl` statements rather than in an
|
|
113
|
+
// attribute, so the database declares the store and no more.
|
|
114
|
+
declares: "store",
|
|
115
|
+
fieldSet: "none"
|
|
116
|
+
}
|
|
117
|
+
},
|
|
118
|
+
{
|
|
119
|
+
resource: "google_firestore_database",
|
|
120
|
+
providerVersions: CURRENT,
|
|
121
|
+
// A database in Datastore mode speaks a different API, so it is
|
|
122
|
+
// not the store this entry describes.
|
|
123
|
+
appliesWhen: { attribute: "type", equals: ["FIRESTORE_NATIVE"] },
|
|
124
|
+
boundary: {
|
|
125
|
+
kind: "storage",
|
|
126
|
+
storageSystem: "gcp.firestore",
|
|
127
|
+
// Code addresses collections, which no attribute of the
|
|
128
|
+
// database lists.
|
|
129
|
+
declares: "store",
|
|
130
|
+
fieldSet: "none"
|
|
131
|
+
}
|
|
132
|
+
},
|
|
133
|
+
{
|
|
134
|
+
resource: "google_bigtable_table",
|
|
135
|
+
providerVersions: CURRENT,
|
|
136
|
+
boundary: {
|
|
137
|
+
kind: "storage",
|
|
138
|
+
storageSystem: "gcp.bigtable",
|
|
139
|
+
// A table id is what code passes to `instance.table()`, so
|
|
140
|
+
// the declared name and the accessed name meet.
|
|
141
|
+
nameAttribute: "name",
|
|
142
|
+
// Column families are not the fields of a row.
|
|
143
|
+
fieldSet: "none"
|
|
144
|
+
}
|
|
145
|
+
},
|
|
146
|
+
{
|
|
147
|
+
resource: "google_sql_database_instance",
|
|
148
|
+
providerVersions: CURRENT,
|
|
149
|
+
boundary: {
|
|
150
|
+
kind: "storage",
|
|
151
|
+
// Code addresses tables inside the database, which no
|
|
152
|
+
// attribute of the instance lists, so the entry declares the
|
|
153
|
+
// store and claims no access.
|
|
154
|
+
storageSystem: SQL_VERSIONS,
|
|
155
|
+
declares: "store",
|
|
156
|
+
fieldSet: "none"
|
|
157
|
+
}
|
|
158
|
+
},
|
|
159
|
+
{
|
|
160
|
+
resource: "google_pubsub_topic",
|
|
161
|
+
providerVersions: CURRENT,
|
|
162
|
+
boundary: {
|
|
163
|
+
kind: "message-bus",
|
|
164
|
+
messageBus: "gcp_pubsub",
|
|
165
|
+
nameAttribute: "name"
|
|
166
|
+
}
|
|
167
|
+
},
|
|
168
|
+
{
|
|
169
|
+
resource: "google_pubsub_subscription",
|
|
170
|
+
providerVersions: CURRENT,
|
|
171
|
+
boundary: {
|
|
172
|
+
kind: "message-bus",
|
|
173
|
+
messageBus: "gcp_pubsub",
|
|
174
|
+
// A subscriber asks for the subscription rather than the
|
|
175
|
+
// topic, so the subscription is its own channel.
|
|
176
|
+
nameAttribute: "name"
|
|
177
|
+
}
|
|
178
|
+
},
|
|
38
179
|
{
|
|
39
180
|
resource: "google_redis_instance",
|
|
40
181
|
providerVersions: CURRENT,
|
|
@@ -54,7 +195,6 @@ function googleTerraform() {
|
|
|
54
195
|
boundary: {
|
|
55
196
|
kind: "metric",
|
|
56
197
|
metricSystem: METRIC_SYSTEM,
|
|
57
|
-
nameAttribute: "name",
|
|
58
198
|
// Cloud Monitoring puts every metric a project defines for
|
|
59
199
|
// itself under this prefix, and an alert policy spells the
|
|
60
200
|
// whole string, so the whole string is the shared identity.
|
|
@@ -69,6 +209,61 @@ function googleTerraform() {
|
|
|
69
209
|
}
|
|
70
210
|
}
|
|
71
211
|
},
|
|
212
|
+
{
|
|
213
|
+
resource: "google_cloud_run_v2_service",
|
|
214
|
+
providerVersions: CURRENT,
|
|
215
|
+
boundary: {
|
|
216
|
+
kind: "deployable",
|
|
217
|
+
deploymentTarget: "container",
|
|
218
|
+
containers: { blocks: ["template", "containers"] },
|
|
219
|
+
env: [CONTAINER_ENV],
|
|
220
|
+
code: { imageAttribute: "image" },
|
|
221
|
+
platformEnvVars: CLOUD_RUN_SERVICE_ENV
|
|
222
|
+
}
|
|
223
|
+
},
|
|
224
|
+
{
|
|
225
|
+
resource: "google_cloud_run_v2_job",
|
|
226
|
+
providerVersions: CURRENT,
|
|
227
|
+
boundary: {
|
|
228
|
+
kind: "deployable",
|
|
229
|
+
deploymentTarget: "container",
|
|
230
|
+
// A job's containers sit one template deeper than a
|
|
231
|
+
// service's: an execution template around a task template.
|
|
232
|
+
containers: { blocks: ["template", "template", "containers"] },
|
|
233
|
+
env: [CONTAINER_ENV],
|
|
234
|
+
code: { imageAttribute: "image" },
|
|
235
|
+
platformEnvVars: CLOUD_RUN_JOB_ENV
|
|
236
|
+
}
|
|
237
|
+
},
|
|
238
|
+
{
|
|
239
|
+
resource: "google_cloudfunctions2_function",
|
|
240
|
+
providerVersions: CURRENT,
|
|
241
|
+
boundary: {
|
|
242
|
+
kind: "deployable",
|
|
243
|
+
// A second-generation function is deployed as a Cloud Run
|
|
244
|
+
// service, so it runs on the same medium as one.
|
|
245
|
+
deploymentTarget: "container",
|
|
246
|
+
runtimeAttribute: "build_config.runtime",
|
|
247
|
+
env: [
|
|
248
|
+
{ style: "map", attribute: "service_config.environment_variables" },
|
|
249
|
+
{
|
|
250
|
+
style: "entries",
|
|
251
|
+
block: "service_config.secret_environment_variables",
|
|
252
|
+
nameAttribute: "key",
|
|
253
|
+
secretAttribute: "secret"
|
|
254
|
+
}
|
|
255
|
+
],
|
|
256
|
+
// The entry point is an exported name and says nothing about
|
|
257
|
+
// which file it is in.
|
|
258
|
+
code: {
|
|
259
|
+
handler: {
|
|
260
|
+
attribute: "build_config.entry_point",
|
|
261
|
+
spelling: "name"
|
|
262
|
+
}
|
|
263
|
+
},
|
|
264
|
+
platformEnvVars: CLOUD_FUNCTION_ENV
|
|
265
|
+
}
|
|
266
|
+
},
|
|
72
267
|
{
|
|
73
268
|
resource: "google_monitoring_alert_policy",
|
|
74
269
|
providerVersions: CURRENT,
|
|
@@ -76,8 +271,11 @@ function googleTerraform() {
|
|
|
76
271
|
kind: "metric-reading",
|
|
77
272
|
metricSystem: METRIC_SYSTEM,
|
|
78
273
|
readingBlocks: ["conditions", "condition_threshold"],
|
|
79
|
-
|
|
80
|
-
|
|
274
|
+
identifies: {
|
|
275
|
+
from: "query",
|
|
276
|
+
attribute: "filter",
|
|
277
|
+
key: "metric.type"
|
|
278
|
+
},
|
|
81
279
|
comparesTo: { attribute: "threshold_value", whenSet: "number" },
|
|
82
280
|
reducesTo: {
|
|
83
281
|
attribute: "aggregations.per_series_aligner",
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@suss/terraform-gcp",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.33.0",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"description": "What the Google Cloud Terraform provider declares, so suss can check your code against the infrastructure you deploy.",
|
|
6
6
|
"keywords": [
|
|
@@ -47,8 +47,8 @@
|
|
|
47
47
|
"typecheck": "tsc --noEmit"
|
|
48
48
|
},
|
|
49
49
|
"dependencies": {
|
|
50
|
-
"@suss/behavioral-ir": "0.
|
|
51
|
-
"@suss/contract-terraform": "0.
|
|
50
|
+
"@suss/behavioral-ir": "0.33.0",
|
|
51
|
+
"@suss/contract-terraform": "0.33.0"
|
|
52
52
|
},
|
|
53
53
|
"devDependencies": {
|
|
54
54
|
"@suss/checker": "*",
|