Worklytics Export to GCP Terraform Module

This module sets IAM policy to support exporting data from Worklytics to a pre-existing GCS bucket and provisions instructions for doing so.

It is published in the Terraform Registry.

It is arguably too minimal to be its own module, but we did so to make it analogous to AWS case and provide for potential future provisioning of the connection from the Worklytics side.

Usage

from Terraform registry:

resource "google_storage_bucket" "worklytics_export" {
  name     = "worklytics-export"

  # customize as needed; see https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/storage_bucket#argument-reference
}

module "worklytics-export" {
  source  = "Worklytics/worklytics-export/gcp"
  version = "~> 1.0.0"

  # email address of your Worklytics Tenant's Service Account (obtain from Worklytics)
  worklytics_tenant_sa_email = "YOUR_SA_EMAIL@YOUR_PROJECT_ID.iam.gserviceaccount.com"
  bucket_name                = google_storage_bucket.worklytics_export.name
}

via GitHub:

module "worklytics-export" {
  source  = "git::https://github.com/worklytics/terraform-gcp-worklytics-export/?ref=v1.0.0"

  # email address of your Worklytics Tenant's Service Account (obtain from Worklytics)
  worklytics_tenant_sa_email = "YOUR_SA_EMAIL@YOUR_PROJECT_ID.iam.gserviceaccount.com"
  bucket_name                = google_storage_bucket.worklytics_export.name
}

Outputs

todo_markdown

If todo_as_outputs is set to true, this will be a markdown-formatted string of TODOs for you to complete outside of Terraform.

Compatibility

This module requires Terraform >= 1.3. It is tested against Terraform 1.6 through the latest released version.

The module requires the hashicorp/google provider >= 6.0 (tested against 6.x and 7.x). Google provider 5.x is no longer maintained, so 1.0 drops it. If you find incompatibilities, please open an issue.

Upgrading to 1.0

1.0 is the first stable release. From 0.x:

• Require hashicorp/google >= 6.0 (5.x is unmaintained).
• Require Terraform >= 1.3.
• Optional bucket_write_iam_role if you want a custom role instead of roles/storage.objectAdmin (default is unchanged).

Pin the module with version = "~> 1.0.0".

Usage Tips

Existing Bucket

If you wish to export Worklytics data to an existing bucket, use a Terraform import as follows:

terraform import module.worklytics_export.google_storage_bucket.worklytics_export <bucket_name>

IAM Permissions

By default this module grants roles/storage.objectAdmin to the Worklytics tenant service account on your bucket, which is the role specified in the Worklytics data export documentation.

Why not a narrower role? GCS implements object overwrite as delete + create internally, so storage.objects.delete is required alongside storage.objects.create. The narrower roles/storage.objectCreator omits delete permission and will fail on re-exports.

Minimum required permissions (PoLP):

Permission	Purpose
storage.objects.create	Upload/write export files
storage.objects.delete	Required for overwrite (GCS delete+create model)
storage.objects.list	Enumerate objects in the bucket

roles/storage.objectAdmin includes these three plus storage.objects.get, storage.objects.update, storage.objects.getIamPolicy, and storage.objects.setIamPolicy, none of which are needed by Worklytics.

Using a custom role instead:

If your security posture requires PoLP, create a custom role and pass its ID via the bucket_write_iam_role variable:

resource "google_project_iam_custom_role" "worklytics_export_writer" {
  role_id     = "worklyticsExportWriter"
  title       = "Worklytics Export Writer"
  description = "Minimum permissions for Worklytics to write data exports to GCS."
  permissions = [
    "storage.objects.create",
    "storage.objects.delete",
    "storage.objects.list",
  ]
}

module "worklytics-export" {
  source  = "Worklytics/worklytics-export/gcp"
  version = "~> 1.0.0"

  worklytics_tenant_sa_email = "YOUR_SA_EMAIL@YOUR_PROJECT_ID.iam.gserviceaccount.com"
  bucket_name                = google_storage_bucket.worklytics_export.name
  bucket_write_iam_role      = google_project_iam_custom_role.worklytics_export_writer.id
}

Development

This module is written and maintained by Worklytics, Co. and intended to guide our customers in setting up their own infra to export data from Worklytics to GCS.

As this is published as a Terraform module, we will strive to follow standard Terraform module structure and style conventions.

See examples/basic/ for a simple example of how to use this module.

Developing:

1. branch from main; open a PR to main when ready for review.
2. releases will be periodically cut from main by tagging with semantic version (v{MAJOR}.{MINOR}.{PATCH}), push to origin (GitHub), and create a release (hopefully automatic via GitHub Actions; via GitHub UI if not).
3. releases should be automatically picked up by Terraform Registry (some lag here)

Non-Terraform Instructions

If you don't wish to use Terraform to prepare your infrastructure for receiving exports from Worklytics, you can do the following.

1. Create a GCS bucket or choose a preexisting one that you wish to export to. (GCP Console or CLI)
2. Grant the roles/storage.objectAdmin IAM role to your Worklytics Tenant's Service Account (obtain from Worklytics) on the bucket.
3. Create an Export connection via the Worklytics web app.