Fix: remove default vpc consistency errors

0-bootstrap/cb.tf

@@ -131,7 +131,7 @@ module "tf_source" {
   }
 
   # Remove after github.com/terraform-google-modules/terraform-google-bootstrap/issues/160
-  depends_on = [module.seed_bootstrap]
+  depends_on = [module.seed_bootstrap, time_sleep.wait_organization_policies]
 }
 
 module "tf_private_pool" {

0-bootstrap/main.tf

@@ -99,6 +99,5 @@ module "seed_bootstrap" {
 
   sa_org_iam_permissions = []
 
-  depends_on = [module.required_group]
+  depends_on = [module.required_group, time_sleep.wait_organization_policies]
 }
-

0-bootstrap/org_policy.tf

@@ -0,0 +1,45 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+locals {
+  organization_id = var.parent_folder != "" ? null : var.org_id
+  folder_id       = var.parent_folder != "" ? var.parent_folder : null
+  policy_for      = var.parent_folder != "" ? "folder" : "organization"
+
+  boolean_type_organization_policies = toset([
+    "compute.skipDefaultNetworkCreation"
+  ])
+}
+
+module "organization_policies_type_boolean" {
+  source   = "terraform-google-modules/org-policy/google"
+  version  = "~> 5.1"
+  for_each = local.boolean_type_organization_policies
+
+  organization_id = local.organization_id
+  folder_id       = local.folder_id
+  policy_for      = local.policy_for
+  policy_type     = "boolean"
+  enforce         = "true"
+  constraint      = "constraints/${each.value}"
+}
+
+resource "time_sleep" "wait_organization_policies" {
+  create_duration = "60s"
+  depends_on = [
+    module.organization_policies_type_boolean
+  ]
+}

1-org/envs/shared/org_policy.tf

@@ -27,7 +27,6 @@ locals {
   boolean_type_organization_policies = toset([
     "compute.disableNestedVirtualization",
     "compute.disableSerialPortAccess",
-    "compute.skipDefaultNetworkCreation",
     "compute.restrictXpnProjectLienRemoval",
     "compute.disableVpcExternalIpv6",
     "compute.setNewProjectDefaultToZonalDNSOnly",

1-org/envs/shared/projects.tf

@@ -44,6 +44,7 @@ module "org_audit_logs" {
   billing_account          = local.billing_account
   folder_id                = google_folder.common.id
   activate_apis            = ["logging.googleapis.com", "bigquery.googleapis.com", "billingbudgets.googleapis.com"]
+  auto_create_network      = true
 
   labels = {
     environment       = "common"
@@ -77,6 +78,7 @@ module "org_billing_export" {
   billing_account          = local.billing_account
   folder_id                = google_folder.common.id
   activate_apis            = ["logging.googleapis.com", "bigquery.googleapis.com", "billingbudgets.googleapis.com"]
+  auto_create_network      = true
 
   labels = {
     environment       = "common"
@@ -110,6 +112,8 @@ module "common_kms" {
   billing_account          = local.billing_account
   folder_id                = google_folder.common.id
   activate_apis            = ["logging.googleapis.com", "cloudkms.googleapis.com", "billingbudgets.googleapis.com"]
+  auto_create_network      = true
+
 
   labels = {
     environment       = "common"
@@ -144,6 +148,8 @@ module "org_secrets" {
   billing_account          = local.billing_account
   folder_id                = google_folder.common.id
   activate_apis            = ["logging.googleapis.com", "secretmanager.googleapis.com", "billingbudgets.googleapis.com"]
+  auto_create_network      = true
+
 
   labels = {
     environment       = "common"
@@ -177,6 +183,8 @@ module "interconnect" {
   billing_account          = local.billing_account
   folder_id                = google_folder.network.id
   activate_apis            = ["billingbudgets.googleapis.com", "compute.googleapis.com"]
+  auto_create_network      = true
+
 
   labels = {
     environment       = "network"
@@ -210,6 +218,8 @@ module "scc_notifications" {
   billing_account          = local.billing_account
   folder_id                = google_folder.common.id
   activate_apis            = ["logging.googleapis.com", "pubsub.googleapis.com", "securitycenter.googleapis.com", "billingbudgets.googleapis.com", "cloudkms.googleapis.com"]
+  auto_create_network      = true
+
 
   labels = {
     environment       = "common"
@@ -242,6 +252,8 @@ module "dns_hub" {
   org_id                   = local.org_id
   billing_account          = local.billing_account
   folder_id                = google_folder.network.id
+  auto_create_network      = true
+
 
   activate_apis = [
     "compute.googleapis.com",
@@ -284,6 +296,8 @@ module "base_network_hub" {
   org_id                   = local.org_id
   billing_account          = local.billing_account
   folder_id                = google_folder.network.id
+  auto_create_network      = true
+
 
   activate_apis = [
     "compute.googleapis.com",
@@ -334,6 +348,8 @@ module "restricted_network_hub" {
   org_id                   = local.org_id
   billing_account          = local.billing_account
   folder_id                = google_folder.network.id
+  auto_create_network      = true
+
 
   activate_apis = [
     "compute.googleapis.com",

1-org/modules/network/main.tf

@@ -29,6 +29,7 @@ module "base_shared_vpc_host_project" {
   billing_account             = var.billing_account
   folder_id                   = var.folder_id
   disable_services_on_destroy = false
+  auto_create_network         = true
 
   activate_apis = [
     "compute.googleapis.com",
@@ -65,6 +66,7 @@ module "restricted_shared_vpc_host_project" {
   billing_account             = var.billing_account
   folder_id                   = var.folder_id
   disable_services_on_destroy = false
+  auto_create_network         = true
 
   activate_apis = [
     "compute.googleapis.com",

2-environments/modules/env_baseline/kms.tf

@@ -33,6 +33,7 @@ module "env_kms" {
   disable_services_on_destroy = false
   depends_on                  = [time_sleep.wait_60_seconds]
   activate_apis               = ["logging.googleapis.com", "cloudkms.googleapis.com", "billingbudgets.googleapis.com"]
+  auto_create_network         = true
 
   labels = {
     environment       = var.env

2-environments/modules/env_baseline/secrets.tf

@@ -33,6 +33,7 @@ module "env_secrets" {
   disable_services_on_destroy = false
   depends_on                  = [time_sleep.wait_60_seconds]
   activate_apis               = ["logging.googleapis.com", "secretmanager.googleapis.com"]
+  auto_create_network         = true
 
   labels = {
     environment       = var.env

4-projects/modules/base_env/example_storage_cmek.tf

@@ -43,8 +43,9 @@ resource "random_string" "bucket_name" {
 }
 
 module "gcs_buckets" {
-  source  = "terraform-google-modules/cloud-storage/google//modules/simple_bucket"
-  version = "~> 6.0"
+  source = "terraform-google-modules/cloud-storage/google//modules/simple_bucket"
+  # Open Issue on version 6.1.0: https://github.com/terraform-google-modules/terraform-google-cloud-storage/issues/339
+  version = "~> 6.0.0"
 
   project_id              = module.base_shared_vpc_project.project_id
   location                = var.location_gcs

4-projects/modules/single_project/main.tf

@@ -55,6 +55,7 @@ module "project" {
   org_id                   = var.org_id
   billing_account          = var.billing_account
   folder_id                = var.folder_id
+  auto_create_network      = true
 
   svpc_host_project_id = var.shared_vpc_host_project_id
   shared_vpc_subnets   = var.shared_vpc_subnets # Optional: To enable subnetting, replace to "module.networking_project.subnetwork_self_link"

test/integration/bootstrap/bootstrap_test.go

@@ -147,6 +147,8 @@ func TestBootstrap(t *testing.T) {
 	bootstrap.DefineVerify(
 		func(assert *assert.Assertions) {
 
+			parentFolder := terraform.OutputMap(t, bootstrap.GetTFOptions(), "common_config")["parent_folder"]
+
 			// cloud build project
 			cbProjectID := bootstrap.GetStringOutput("cloudbuild_project_id")
 			artifactsBktName := terraform.OutputMap(t, bootstrap.GetTFOptions(), "gcs_bucket_cloudbuild_artifacts")
@@ -304,8 +306,17 @@ func TestBootstrap(t *testing.T) {
 					assert.Subset(listRoles, sa.orgRoles, fmt.Sprintf("service account %s should have organization level roles", terraformSAEmail))
 				}
 			}
+			// boolean organization policies
+			for _, booleanConstraint := range []string{
+				"constraints/compute.skipDefaultNetworkCreation",
+			} {
+				orgPolicy := gcloud.Runf(t, "resource-manager org-policies describe %s --folder %s", booleanConstraint, parentFolder)
+				assert.True(orgPolicy.Get("booleanPolicy.enforced").Bool(), fmt.Sprintf("org policy %s should be enforced", booleanConstraint))
+			}
 		})
 
+
+
 	bootstrap.DefineTeardown(func(assert *assert.Assertions) {
 		// configure options to pull state from GCS bucket
 		cwd, err := os.Getwd()

test/integration/org/org_test.go

@@ -158,7 +158,6 @@ func TestOrg(t *testing.T) {
 			for _, booleanConstraint := range []string{
 				"constraints/compute.disableNestedVirtualization",
 				"constraints/compute.disableSerialPortAccess",
-				"constraints/compute.skipDefaultNetworkCreation",
 				"constraints/compute.restrictXpnProjectLienRemoval",
 				"constraints/sql.restrictPublicIp",
 				"constraints/sql.restrictAuthorizedNetworks",

test/setup/main.tf

@@ -54,6 +54,7 @@ module "project" {
   org_id                   = var.org_id
   folder_id                = var.folder_id
   billing_account          = var.billing_account
+  auto_create_network      = true
 
   activate_apis = [
     "cloudresourcemanager.googleapis.com",