modules/set-bq-project-cmek/main.tf

/**
 * Copyright 2023 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

resource "null_resource" "set_bq_project_level_cmek" {

  triggers = {
    project_id                = var.project_id,
    crypto_key                = var.crypto_key
    location                  = var.location
    terraform_service_account = var.terraform_service_account
  }

  provisioner "local-exec" {
    when    = create
    command = <<EOF
    curl -s --request POST https://bigquery.googleapis.com/bigquery/v2/projects/${var.project_id}/queries \
    --header "Authorization: Bearer $(gcloud auth print-access-token --verbosity error --impersonate-service-account=${var.terraform_service_account})" \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data "{\"query\":\"ALTER PROJECT \`${var.project_id}\` SET OPTIONS \( \`region-${var.location}.default_kms_key_name\` = \`${var.crypto_key}\`\);\",\"useLegacySql\":false}"
    EOF
  }
}