feat: Add optional kms_key_handle_name (#743)

imrannayer · web-flow · commit 19c3b840841a · 2025-06-26T12:19:40.000-05:00
diff --git a/examples/mssql-failover-replica/main.tf b/examples/mssql-failover-replica/main.tf
@@ -24,7 +24,7 @@ locals {
 
 module "mssql1" {
   source  = "terraform-google-modules/sql-db/google//modules/mssql"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
   region = local.region_1
 
diff --git a/examples/mssql-public/main.tf b/examples/mssql-public/main.tf
@@ -16,7 +16,7 @@
 
 module "mssql" {
   source  = "terraform-google-modules/sql-db/google//modules/mssql"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
   name                 = var.name
   random_instance_name = true
@@ -27,4 +27,9 @@ module "mssql" {
   deletion_protection = false
 
   sql_server_audit_config = var.sql_server_audit_config
+
+  insights_config = {
+    query_plans_per_minute = 5
+  }
+
 }
diff --git a/examples/mysql-backup-create-service-account/main.tf b/examples/mysql-backup-create-service-account/main.tf
@@ -16,7 +16,7 @@
 
 module "mysql" {
   source  = "terraform-google-modules/sql-db/google//modules/mysql"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
   name                 = "example-mysql-public"
   database_version     = "MYSQL_8_0"
@@ -45,7 +45,7 @@ resource "google_storage_bucket" "backup" {
 
 module "backup" {
   source  = "terraform-google-modules/sql-db/google//modules/backup"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
   region                = "us-central1"
   project_id            = var.project_id
diff --git a/examples/mysql-ha/main.tf b/examples/mysql-ha/main.tf
@@ -33,7 +33,7 @@ locals {
 
 module "mysql" {
   source  = "terraform-google-modules/sql-db/google//modules/mysql"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
   name                 = var.mysql_ha_name
   random_instance_name = true
diff --git a/examples/mysql-private/main.tf b/examples/mysql-private/main.tf
@@ -39,7 +39,7 @@ module "network-safer-mysql-simple" {
 
 module "private-service-access" {
   source  = "terraform-google-modules/sql-db/google//modules/private_service_access"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
   project_id      = var.project_id
   vpc_network     = module.network-safer-mysql-simple.network_name
@@ -48,7 +48,7 @@ module "private-service-access" {
 
 module "safer-mysql-db" {
   source  = "terraform-google-modules/sql-db/google//modules/safer_mysql"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
 
   name                 = var.db_name
diff --git a/examples/mysql-psc/main.tf b/examples/mysql-psc/main.tf
@@ -27,7 +27,7 @@ locals {
 
 module "mysql" {
   source  = "terraform-google-modules/sql-db/google//modules/mysql"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
   name                 = var.mysql_ha_name
   random_instance_name = true
diff --git a/examples/mysql-public/main.tf b/examples/mysql-public/main.tf
@@ -20,7 +20,7 @@ resource "random_id" "name" {
 
 module "mysql-db" {
   source  = "terraform-google-modules/sql-db/google//modules/mysql"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
   name                 = var.db_name
   random_instance_name = true
diff --git a/examples/postgresql-backup-provided-service-account/main.tf b/examples/postgresql-backup-provided-service-account/main.tf
@@ -16,7 +16,7 @@
 
 module "postgresql" {
   source  = "terraform-google-modules/sql-db/google//modules/postgresql"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
   name                 = "example-postgres"
   random_instance_name = true
@@ -56,7 +56,7 @@ resource "google_monitoring_notification_channel" "email" {
 
 module "backup" {
   source  = "terraform-google-modules/sql-db/google//modules/backup"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
   region                      = "us-central1"
   project_id                  = var.project_id
diff --git a/examples/postgresql-ha/main.tf b/examples/postgresql-ha/main.tf
@@ -32,10 +32,10 @@ locals {
 
 module "pg" {
   source  = "terraform-google-modules/sql-db/google//modules/postgresql"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
   name                 = var.pg_ha_name
-  random_instance_name = true
+  random_instance_name = false
   project_id           = var.project_id
   database_version     = "POSTGRES_9_6"
   region               = "us-central1"
diff --git a/examples/postgresql-psc/main.tf b/examples/postgresql-psc/main.tf
@@ -26,7 +26,7 @@ locals {
 
 module "pg" {
   source  = "terraform-google-modules/sql-db/google//modules/postgresql"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
   name                 = var.pg_psc_name
   random_instance_name = true
diff --git a/examples/postgresql-public-iam/main.tf b/examples/postgresql-public-iam/main.tf
@@ -17,7 +17,7 @@
 
 module "postgresql-db" {
   source  = "terraform-google-modules/sql-db/google//modules/postgresql"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
   name                 = var.db_name
   random_instance_name = true
diff --git a/examples/postgresql-public/main.tf b/examples/postgresql-public/main.tf
@@ -17,7 +17,7 @@
 
 module "postgresql-db" {
   source  = "terraform-google-modules/sql-db/google//modules/postgresql"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
   name                 = var.db_name
   random_instance_name = true
diff --git a/examples/postgresql-with-cross-region-failover/main.tf b/examples/postgresql-with-cross-region-failover/main.tf
@@ -46,7 +46,7 @@ data "google_compute_zones" "available_region2" {
 
 module "pg1" {
   source  = "terraform-google-modules/sql-db/google//modules/postgresql"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
 
   name                 = var.pg_name_1
@@ -155,7 +155,7 @@ module "pg1" {
 
 module "pg2" {
   source  = "terraform-google-modules/sql-db/google//modules/postgresql"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
 
   # Comment this parameter to promote instance 2 as primary instance.
diff --git a/examples/private_service_access/main.tf b/examples/private_service_access/main.tf
@@ -23,7 +23,7 @@ resource "google_compute_network" "default" {
 
 module "test_psa" {
   source  = "terraform-google-modules/sql-db/google//modules/private_service_access"
-  version = "~> 25.0"
+  version = "~> 26.0"
 
   project_id      = var.project_id
   vpc_network     = google_compute_network.default.name
diff --git a/modules/mssql/README.md b/modules/mssql/README.md
@@ -60,6 +60,7 @@ module "mssql" {
 | enable\_default\_user | Enable or disable the creation of the default user | `bool` | `true` | no |
 | encryption\_key\_name | The full path to the encryption key used for the CMEK disk encryption | `string` | `null` | no |
 | follow\_gae\_application | A Google App Engine application whose zone to remain in. Must be in the same region as this instance. | `string` | `null` | no |
+| insights\_config | The insights\_config settings for the database. | <pre>object({<br>    query_plans_per_minute  = optional(number, 5)<br>    query_string_length     = optional(number, 1024)<br>    record_application_tags = optional(bool, false)<br>    record_client_address   = optional(bool, false)<br>  })</pre> | `null` | no |
 | instance\_type | The type of the instance. The supported values are SQL\_INSTANCE\_TYPE\_UNSPECIFIED, CLOUD\_SQL\_INSTANCE, ON\_PREMISES\_INSTANCE and READ\_REPLICA\_INSTANCE. Set to READ\_REPLICA\_INSTANCE when primary\_instance\_name is provided | `string` | `"CLOUD_SQL_INSTANCE"` | no |
 | ip\_configuration | The ip configuration for the Cloud SQL instances. | <pre>object({<br>    authorized_networks = optional(list(map(string)), [])<br>    ipv4_enabled        = optional(bool)<br>    private_network     = optional(string)<br>    allocated_ip_range  = optional(string)<br>    ssl_mode            = optional(string)<br>  })</pre> | <pre>{<br>  "allocated_ip_range": null,<br>  "authorized_networks": [],<br>  "ipv4_enabled": true,<br>  "private_network": null,<br>  "ssl_mode": null<br>}</pre> | no |
 | maintenance\_version | The current software version on the instance. This attribute can not be set during creation. Refer to available\_maintenance\_versions attribute to see what maintenance\_version are available for upgrade. When this attribute gets updated, it will cause an instance restart. Setting a maintenance\_version value that is older than the current one on the instance will be ignored | `string` | `null` | no |
diff --git a/modules/mssql/main.tf b/modules/mssql/main.tf
@@ -115,6 +115,18 @@ resource "google_sql_database_instance" "default" {
       }
     }
 
+    dynamic "insights_config" {
+      for_each = var.insights_config != null ? [var.insights_config] : []
+
+      content {
+        query_insights_enabled  = true
+        query_plans_per_minute  = lookup(insights_config.value, "query_plans_per_minute", 5)
+        query_string_length     = lookup(insights_config.value, "query_string_length", 1024)
+        record_application_tags = lookup(insights_config.value, "record_application_tags", false)
+        record_client_address   = lookup(insights_config.value, "record_client_address", false)
+      }
+    }
+
     disk_autoresize       = var.disk_autoresize
     disk_autoresize_limit = var.disk_autoresize_limit
     disk_size             = var.disk_size
diff --git a/modules/mssql/variables.tf b/modules/mssql/variables.tf
@@ -366,3 +366,14 @@ variable "enable_dataplex_integration" {
   type        = bool
   default     = false
 }
+
+variable "insights_config" {
+  description = "The insights_config settings for the database."
+  type = object({
+    query_plans_per_minute  = optional(number, 5)
+    query_string_length     = optional(number, 1024)
+    record_application_tags = optional(bool, false)
+    record_client_address   = optional(bool, false)
+  })
+  default = null
+}
diff --git a/modules/postgresql/README.md b/modules/postgresql/README.md
@@ -122,6 +122,7 @@ module "pg" {
 | availability\_type | The availability type for the Cloud SQL instance.This is only used to set up high availability for the PostgreSQL instance. Can be either `ZONAL` or `REGIONAL`. | `string` | `"ZONAL"` | no |
 | backup\_configuration | The backup\_configuration settings subblock for the database setings | <pre>object({<br>    enabled                        = optional(bool, false)<br>    start_time                     = optional(string)<br>    location                       = optional(string)<br>    point_in_time_recovery_enabled = optional(bool, false)<br>    transaction_log_retention_days = optional(string)<br>    retained_backups               = optional(number)<br>    retention_unit                 = optional(string)<br>  })</pre> | `{}` | no |
 | connector\_enforcement | Enforce that clients use the connector library | `bool` | `false` | no |
+| create\_kms\_key\_handle | KeyHandles cannot be deleted from Google Cloud Platform. Destroying a Terraform-managed KeyHandle will remove it from state but will not delete the resource from the project. Set this to false if key handle already exists | `bool` | `true` | no |
 | create\_timeout | The optional timout that is applied to limit long database creates. | `string` | `"30m"` | no |
 | data\_cache\_enabled | Whether data cache is enabled for the instance. Defaults to false. Feature is only available for ENTERPRISE\_PLUS tier and supported database\_versions | `bool` | `false` | no |
 | database\_deletion\_policy | The deletion policy for the database. Setting ABANDON allows the resource to be abandoned rather than deleted. This is useful for Postgres, where databases cannot be deleted from the API if there are users other than cloudsqlsuperuser with access. Possible values are: "ABANDON". | `string` | `null` | no |
@@ -152,6 +153,7 @@ module "pg" {
 | insights\_config | The insights\_config settings for the database. | <pre>object({<br>    query_plans_per_minute  = optional(number, 5)<br>    query_string_length     = optional(number, 1024)<br>    record_application_tags = optional(bool, false)<br>    record_client_address   = optional(bool, false)<br>  })</pre> | `null` | no |
 | instance\_type | The type of the instance. The supported values are SQL\_INSTANCE\_TYPE\_UNSPECIFIED, CLOUD\_SQL\_INSTANCE, ON\_PREMISES\_INSTANCE and READ\_REPLICA\_INSTANCE. Set to READ\_REPLICA\_INSTANCE if master\_instance\_name value is provided | `string` | `"CLOUD_SQL_INSTANCE"` | no |
 | ip\_configuration | The ip configuration for the Cloud SQL instances. | <pre>object({<br>    authorized_networks                           = optional(list(map(string)), [])<br>    ipv4_enabled                                  = optional(bool, true)<br>    private_network                               = optional(string)<br>    ssl_mode                                      = optional(string)<br>    allocated_ip_range                            = optional(string)<br>    enable_private_path_for_google_cloud_services = optional(bool, false)<br>    psc_enabled                                   = optional(bool, false)<br>    psc_allowed_consumer_projects                 = optional(list(string), [])<br>    server_ca_mode                                = optional(string)<br>    server_ca_pool                                = optional(string)<br>    custom_subject_alternative_names              = optional(list(string), [])<br>  })</pre> | `{}` | no |
+| kms\_key\_handle\_name | key handle name. If not provided module will use instance name as key handle name | `string` | `null` | no |
 | maintenance\_version | The current software version on the instance. This attribute can not be set during creation. Refer to available\_maintenance\_versions attribute to see what maintenance\_version are available for upgrade. When this attribute gets updated, it will cause an instance restart. Setting a maintenance\_version value that is older than the current one on the instance will be ignored | `string` | `null` | no |
 | maintenance\_window\_day | The day of week (1-7) for the Cloud SQL instance maintenance. | `number` | `1` | no |
 | maintenance\_window\_hour | The hour of day (0-23) maintenance window for the Cloud SQL instance maintenance. | `number` | `23` | no |
@@ -173,7 +175,7 @@ module "pg" {
 | secondary\_zone | The preferred zone for the replica instance, it should be something like: `us-central1-a`, `us-east1-c`. | `string` | `null` | no |
 | tier | The tier for the Cloud SQL instance, for ADC its defualt value will be db-perf-optimized-N-8 which is tier value for edtion ENTERPRISE\_PLUS, if user wants to change the edition, he should chose compatible tier. | `string` | `"db-f1-micro"` | no |
 | update\_timeout | The optional timout that is applied to limit long database updates. | `string` | `"30m"` | no |
-| use\_autokey | Enable the use of autokeys from Google Cloud KMS for CMEK. This requires autokey already configured in the project. | `bool` | `false` | no |
+| use\_autokey | Enable the use of autokeys from Google Cloud KMS for CMEK. This requires autokey already configured in the project | `bool` | `false` | no |
 | user\_deletion\_policy | The deletion policy for the user. Setting ABANDON allows the resource to be abandoned rather than deleted. This is useful for Postgres, where users cannot be deleted from the API if they have been granted SQL roles. Possible values are: "ABANDON". | `string` | `null` | no |
 | user\_labels | The key/value labels for the Cloud SQL instances. | `map(string)` | `{}` | no |
 | user\_name | The name of the default user | `string` | `"default"` | no |
diff --git a/modules/postgresql/main.tf b/modules/postgresql/main.tf
@@ -46,7 +46,7 @@ locals {
 
   database_name = var.enable_default_db ? var.db_name : (length(var.additional_databases) > 0 ? var.additional_databases[0].name : "")
 
-  encryption_key = var.encryption_key_name != null ? var.encryption_key_name : var.use_autokey ? google_kms_key_handle.default[0].kms_key : null
+  encryption_key = var.encryption_key_name != null ? var.encryption_key_name : var.use_autokey ? try(google_kms_key_handle.default[0].kms_key, data.google_kms_key_handle.key_handle[0].kms_key, null) : null
 }
 
 resource "random_id" "suffix" {
@@ -226,14 +226,22 @@ resource "google_sql_database_instance" "default" {
 }
 
 resource "google_kms_key_handle" "default" {
-  count                  = var.use_autokey ? 1 : 0
+  count                  = var.use_autokey && var.create_kms_key_handle ? 1 : 0
   provider               = google-beta
   project                = var.project_id
-  name                   = local.instance_name
+  name                   = coalesce(var.kms_key_handle_name, local.instance_name) #local.instance_name
   location               = coalesce(var.region, join("-", slice(split("-", var.zone), 0, 2)))
   resource_type_selector = "sqladmin.googleapis.com/Instance"
 }
 
+data "google_kms_key_handle" "key_handle" {
+  provider = google-beta
+  count    = var.use_autokey && !var.create_kms_key_handle && var.kms_key_handle_name != null ? 1 : 0
+  project  = var.project_id
+  name     = coalesce(var.kms_key_handle_name, local.instance_name)
+  location = coalesce(var.region, join("-", slice(split("-", var.zone), 0, 2)))
+}
+
 resource "google_sql_database" "default" {
   count           = var.enable_default_db ? 1 : 0
   name            = var.db_name
diff --git a/modules/postgresql/variables.tf b/modules/postgresql/variables.tf
@@ -473,11 +473,23 @@ variable "database_integration_roles" {
 }
 
 variable "use_autokey" {
-  description = "Enable the use of autokeys from Google Cloud KMS for CMEK. This requires autokey already configured in the project."
+  description = "Enable the use of autokeys from Google Cloud KMS for CMEK. This requires autokey already configured in the project"
   type        = bool
   default     = false
 }
 
+variable "create_kms_key_handle" {
+  description = "KeyHandles cannot be deleted from Google Cloud Platform. Destroying a Terraform-managed KeyHandle will remove it from state but will not delete the resource from the project. Set this to false if key handle already exists"
+  type        = bool
+  default     = true
+}
+
+variable "kms_key_handle_name" {
+  description = "key handle name. If not provided module will use instance name as key handle name"
+  type        = string
+  default     = null
+}
+
 variable "retain_backups_on_delete" {
   description = "When this parameter is set to true, Cloud SQL retains backups of the instance even after the instance is deleted. The ON_DEMAND backup will be retained until customer deletes the backup or the project. The AUTOMATED backup will be retained based on the backups retention setting."
   type        = bool
