This module handles the deployment required for Cloud Run usage. Secure-cloud-run module will call the secure-cloud-run-core, secure-serverless-net and secure-cloud-run-security modules.

When using a Shared VPC, you can chose where to create the VPC Connector.

Note: When using a single VPC you should provides VPC and Serverless project id with the same value and the value for connector_on_host_project variable must be false.

The resources/services/activations/deletions that this module will create/trigger are:

• secure-serverless-net module will apply:

  • Creates Firewall rules on your VPC Project.
    • Serverless to VPC Connector
    • VPC Connector to Serverless
    • VPC Connector to LB
    • VPC Connector Health Checks
  • Creates a sub network to VPC Connector usage purpose.
  • Creates Serverless Connector on your VPC Project or Serverless Project. Refer the comparison below:
    • Advantages of creating connectors in the VPC Project
    • Advantages of creating connectors in the Serverless Project
  • Grant the necessary roles for Cloud Run be able to use VPC Connector on your Shared VPC when creating VPC Connector in host project.
    • Grant Network User role to Cloud Services service account.
    • Grant VPC Access User to Cloud Run Service Identity when deploying VPC Access.

• secure-cloud-run-security module will apply:

  • Creates KMS Keyring and Key for customer managed encryption keys in the KMS Project to be used by Cloud Run.
  • Enables Organization Policies related to Cloud Run in the Serverless Project.
  • Allow Ingress only from internal and Cloud Load Balancing.
  • Allow VPC Egress to Private Ranges Only.
  • When groups emails are provided, this module will grant the roles for each persona.
    • Serverless Administrator - Service Project
      • Cloud Run Administrator: roles/run.admin
      • Cloud Compute Network Viewer: roles/compute.networkViewer
      • Cloud Compute Network User: compute.networkUser
    • Servervless Security Administrator - Security Project
      • Cloud Run Viewer: roles/run.viewer
      • Cloud KMS Viewer: roles/cloudkms.viewer
      • roles/artifactregistry.reader
    • Cloud Run developer - Security Project
      • Cloud Run Develper: roles/run.developer
      • Cloud Run: roles/artifactregistry.writer
      • Cloud Run KMS Encrypter: roles/cloudkms.cryptoKeyEncrypter
    • Cloud Run user - Security Project
      • Cloud Run Invoker: roles/run.invoker

• secure-cloud-run-core module will apply:

  • Creates a Cloud Run Service.
  • Creates a Load Balancer Service using Google-managed SSL certificates.
  • Creates Cloud Armor Service only including the pre-configured rules for SQLi, XSS, LFI, RCE, RFI, Scannerdetection, Protocolattack and Sessionfixation.

Basic usage of this module is as follows:

module "secure_cloud_run" {
  source = "../modules/secure-cloud-run"

  vpc_project_id                          = <VPC Project ID>
  kms_project_id                          = <KMS Project ID>
  serverless_project_id                   = <Serverless Project ID>
  domain                                  = <Domain>
  shared_vpc_name                         = <Shared VPC Name
  ip_cidr_range                           = <IP CIDR Range>
  service_name                            = <Service Name>
  location                                = <Location>
  region                                  = <Region>
  image                                   = <Image>
  cloud_run_sa                            = <Cloud Run Service Account>
  artifact_registry_repository_location   = <Artifact Registry Repository Location>
  artifact_registry_repository_name       = <Artifact Registry Repository Name>
  artifact_registry_repository_project_id = <Artifact Registry Repository Project ID>
}

list(object({
    value = string
    name  = string
  }))

object({
    group_serverless_administrator          = optional(string, null)
    group_serverless_security_administrator = optional(string, null)
    group_cloud_run_developer               = optional(string, null)
    group_cloud_run_user                    = optional(string, null)
  })

object({
    ssl_certificates_self_links       = list(string)
    generate_certificates_for_domains = list(string)
  })

list(object({
    name = string
    secret = set(object({
      secret_name = string
      items       = map(string)
    }))
  }))

The following dependencies must be available:

• Terraform >= 0.13.0
• Terraform Provider for GCP < 5.0

The Secure-cloud-run module will enable the following APIs to the Serverlesss Project:

• Google VPC Access API: vpcaccess.googleapis.com
• Compute API: compute.googleapis.com
• Container Registry API: container.googleapis.com
• Cloud Run API: run.googleapis.com

The Secure-cloud-run module will enable the following APIs to the VPC Project:

• Google VPC Access API: vpcaccess.googleapis.com
• Compute API: compute.googleapis.com

The Secure-cloud-run module will enable the following APIs to the KMS Project:

• Cloud KMS API: cloudkms.googleapis.com

A service account with the following roles must be used to provision the resources of this module:

• VPC Project
  • Compute Shared VPC Admin: roles/compute.xpnAdmin
  • Network Admin: roles/compute.networkAdmin
  • Security Admin: roles/compute.securityAdmin
  • Serverless VPC Access Admin: roles/vpcaccess.admin
• KMS Project
  • Cloud KMS Admin: roles/cloudkms.admin
• Serverless Project
  • Security Admin: roles/compute.securityAdmin
  • Serverless VPC Access Admin: roles/vpcaccess.admin
  • Cloud Run Developer: roles/run.developer
  • Compute Network User: roles/compute.networkUser
  • Artifact Registry Reader: roles/artifactregistry.reader

Note: Secret Manager Secret Accessor role must be granted to the Cloud Run service account to allow read access on the secret.