The Terraform module handles the deployment of Cloud Functions (Gen 2) on GCP.
The resources/services/activations/deletions that this module will create/trigger are:
- Deploy Cloud Functions (2nd Gen) with provided source code and trigger
- Provide Cloud Functions Invoker or Developer roles to the users and service accounts
This module assumes that below mentioned prerequisites are in place before consuming the module.
- APIs are enabled
- Permissions are available.
- You have explicitly granted the necessary IAM roles for the underlying service account used by Cloud Build,
build_service_account
. Ifbuild_service_account
is not specified, then the default compute service account is used, which has no default IAM roles in new organizations. At a minimum, the following IAM roles are required for the build service account:roles/logging.logWriter
roles/storage.objectViewer
roles/artifactregistry.writer
Basic usage of this module is as follows:
module "cloud_functions2" {
source = "GoogleCloudPlatform/cloud-functions/google"
version = "~> 0.6"
# Required variables
function_name = "<FUNCTION_NAME>"
project_id = "<PROJECT_ID>"
location = "<LOCATION>"
runtime = "<RUNTIME>"
entrypoint = "<ENTRYPOINT>"
storage_source = {
bucket = "<BUCKET_NAME>"
object = "<ARCHIVE_PATH>"
generation = "<GCS_GENERATION>"
}
}
Functional examples are included in the examples directory.
Name | Description | Type | Default | Required |
---|---|---|---|---|
build_env_variables | User-provided build-time environment variables | map(string) |
null |
no |
build_service_account | Cloud Function Build Service Account Id. This is The fully-qualified name of the service account to be used for building the container. | string |
null |
no |
description | Short description of the function | string |
null |
no |
docker_repository | User managed repository created in Artifact Registry optionally with a customer managed encryption key. | string |
null |
no |
entrypoint | The name of the function (as defined in source code) that will be executed. Defaults to the resource name suffix, if not specified | string |
n/a | yes |
event_trigger | Event triggers for the function | object({ |
null |
no |
function_location | The location of this cloud function | string |
n/a | yes |
function_name | A user-defined name of the function | string |
n/a | yes |
labels | A set of key/value label pairs associated with this Cloud Function | map(string) |
null |
no |
members | Cloud Function Invoker and Developer roles for Users/SAs. Key names must be developers and/or invokers | map(list(string)) |
{} |
no |
project_id | Project ID to create Cloud Function | string |
n/a | yes |
repo_source | Get the source from this location in a Cloud Source Repository | object({ |
null |
no |
runtime | The runtime in which to run the function. | string |
n/a | yes |
service_config | Details of the service | object({ |
{} |
no |
storage_source | Get the source from this location in Google Cloud Storage | object({ |
null |
no |
worker_pool | Name of the Cloud Build Custom Worker Pool that should be used to build the function. | string |
null |
no |
Name | Description |
---|---|
function_name | Name of the Cloud Function (Gen 2) |
function_uri | URI of the Cloud Function (Gen 2) |
These sections describe requirements for using this module.
The following dependencies must be available:
- Terraform v1.3+
- Terraform Provider for GCP plugin v3.0
A service account with the following roles must be used to provision the resources of this module:
- Storage Admin:
roles/storage.admin
- Cloud Functions Admin:
roles/cloudfunctions.admin
- Cloud Run Admin:
roles/run.admin
- Pub/Sub Admin:
roles/pubsub.admin
- Artifact Registry Admin:
roles/artifactregistry.admin
- Cloud Build Editor:
roles/cloudbuild.builds.editor
- Secret Manager Admin:
roles/secretmanager.admin
The Project Factory module and the IAM module may be used in combination to provision a service account with the necessary roles applied.
A project with the following APIs enabled must be used to host the resources of this module:
- Google Cloud Storage JSON API:
storage-api.googleapis.com
- Cloud Functions API:
cloudfunctions.googleapis.com
- Cloud Run Admin API:
run.googleapis.com
- Cloud Build API:
cloudbuild.googleapis.com
- Artifact Registry API:
artifactregistry.googleapis.com
- Pub/Sub API:
pubsub.googleapis.com
- Secret Manager API:
secretmanager.googleapis.com
- EventArc API:
eventarc.googleapis.com
The Project Factory module can be used to provision a project with the necessary APIs enabled.
Refer to the contribution guidelines for information on contributing to this module.
Please see our security disclosure process.