TerraformでCloud Spannerを構築するサンプルコードを書いてみた

# Requirements
terraform {
  required_version = "1.3.4"

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "4.46.0"
    }
  }
}

# デフォルトのプロバイダー設定
provider "google" {
  project = var.project_id
  region  = "asia-northeast1"
  zone    = "asia-northeast1-b"
}

# asia1マルチリージョンのSpannerインスタンス定義
resource "google_spanner_instance" "sample" {
  display_name     = "my-sample-spanner" # 4-30 characters
  config           = "asia1"
  processing_units = 100                 # 1000 == 1 node
  force_destroy    = var.force_destry_enabled ? true : false
}

# Google Standard SQL言語ベースのデータベース定義
resource "google_spanner_database" "google" {
  instance                 = google_spanner_instance.sample.id
  name                     = "my-googlesql-db" # 2-30 characters
  database_dialect         = "GOOGLE_STANDARD_SQL"
  version_retention_period = "3d" # Default 1h, Max 7d
  deletion_protection      = var.deletion_protection_enabled ? true : false
}

# PostgreSQL言語ベースのデータベース定義
resource "google_spanner_database" "postgre" {
  instance                 = google_spanner_instance.sample.id
  name                     = "my-postgresql-db" # 2-30 characters
  database_dialect         = "POSTGRESQL"
  version_retention_period = "24h" # Default 1h, Max 7d
  deletion_protection      = var.deletion_protection_enabled ? true : false
}

# Cloud KMSで管理する顧客管理暗号鍵(CMEK)で暗号化したデータベース定義
resource "google_spanner_database" "google" {
  instance                 = google_spanner_instance.sample[0].name
  name                     = "my-cmek-encrypted-db" # 2-30 characters
  database_dialect         = "GOOGLE_STANDARD_SQL"
  version_retention_period = "3d"

  encryption_config {
    kms_key_name = data.google_kms_crypto_key.spanner.id
  }

  deletion_protection = var.deletion_protection_enabled ? true : false
}

# Cloud KMSで管理する顧客管理暗号鍵(CMEK)を利用するための権限付与
resource "google_kms_crypto_key_iam_member" "crypto_key" {
  crypto_key_id = data.google_kms_crypto_key.spanner.id
  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  member        = "serviceAccount:service-${data.google_project.this.number}@gcp-sa-spanner.iam.gserviceaccount.com"
}

# プロジェクトリソース取得
data "google_project" "this" {}

# キーリングリソース取得
data "google_kms_key_ring" "asia1" {
  name     = var.gcp_kms_keyring_name
  location = "asia1"
}

# 暗号化キーリソース取得
data "google_kms_crypto_key" "spanner" {
  name     = var.gcp_kms_key_nameGoogle
  key_ring = data.google_kms_key_ring.asia1.id
}