如何修改Terraform代码实现带IAM条件的GCP组织权限绑定

1. 定义new变量结构 #

先明确包含角色与对应IAM条件的变量结构，示例如下：

variable "new" {
  type = map(object({
    roles = list(object({
      role       = string
      condition = object({
        title       = string
        description = string
        expression  = string
      })
    }))
  }))
  default = {
    "group:dev@example.com" = {
      roles = [
        {
          role = "roles/cloudfunctions.developer"
          condition = {
            title       = "AllowWeekdayAccess"
            description = "仅允许工作日访问"
            expression  = "request.time.getDayOfWeek() >= 1 && request.time.getDayOfWeek() <= 5"
          }
        },
        {
          role = "roles/storage.objectViewer"
          condition = {
            title       = "AllowSpecificBucket"
            description = "仅允许访问dev-bucket存储桶"
            expression  = "resource.name.startsWith('projects/_/buckets/dev-bucket')"
          }
        }
      ]
    },
    "serviceAccount:ci-sa@example.iam.gserviceaccount.com" = {
      roles = [
        {
          role = "roles/artifactregistry.writer"
          condition = {
            title       = "AllowCIOnly"
            description = "仅允许CI服务账号访问"
            expression  = "request.auth.principalEmail == 'ci-sa@example.iam.gserviceaccount.com'"
          }
        }
      ]
    }
  }
}

2. 构造new_bindings_IAM本地变量 #

将「主体-多角色-多条件」的嵌套结构转换为google_organization_iam_binding所需的「角色+条件唯一组合-多主体」结构：

locals {
  # 展开所有主体、角色、条件的关联条目
  flattened_entries = flatten([
    for member, details in var.new : [
      for role_item in details.roles : {
        member     = member
        role       = role_item.role
        condition  = role_item.condition
      }
    ]
  ])

  # 按角色+条件的唯一标识分组，聚合同一组合下的所有成员
  new_bindings_IAM = merge([
    for key, group in groupby(local.flattened_entries, e => "${e.role}-${sha256(jsonencode(e.condition))}") : {
      "${key}" = {
        role       = group[0].role
        condition  = group[0].condition
        members    = distinct([for item in group : item.member])
      }
    }
  ]...)
}

3. 生成IAM绑定资源 #

通过for_each遍历转换后的结构，创建带条件的组织IAM绑定：

resource "google_organization_iam_binding" "org_bindings" {
  for_each = local.new_bindings_IAM

  org_id  = var.org_id # 替换为你的GCP组织ID变量
  role    = each.value.role
  members = each.value.members

  condition {
    title       = each.value.condition.title
    description = each.value.condition.description
    expression  = each.value.condition.expression
  }
}

核心逻辑说明 #

• 结构转换：先将嵌套结构展开为一维列表，再通过「角色+条件哈希值」作为唯一键分组，确保每个绑定对应唯一的角色+条件组合，符合GCP IAM的绑定规则。
• 成员去重：使用distinct()避免同一成员在同一绑定中重复出现。
• 条件唯一性：通过sha256(jsonencode(e.condition))生成条件的唯一标识，确保内容完全一致的条件会被归为同一组合。

内容的提问来源于stack exchange，提问作者Alexandre Alves