terraform-google-cloud-function

A Terraform module to create a Google Cloud Function on Google Cloud Services (GCP).

This module supports Terraform version 1 and is compatible with the Terraform Google Provider version 4.

This module is part of our Infrastructure as Code (IaC) framework that enables our users and customers to easily deploy and manage reusable, secure, and production-grade cloud infrastructure.

• Module Features
• Getting Started
• Module Argument Reference
  • Top-level Arguments
    • Main Resource Configuration
    • Module Configuration
    • Extended Resource Configuration
      • Google storage archive bucket object
• Module Outputs
• External Documentation
  • Google Documentation
  • Terraform Google Provider Documentation
• Module Versioning
  • Backwards compatibility in 0.0.z and 0.y.z version
• About Mineiros
• Reporting Issues
• Contributing
• Makefile Targets
• License

Module Features

A Terraform base module for creating a google_cloudfunctions_function resource that creates a new Cloud Function.

In addition to creation of resource this module creates an accompanying google_storage_bucket_object for archiving. and supports additional features of the following modules:

• mineiros-io/terraform-google-cloud-function-iam

Getting Started

Most basic usage just setting required arguments:

module "terraform-google-cloud-function" {
  source = "github.com/mineiros-io/terraform-google-cloud-function.git?ref=v0.1.1"

  project     = "my-project"
  region      = "europe-west3"
  name        = "function-test"
  description = "My function"
  runtime     = "nodejs14"
}

Module Argument Reference

See variables.tf and examples/ for details and use-cases.

Top-level Arguments

Main Resource Configuration

• region: (Required string)

  The region where the Cloud Function will be created.

• project: (Required string)

  The ID of the project in which the resources belong.

• name: (Required string)

  A user-defined name of the function. The function names must be unique globally.

• runtime: (Required string)

  The runtime in which the function is going to run. Eg. nodejs10, nodejs12, nodejs14, python37, python38, python39, dotnet3, go113, java11, ruby27, etc.

• source_repository: (Optional any)

  Represents parameters related to source repository where a function is hosted. Cannot be set alongside source_archive. For details please see https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloudfunctions_function#source_repository

  The object accepts the following attributes:

  • url: (Required string)

    The URL pointing to the hosted repository where the function is defined. There are supported Cloud Source Repository URLs in the following formats:

    • To refer to a specific commit: https://source.developers.google.com/projects/*/repos/*/revisions/*/paths/*
    • To refer to a moveable alias (branch): https://source.developers.google.com/projects/*/repos/*/moveable-aliases/*/paths/*. To refer to HEAD, use the master moveable alias.
    • To refer to a specific fixed alias (tag): https://source.developers.google.com/projects/*/repos/*/fixed-aliases/*/paths/*

• entry_point: (Optional string)

  Name of the function that will be executed when the Google Cloud Function is triggered.

• event_trigger: (Optional object(event_trigger))

  A source that fires events in response to a condition in another service. Structure is documented below. Cannot be used with trigger_http.

  The event_trigger object accepts the following attributes:

  • event_type: (Required string)

    The type of event to observe. For example: google.storage.object.finalize. See the documentation on calling Cloud Functions for a full reference of accepted triggers.

  • resource: (Required string)

    The name or partial URI of the resource from which to observe events. For example, myBucket or projects/my-project/topics/my-topic.

  • failure_policy: (Optional object(failure_policy))

    Specifies policy for failed executions.

    A failure_policy object can have the following field:

    The failure_policy object accepts the following attributes:

    • retry: (Required bool)

      Whether the function should be retried on failure.

      Default is false.

• trigger_http: (Optional bool)

  Boolean variable. Any HTTP request (of a supported type) to the endpoint will trigger function execution. Supported HTTP request types are: POST, PUT, GET, DELETE, and OPTIONS. Endpoint is returned as https_trigger_url. Cannot be used with event_trigger.

  Default is false.

• description: (Optional string)

  The description of the function.

• timeout: (Optional number)

  (Optional) Timeout (in seconds) for the function. Cannot be more than 540 seconds.

  Default is 60.

• available_memory_mb: (Optional number)

  Memory (in MB), available to the function. Possible values include 128, 256, 512, 1024, etc.

  Default is 128.

• max_instances: (Optional number)

  The limit on the maximum number of function instances that may coexist at a given time. Setting maximum instances to 0 results in clearing existing maximum instances limits. Setting a 0 value does not pause your function.

• ingress_settings: (Optional string)

  String value that controls what traffic can reach the function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY. Changes to this field will recreate the cloud function.

  Default is "ALLOW_INTERNAL_ONLY".

• labels: (Optional map(string))

  A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.

  Default is {}.

• service_account_email: (Optional string)

  If defined, use the provided service account to run the function.

• environment_variables: (Optional map(string))

  A set of key/value environment variable pairs to assign to the function.

  Default is {}.

• build_environment_variables: (Optional map(string))

  A set of key/value environment variable pairs available during build time.

• vpc_connector: (Optional string)

  The VPC Network Connector that this cloud function can connect to. It should be set up as fully-qualified URI. The format of this field is projects/*/locations/*/connectors/*.

• vpc_connector_egress_settings: (Optional string)

  The egress settings for the connector, controlling what traffic is diverted through it. Allowed values are ALL_TRAFFIC and PRIVATE_RANGES_ONLY.

  Default is "PRIVATE_RANGES_ONLY".

• secret_environment_variables: (Optional list(secret_environment_variables))

  Secret environment variables configuration.

  Example:

  secret_environment_variables = [
    {
      key        = "var_a"
      project_id = "my-project"
      secret     = "my-secret"
      version    = "3"
    },
    {
      key     = "var_b"
      secret  = "my-other-secret"
      version = "3"
    }
  ]

  Each secret_environment_variables object in the list accepts the following attributes:

  • key: (Required string)

    Name of the environment variable.

  • project_id: (Optional string)

    Project identifier (due to a known limitation, only project number is supported by this field) of the project that contains the secret. If not set, it will be populated with the function's project, assuming that the secret exists in the same project as of the function.

  • secret: (Required string)

    ID of the secret in secret manager (not the full resource name).

  • version: (Required string)

    Version of the secret (version number or the string "latest"). It is recommended to use a numeric version for secret environment variables as any updates to the secret value is not reflected until new clones start.

Module Configuration

• module_enabled: (Optional bool)

  Specifies whether resources in the module will be created.

  Default is true.

• module_depends_on: (Optional list(dependency))

  A list of dependencies. Any object can be assigned to this list to define a hidden external dependency.

  Example:

  module_depends_on = [
    google_network.network
  ]

Extended Resource Configuration

• iam: (Optional list(iam))

  A list of IAM access.

  Example:

  iam = [{
    role          = "roles/secretmanager.admin"
    members       = ["user:[email protected]"]
    authoritative = false
  }]

  Each iam object in the list accepts the following attributes:

  • members: (Optional set(string))

    Identities that will be granted the privilege in role. Each entry can have one of the following values:

    • allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account.
    • allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account.
    • user:{emailid}: An email address that represents a specific Google account. For example, [email protected] or [email protected].
    • serviceAccount:{emailid}: An email address that represents a service account. For example, [email protected].
    • group:{emailid}: An email address that represents a Google group. For example, [email protected].
    • domain:{domain}: A G Suite domain (primary, instead of alias) name that represents all the users of that domain. For example, google.com or example.com.
    • projectOwner:projectid: Owners of the given project. For example, projectOwner:my-example-project
    • projectEditor:projectid: Editors of the given project. For example, projectEditor:my-example-project
    • projectViewer:projectid: Viewers of the given project. For example, projectViewer:my-example-project
    • computed:{identifier}: An existing key from var.computed_members_map.

    Default is [].

  • role: (Optional string)

    The role that should be applied. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

  • authoritative: (Optional bool)

    Whether to exclusively set (authoritative mode) or add (non-authoritative/additive mode) members to the role.

    Default is true.

• computed_members_map: (Optional map(string))

  A map of members to replace in members of various IAM settings to handle terraform computed values.

  Default is {}.

• policy_bindings: (Optional list(policy_binding))

  A list of IAM policy bindings.

  Example:

  policy_bindings = [{
    role      = "roles/secretmanager.admin"
    members   = ["user:[email protected]"]
    condition = {
      title       = "expires_after_2021_12_31"
      description = "Expiring at midnight of 2021-12-31"
      expression  = "request.time < timestamp(\"2022-01-01T00:00:00Z\")"
    }
  }]

  Each policy_binding object in the list accepts the following attributes:

  • role: (Required string)

    The role that should be applied.

  • members: (Optional set(string))

    Identities that will be granted the privilege in role.

    Default is var.members.

  • condition: (Optional object(condition))

    An IAM Condition for a given binding.

    Example:

    condition = {
      expression = "request.time < timestamp(\"2022-01-01T00:00:00Z\")"
      title      = "expires_after_2021_12_31"
    }

    The condition object accepts the following attributes:

    • expression: (Required string)

      Textual representation of an expression in Common Expression Language syntax.

    • title: (Required string)

      A title for the expression, i.e. a short string describing its purpose.

    • description: (Optional string)

      An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.

Google storage archive bucket object

• bucket: (Required string)

  The URI of the bucket that the archive that contains the function and its dependencies will be uploaded to.

• archive_upload_name: (Optional string)

  If provided, this value will overwrite the archive name on upload. If a specific archive name is requested for the uploaded object, then override the archive name.

• source_archive: (Required string)

  Path to the '.zip' archive that contains the source code of this Cloud Function.

Module Outputs

The following attributes are exported in the outputs of the module:

• module_enabled: (bool)

  Whether this module is enabled.

• cloud_function: (object(cloud_function))

  All outputs of the created google_cloudfunctions_function resource.

• bucket_object: (object(bucket_object))

  All outputs of the created google_storage_bucket_object resource.

• iam: (list(iam))

  The iam resource objects that define the access to the cloud function.

External Documentation

Google Documentation

• Cloud function: https://cloud.google.com/functions/docs
• Cloud function REST: https://cloud.google.com/functions/docs/reference/rest/v1/projects.locations.functions
• Storage bucket object: https://cloud.google.com/storage/docs/key-terms#objects

Terraform Google Provider Documentation

• https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloudfunctions_function
• https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/storage_bucket_object

Module Versioning

This Module follows the principles of Semantic Versioning (SemVer).

Given a version number MAJOR.MINOR.PATCH, we increment the:

1. MAJOR version when we make incompatible changes,
2. MINOR version when we add functionality in a backwards compatible manner, and
3. PATCH version when we make backwards compatible bug fixes.

Backwards compatibility in 0.0.z and 0.y.z version

• Backwards compatibility in versions 0.0.z is not guaranteed when z is increased. (Initial development)
• Backwards compatibility in versions 0.y.z is not guaranteed when y is increased. (Pre-release)

About Mineiros

Mineiros is a remote-first company headquartered in Berlin, Germany that solves development, automation and security challenges in cloud infrastructure.

Our vision is to massively reduce time and overhead for teams to manage and deploy production-grade and secure cloud infrastructure.

We offer commercial support for all of our modules and encourage you to reach out if you have any questions or need help. Feel free to email us at [email protected] or join our Community Slack channel.

Reporting Issues

We use GitHub Issues to track community reported issues and missing features.

Contributing

Contributions are always encouraged and welcome! For the process of accepting changes, we use Pull Requests. If you'd like more information, please see our Contribution Guidelines.

Makefile Targets

This repository comes with a handy Makefile. Run make help to see details on each available target.

License

This module is licensed under the Apache License Version 2.0, January 2004. Please see LICENSE for full details.

Copyright © 2020-2023 Mineiros GmbH