☁️ Google Cloud Apigee Sync Authorization Terraform Module

Manages the org-level singleton granting service accounts access to control-plane resources for Apigee hybrid Synchronizer. Targets hashicorp/google ~> 7.0.

• Provisions a single google_apigee_sync_authorization — an org-level singleton listing which service accounts are authorized for Apigee hybrid Synchronizer control-plane access.
• No deletion_policy on this resource — confirmed absent from its own live schema.

💡 Why it matters: the name argument on this resource IS the organization reference — like google_apigee_addons_config.org, it consumes the org's .name output directly, with no separate org_id argument at all.

If these Terraform modules have been helpful to you or your organization, I'd appreciate your support in any of the following ways:

• ⭐ Star this repository to help others discover this Terraform module.
• 🤝 Connect with me on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

Whether it's a star, a professional connection, or a coffee, every gesture helps keep these modules actively maintained and continually improving. Thank you for being part of the community!

flowchart LR
 ORG["terraform-google-apigee-organization<br/>(same batch, required)"]:::keystone
 THIS["terraform-google-apigee-sync-authorization<br/>(this module — standalone)"]:::thismodule

 ORG -.->|"name -> name"| THIS

 classDef thismodule fill:#4285F4,color:#FFFFFF,stroke:#174EA6,stroke-width:1px;
 classDef keystone fill:#174EA6,color:#FFFFFF,stroke:#174EA6,stroke-width:1px;

flowchart TB
 subgraph Inputs
 NAME["var.name"]
 IDENT["var.identities"]
 end

 KEYSTONE["google_apigee_sync_authorization.this"]:::keystone

 subgraph Outputs
 ID["id"]
 ETAG["etag"]
 end

 NAME --> KEYSTONE
 IDENT --> KEYSTONE

 KEYSTONE --> ID
 KEYSTONE --> ETAG

 classDef keystone fill:#174EA6,color:#FFFFFF,stroke:#174EA6,stroke-width:1px;

Resource inventory: one resource, google_apigee_sync_authorization.this.

Schema notes that bite:

• name IS the organization reference — no separate org_id argument exists, and name consumes the org's .name output, mirroring google_apigee_addons_config.org's precedent.
• No deletion_policy — confirmed absent from this resource's schema.
• No labels, no self_link, no project argument — confirmed absent.

• roles/apigee.admin — organization-wide Apigee administration.
• roles/apigee.synchronizerManager — required on each service account listed in identities.

• apigee.googleapis.com enabled (via terraform-google-project-services).
• An Apigee organization must already exist (terraform-google-apigee-organization).
• Each service account listed in identities must already hold the Apigee Synchronizer Manager role.

terraform-google-apigee-sync-authorization/
├── providers.tf # required_providers + required_version
├── variables.tf # name, identities, timeouts
├── main.tf # google_apigee_sync_authorization.this
├── outputs.tf # id, etag
├── README.md
├── SCOPE.md
└── examples/
 └── basic/

module "apigee_sync_authorization" {
  source = "git::https://github.com/microsoftexpert/terraform-google-apigee-sync-authorization.git?ref=v1.0.0"

  name = module.apigee_org.name

  identities = [
    "serviceAccount:[email protected]",
  ]
}

ℹ️ The caller configures the google provider block with valid ADC, Workload Identity Federation, or a service-account key per our authentication model.

Consumes

Emits

No self_link.

module "apigee_sync_authorization" {
  source = "git::https://github.com/microsoftexpert/terraform-google-apigee-sync-authorization.git?ref=v1.0.0"

  name       = module.apigee_org.name
  identities = ["serviceAccount:[email protected]"]
}

module "apigee_sync_authorization" {
  source = "git::https://github.com/microsoftexpert/terraform-google-apigee-sync-authorization.git?ref=v1.0.0"

  name = module.apigee_org.name

  identities = [
    "serviceAccount:[email protected]",
    "serviceAccount:[email protected]",
  ]
}

module "apigee_sync_authorization" {
  source = "git::https://github.com/microsoftexpert/terraform-google-apigee-sync-authorization.git?ref=v1.0.0"

  name       = module.apigee_org.name
  identities = ["serviceAccount:[email protected]"]

  timeouts = {
    create = "15m"
    update = "15m"
    delete = "15m"
  }
}

module "apigee_sync_authorization" {
  source = "git::https://github.com/microsoftexpert/terraform-google-apigee-sync-authorization.git?ref=v1.0.0"

  name       = module.apigee_org.name
  identities = ["serviceAccount:[email protected]"]
}

output "sync_authorization_etag" {
  value = module.apigee_sync_authorization.etag
}

module "apigee_sync_authorization" {
  source = "git::https://github.com/microsoftexpert/terraform-google-apigee-sync-authorization.git?ref=v1.0.0"

  name       = module.apigee_org_hybrid.name
  identities = ["serviceAccount:[email protected]"]
}

module "apigee_org" {
  source = "git::https://github.com/microsoftexpert/terraform-google-apigee-organization.git?ref=v1.0.0"

  project_id          = "casey-prod-apigee"
  analytics_region    = "us-central1"
  disable_vpc_peering = true
}

module "apigee_sync_authorization" {
  source = "git::https://github.com/microsoftexpert/terraform-google-apigee-sync-authorization.git?ref=v1.0.0"

  name = module.apigee_org.name

  identities = [
    "serviceAccount:[email protected]",
  ]
}

variable "name" {
  type = string
}

variable "identities" {
  type = list(string)
}

variable "timeouts" {
  type = object({
    create = optional(string)
    update = optional(string)
    delete = optional(string)
  })
  default = null
}

No self_link output — confirmed absent from this resource.

• name IS the organization reference (no separate org_id argument), consuming the org's .name output — mirrors google_apigee_addons_config.org's precedent exactly.
• No deletion_policy — this resource has no such field to override.
• This is a singleton per organization; there is no natural key beyond the organization itself.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin ?ref=v1.0.0 — never a branch. This library is plan-only; a human applies from CI with valid credentials.

validate/fmt -check confirm structural and syntactic correctness only. They cannot catch GCP-side rejections — e.g. a service account listed in identities that lacks the Apigee Synchronizer Manager role surfaces only at apply time against a real project.

id = "organizations/casey-prod-apigee/syncAuthorization"
etag = "BwYzX1abcde="

• google_apigee_sync_authorization resource docs
• terraform-google-apigee-organization — required parent module
• This module's SCOPE.md