fix: add google_storage_bucket in bootstrap module

[k9ert]

Without this, i get:

│ Error: googleapi: Error 412: Request violates constraint 'constraints/storage.uniformBucketLevelAccess', conditionNotMet
│ 
│   with module.bootstrap.google_storage_bucket.tf_state,
│   on .terraform/modules/bootstrap/modules/bootstrap/gcp/tf-state-bucket.tf line 1, in resource "google_storage_bucket" "tf_state":
│    1: resource "google_storage_bucket" "tf_state" {
│ 

This seems to be related to the way new organisations are setup by default in GCP as this contraint is coming from the org.

https://cloud.google.com/storage/docs/uniform-bucket-level-access

[bodymindarts]

This shouldn't be required in bootstrap stage. The inception stage takes ownership for all config for this bucket (including setting uniform_bucket_level_access = true) - bootstrap simply creates it.

[k9ert]

The problem here is the default list of constraints for new orgs:

gcloud resource-manager org-policies list --organization=247915926625
CONSTRAINT                                                      LIST_POLICY  BOOLEAN_POLICY  ETAG
constraints/compute.setNewProjectDefaultToZonalDNSOnly          -            SET             CJjT2LgGEJi-5ZkB
constraints/essentialcontacts.allowedContactDomains             SET          -               CJjT2LgGEMCIrJ4B
constraints/iam.allowedPolicyMemberDomains                      SET          -               CKbB5LgGEPi9tJgB
constraints/iam.disableServiceAccountKeyUpload                  -            SET             CJjT2LgGEJj32JcB
constraints/iam.automaticIamGrantsForDefaultServiceAccounts     -            SET             CJjT2LgGEJjgrZoB
constraints/resourcemanager.allowedExportDestinations           SET          -               CMGL7rgGEODJn-QB
constraints/resourcemanager.allowedImportSources                SET          -               CKGA7rgGEMCV4s0C
constraints/storage.uniformBucketLevelAccess                    -            SET             CJjT2LgGEKCh2JcB
constraints/compute.restrictProtocolForwardingCreationForTypes  SET          -               CJjT2LgGELCK0JcB

With that, you get the issue above! So, why not creating the bucket in a compliant way just right from the start? The alternative would be to disable explicitely that constraint on a project level (which is definitely possible) but why should we do that as this is suppose to improve the security on the buckets?