GCE based IaaS rosetta terraform red/blue team testing

[obriensystems]

michael@cloudshell:~/wse_github/ObrienlabsDev/gcp-infrastructure-as-code/m20-terraform-change-sandbox (ops-cicd-old)$ terraform apply -var-file=override.tfvars -auto-approve

[obriensystems]

subfolders can be renamed in place (id stays the same) - not affecting projects/vms below

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # google_folder.subfolder will be updated in-place
  ~ resource "google_folder" "subfolder" {
      ~ display_name            = "subfolder2" -> "subfolder"
        id                      = "folders/266445081749"
        name                    = "folders/266445081749"
        # (6 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

c16af2b

[obriensystems]

Add organization Policy constraint on a project - override parent

resource "google_org_policy_policy" "resource_locations" {
  # either on the project or super folder
  #name = "projects/${google_project.this.number}/policies/gcp.resourceLocations"
  #parent = "projects/${google_project.this.number}"
  name = "folders/${google_folder.subfolder.folder_id}/policies/gcp.resourceLocations"
  parent = "folders/${google_folder.subfolder.folder_id}"

  spec {
    #rules {
      # `allow_all`, `deny_all`, or `values` for list policies
      # This example denies all locations by default
     # deny_all = "TRUE"
    #}
    
    rules {
      values {
        allowed_values = [
          "in:northamerica-northeast1-locations",
          "in:northamerica-northeast2-locations",
          "in:us-east1-locations"
        ]
      }
    }
  }
  depends_on = [google_project.this]
}