This module creates the infrastructure required by Secure Serverless blueprint.

This module deploys:

• A folder to store Serverless infrastructure.
• The service project where Serverless application is going to be deployed.
• The security project where KMS and Artifact Registry are going to be created.
  • Keyring and Key created for Artifact Registry.
  • Artifact Registry created with Encryption Key.
  • Hello World example image copied to Artifact Registry.
• A network and one subnetwork.
• Firewall rules:
  • Deny all egress traffic.
  • Allow Restricted and Private Google APIs.
• Configure a Private Service Connect.
• Creates an Access Level and a Service Perimeter with both projects and restricting all the supported services.

Basic usage of this module is as follows:

module "secure_cloud_run_harness" {
  source  = "GoogleCloudPlatform/cloud-run/google//modules/secure-cloud-serverless-harness"
  version = "~> 0.9.1"

  # Required variables
  billing_account                   = "<BILLING ACCOUNT>"
  security_project_name             = "<SECURITY PROJECT NAME>"
  serverless_project_name           = "<SERVERLESS PROJECT NAME>"
  org_id                            = "<ORGANIZATION ID>"
  region                            = "<REGION>"
  location                          = "<LOCATION>"
  vpc_name                          = "<VPC NAME>"
  subnet_ip                         = "<SUBNET IP RANGE>"
  artifact_registry_repository_name = "<ARTIFACT REGISTRY NAME>"
  keyring_name                      = "<KEYRING NAME>"
  key_name                          = "<KEY NAME>"
  access_level_members              =["user:<USER-EMAIL>", "serviceAccount:<SERVICE-ACCOUNT-EMAIL>"]
  base_serverless_api               = "<RUN-OR-CLOUD-FUNCTIONS>.googleapis.com"
  private_service_connect_ip        = "<INTERNAL-IP-USED-BY-PRIVATE-SERVICE-CONNECT>"
}

list(object({
    from = any
    to   = any
  }))

list(object({
    from = any
    to   = any
  }))

These sections describe requirements for using this module.

• Terraform ~> v0.13+
• Terraform Provider for GCP < 5.0
• Terraform Provider for GCP Beta >= 3.53, < 5.0

A service account can be used with required roles to execute this module:

• Organization Level:
  • Access Context Manager Editor: roles/accesscontextmanager.policyEditor
• Parent level - Organization or Folder level:
  • Folder Admin - roles/resourcemanager.folderAdmin
  • Project Creator - roles/resourcemanager.projectCreator
  • Project Deleter - roles/resourcemanager.projectDeleter
• Billing
  • Billing User - roles/billing.user

Know more about Cloud Run Deployment Permissions or Cloud Functions Deployment Permissions.

The Project Factory module and the IAM module may be used in combination to provision a service account with the necessary roles applied.