This example showcases the deployment of Secure Cloud Run, along with domain mapping and IAM policy for the service.

The resources/services/activations/deletions that this example will create/trigger are:

• Creates Firewall rules on your VPC Project.
  • Serverless to VPC Connector
  • VPC Connector to Serverless
  • VPC Connector to LB
  • VPC Connector Health Checks
• Creates a sub network to VPC Connector usage purpose.
• Creates Serverless Connector on your VPC Project or Serverless Project. Refer the comparison below:
  • Advantages of creating connectors in the VPC Project
  • Advantages of creating connectors in the Serverless Project
• Grant the necessary roles for Cloud Run are able to use VPC Connector on your Shared VPC when creating VPC Connector in host project.
  • Grant Network User role to Cloud Services service account.
  • Grant VPC Access User to Cloud Run Service Identity when deploying VPC Access.
  • Creates KMS Keyring and Key for customer managed encryption keys in the KMS Project to be used by Cloud Run.
  • Enables Organization Policies related to Cloud Run in the Serverless Project.
  • Allow Ingress only from internal and Cloud Load Balancing.
  • Allow VPC Egress to Private Ranges Only.
  • Creates a Cloud Run Service.
  • Creates a Load Balancer Service using Google-managed SSL certificates.
  • Creates Cloud Armor Service only including the pre-configured rules for SQLi, XSS, LFI, RCE, RFI, Scannerdetection, Protocolattack and Sessionfixation.

By default, this example will apply 2 organization policies at the project level for the Serverless Project.

• Allow Ingress only from internal and Cloud Load Balancing.
• Allow VPC Egress to Private Ranges Only.

To the organization policies to be applied at folder or organization level, the policy_for variable needs to be changed. Possible values: ["project", "folder", "organization"] and the variables folder_id or organization_id need to be be filled up, respectively.

To provision this example, run the following from within this directory:

• Rename terraform.example.tfvars to terraform.tfvars by running mv terraform.example.tfvars terraform.tfvars and update the file with values from your environment.
• terraform init to get the plugins
• terraform plan to see the infrastructure plan
• terraform apply to apply the infrastructure build

• Run terraform destroy to clean up your environment.

This example assumes that below mentioned pre-requisites are in place before consuming the example.

• All required APIs are enabled in the GCP Project.
• An Organization.
• A Billing Account.

object({
    group_serverless_administrator          = optional(string, null)
    group_serverless_security_administrator = optional(string, null)
    group_cloud_run_developer               = optional(string, null)
    group_cloud_run_user                    = optional(string, null)
  })

These sections describe requirements for using this example.

• Terraform ~> v0.13+
• Terraform Provider for GCP >= 3.53, < 5.0
• Terraform Provider for GCP Beta >= 3.53, < 5.0

A service account can be used with required roles to execute this example:

• Compute Shared VPC Admin: roles/compute.xpnAdmin
• Security Admin: roles/compute.securityAdmin
• Serverless VPC Access Admin: roles/vpcaccess.admin
• Cloud KMS Admin: roles/cloudkms.admin
• Serverless VPC Access Admin: roles/vpcaccess.admin
• Cloud Run Developer: roles/run.developer
• Compute Network User: roles/compute.networkUser
• Artifact Registry Reader: roles/artifactregistry.reader