From 685156c75e42f76af6347fffd21967e001ea1cbc Mon Sep 17 00:00:00 2001
From: The Magician <magic-modules@google.com>
Date: Wed, 9 Oct 2024 08:11:03 -0700
Subject: [PATCH] Add example of a Workload Identity Pool configuration for
 GitHub Actions (#11936) (#813)

[upstream:47f6ff1f4da285bf47ffbb0584a4cf476324f18e]

Signed-off-by: Modular Magician <magic-modules@google.com>
---
 .../backing_file.tf                           | 15 ++++
 .../main.tf                                   | 26 ++++++
 .../motd                                      |  7 ++
 .../tutorial.md                               | 79 +++++++++++++++++++
 4 files changed, 127 insertions(+)
 create mode 100644 iam_workload_identity_pool_provider_github_actions/backing_file.tf
 create mode 100644 iam_workload_identity_pool_provider_github_actions/main.tf
 create mode 100644 iam_workload_identity_pool_provider_github_actions/motd
 create mode 100644 iam_workload_identity_pool_provider_github_actions/tutorial.md

diff --git a/iam_workload_identity_pool_provider_github_actions/backing_file.tf b/iam_workload_identity_pool_provider_github_actions/backing_file.tf
new file mode 100644
index 00000000..c60b1199
--- /dev/null
+++ b/iam_workload_identity_pool_provider_github_actions/backing_file.tf
@@ -0,0 +1,15 @@
+# This file has some scaffolding to make sure that names are unique and that
+# a region and zone are selected when you try to create your Terraform resources.
+
+locals {
+  name_suffix = "${random_pet.suffix.id}"
+}
+
+resource "random_pet" "suffix" {
+  length = 2
+}
+
+provider "google" {
+  region = "us-central1"
+  zone   = "us-central1-c"
+}
diff --git a/iam_workload_identity_pool_provider_github_actions/main.tf b/iam_workload_identity_pool_provider_github_actions/main.tf
new file mode 100644
index 00000000..db5aaf17
--- /dev/null
+++ b/iam_workload_identity_pool_provider_github_actions/main.tf
@@ -0,0 +1,26 @@
+resource "google_iam_workload_identity_pool" "pool" {
+  workload_identity_pool_id = "example-pool-${local.name_suffix}"
+}
+
+resource "google_iam_workload_identity_pool_provider" "example" {
+  workload_identity_pool_id          = google_iam_workload_identity_pool.pool.workload_identity_pool_id
+  workload_identity_pool_provider_id = "example-prvdr-${local.name_suffix}"
+  display_name                       = "Name of provider"
+  description                        = "GitHub Actions identity pool provider for automated test"
+  disabled                           = true
+  attribute_condition = <<EOT
+    assertion.repository_owner_id == "123456789" &&
+    attribute.repository == "gh-org/gh-repo" &&
+    assertion.ref == "refs/heads/main" &&
+    assertion.ref_type == "branch"
+EOT
+  attribute_mapping = {
+    "google.subject"       = "assertion.sub"
+    "attribute.actor"      = "assertion.actor"
+    "attribute.aud"        = "assertion.aud"
+    "attribute.repository" = "assertion.repository"
+  }
+  oidc {
+    issuer_uri = "https://token.actions.githubusercontent.com"
+  }
+}
diff --git a/iam_workload_identity_pool_provider_github_actions/motd b/iam_workload_identity_pool_provider_github_actions/motd
new file mode 100644
index 00000000..45a906e8
--- /dev/null
+++ b/iam_workload_identity_pool_provider_github_actions/motd
@@ -0,0 +1,7 @@
+===
+
+These examples use real resources that will be billed to the
+Google Cloud Platform project you use - so make sure that you
+run "terraform destroy" before quitting!
+
+===
diff --git a/iam_workload_identity_pool_provider_github_actions/tutorial.md b/iam_workload_identity_pool_provider_github_actions/tutorial.md
new file mode 100644
index 00000000..aed9b545
--- /dev/null
+++ b/iam_workload_identity_pool_provider_github_actions/tutorial.md
@@ -0,0 +1,79 @@
+# Iam Workload Identity Pool Provider Github Actions - Terraform
+
+## Setup
+
+<walkthrough-author name="rileykarson@google.com" analyticsId="UA-125550242-1" tutorialName="iam_workload_identity_pool_provider_github_actions" repositoryUrl="https://github.com/terraform-google-modules/docs-examples"></walkthrough-author>
+
+Welcome to Terraform in Google Cloud Shell! We need you to let us know what project you'd like to use with Terraform.
+
+<walkthrough-project-billing-setup></walkthrough-project-billing-setup>
+
+Terraform provisions real GCP resources, so anything you create in this session will be billed against this project.
+
+## Terraforming!
+
+Let's use {{project-id}} with Terraform! Click the Cloud Shell icon below to copy the command
+to your shell, and then run it from the shell by pressing Enter/Return. Terraform will pick up
+the project name from the environment variable.
+
+```bash
+export GOOGLE_CLOUD_PROJECT={{project-id}}
+```
+
+After that, let's get Terraform started. Run the following to pull in the providers.
+
+```bash
+terraform init
+```
+
+With the providers downloaded and a project set, you're ready to use Terraform. Go ahead!
+
+```bash
+terraform apply
+```
+
+Terraform will show you what it plans to do, and prompt you to accept. Type "yes" to accept the plan.
+
+```bash
+yes
+```
+
+
+## Post-Apply
+
+### Editing your config
+
+Now you've provisioned your resources in GCP! If you run a "plan", you should see no changes needed.
+
+```bash
+terraform plan
+```
+
+So let's make a change! Try editing a number, or appending a value to the name in the editor. Then,
+run a 'plan' again.
+
+```bash
+terraform plan
+```
+
+Afterwards you can run an apply, which implicitly does a plan and shows you the intended changes
+at the 'yes' prompt.
+
+```bash
+terraform apply
+```
+
+```bash
+yes
+```
+
+## Cleanup
+
+Run the following to remove the resources Terraform provisioned:
+
+```bash
+terraform destroy
+```
+```bash
+yes
+```