This module handles the deployment required for Cloud Function (2nd Gen) usage. Secure-cloud-function module will call the secure-cloud-function-core, secure-cloud-serverless-net and secure-cloud-function-security modules.

When using a Shared VPC, you can chose where to create the VPC Connector.

Note: When using a single VPC you should provides VPC and Serverless project id with the same value and the value for connector_on_host_project variable must be false.

The resources/services/activations/deletions that this module will create/trigger are:

• secure-cloud-serverless-network module will apply:

  • Creates Firewall rules on your VPC Project.
    • Serverless to VPC Connector
    • VPC Connector to Serverless
    • VPC Connector to LB
    • VPC Connector Health Checks
  • Creates a sub network to VPC Connector usage purpose.
  • Creates Serverless Connector on your VPC Project or Serverless Project. Refer the comparison below:
    • Advantages of creating connectors in the VPC Project
    • Advantages of creating connectors in the Serverless Project
  • Grant the necessary roles for Cloud Function are able to use VPC Connector on your Shared VPC when creating VPC Connector in host project.
    • Grant Network User role to Cloud Services service account.
    • Grant VPC Access User to Cloud Function Service Identity when deploying VPC Access.

• secure-cloud-function-security module will apply:

  • Creates KMS Keyring and Key for customer managed encryption keys in the KMS Project to be used by Cloud Function (2nd Gen).
  • Enables Organization Policies related to Cloud Function (2nd Gen) in the Serverless Project.
    • Allow Ingress only from internal and Cloud Load Balancing.
    • Allow VPC Egress to Private Ranges Only.
  • When groups emails are provided, this module will grant the roles for each persona.
    • Serverless administrator - Service Project
      • roles/run.admin
      • roles/cloudfunctions.admin
      • roles/compute.networkViewer
      • compute.networkUser
    • Servervless Security Administrator - Security project
      • roles/cloudfunctions.viewer
      • roles/run.viewer
      • roles/cloudkms.viewer
      • roles/artifactregistry.reader
    • Cloud Function (2nd Gen) developer - Security project
      • roles/cloudfunctions.developer
      • roles/artifactregistry.writer
      • roles/cloudkms.cryptoKeyEncrypter
    • Cloud Function (2nd Gen) user - Service project
      • roles/cloudfunctions.invoker

• secure-cloud-function-core module will apply:

  • Creates a Cloud Function (2nd Gen).
  • Creates the Cloud Function source bucket in the same location as the Cloud Function.
  • Configure the EventArc Google Channel to use Customer Encryption Key in the Cloud Function location.
    • Warning: If there is another CMEK configured for the same region, it will be overwritten.
  • Creates a private worker pool for Cloud Build configured to not use External IP.
  • Grants Cloud Functions Invoker to EventArc Trigger Service Account.
  • Enables Container Scanning.

Basic usage of this module is as follows:

module "secure_cloud_function" {
  source  = "GoogleCloudPlatform/cloud-functions/google//modules/secure-cloud-function"
  version = "~> 0.6"

  function_name             = <FUNCTION-NAME>
  function_description      = <FUNCTION-DESCRIPTION>
  location                  = <FUNCTION-LOCATION>
  region                    = <FUNCTION-REGION>
  serverless_project_id     = <FUNCTION-PROJECT-ID>
  vpc_project_id            = <VPC-PROJECT-ID>
  kms_project_id            = <KMS-PROJECT-IF>
  key_name                  = <KMS-KEY-NAME>
  keyring_name              = <KMS-KEYRING-NAME>
  service_account_email     = <FUNCTION-SERVICE-ACCOUNT>
  connector_name            = <VPC-CONNECTOR-NAME>
  subnet_name               = <SUBNET-NAME>
  create_subnet             = false
  shared_vpc_name           = <SHARE-VPC-NAME>
  ip_cidr_range             = "10.0.0.0/28"

  storage_source = {
     bucket = <SOURCE-BUCKET-NAME>
     object = <SOURCE-FILE-NAME>
  }
  runtime     = <FUNCTION-RUNTIME>
  entry_point = <FUNCTION-ENTRY-POINT>
}

[
  {
    "max_age_seconds": 0,
    "method": [
      "GET"
    ],
    "origin": [
      "https://.cloud.google.com",
      "https://.corp.google.com",
      "https://.corp.google.com:",
      "https://.cloud.google",
      "https://.byoid.goog"
    ],
    "response_header": []
  }
]

list(object({
    # Object with keys:
    # - type - The type of the action of this Lifecycle Rule. Supported values: Delete and SetStorageClass.
    # - storage_class - (Required if action type is SetStorageClass) The target Storage Class of objects affected by this Lifecycle Rule.
    action = any

    # Object with keys:
    # - age - (Optional) Minimum age of an object in days to satisfy this condition.
    # - created_before - (Optional) Creation date of an object in RFC 3339 (e.g. 2017-06-13) to satisfy this condition.
    # - with_state - (Optional) Match to live and/or archived objects. Supported values include: "LIVE", "ARCHIVED", "ANY".
    # - matches_storage_class - (Optional) Storage Class of objects to satisfy this condition. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, STANDARD, DURABLE_REDUCED_AVAILABILITY.
    # - matches_prefix - (Optional) One or more matching name prefixes to satisfy this condition.
    # - matches_suffix - (Optional) One or more matching name suffixes to satisfy this condition
    # - num_newer_versions - (Optional) Relevant only for versioned objects. The number of newer versions of an object to satisfy this condition.
    condition = any
  }))

[
  {
    "action": {
      "type": "Delete"
    },
    "condition": {
      "age": 0,
      "days_since_custom_time": 0,
      "days_since_noncurrent_time": 0,
      "num_newer_versions": 3,
      "with_state": "ARCHIVED"
    }
  }
]

object({
    trigger_region        = optional(string)
    event_type            = string
    service_account_email = string
    pubsub_topic          = optional(string)
    retry_policy          = string
    event_filters = optional(set(object({
      attribute       = string
      attribute_value = string
      operator        = optional(string)
    })))
  })

object({
    group_serverless_administrator          = optional(string, null)
    group_serverless_security_administrator = optional(string, null)
    group_cloud_run_developer               = optional(string, null)
    group_cloud_run_user                    = optional(string, null)
  })

object({
    project_id   = optional(string)
    repo_name    = string
    branch_name  = string
    dir          = optional(string)
    tag_name     = optional(string)
    commit_sha   = optional(string)
    invert_regex = optional(bool, false)
  })

set(object({
    key_name   = string
    project_id = optional(string)
    secret     = string
    version    = string
  }))

set(object({
    mount_path = string
    project_id = optional(string)
    secret     = string
    versions = set(object({
      version = string
      path    = string
    }))
  }))

object({
    bucket     = string
    object     = string
    generation = optional(string, null)
  })

The following dependencies must be available:

• Terraform >= 1.3
• Terraform Provider for GCP < 5.0

The Secure-cloud-function module will enable the following APIs to the Serverless Project:

• Serverless Project
  • Container Scanning: containerscanning.googleapis.com

A service account with the following roles must be used to provision the resources of this module:

• VPC Project
  • Compute Shared VPC Admin: roles/compute.xpnAdmin
  • Network Admin: roles/compute.networkAdmin
  • Security Admin: roles/compute.securityAdmin
  • Serverless VPC Access Admin: roles/vpcaccess.admin
• KMS Project
  • Cloud KMS Admin: roles/cloudkms.admin
• Serverless Project
  • Viewer: roles/viewer
  • Cloud Function Developer: roles/cloudfunctions.developer
  • Compute Network User: roles/compute.networkUser
  • Artifact Registry Admin: roles/artifactregistry.admin
  • Cloud Build Editor: roles/cloudbuild.builds.editor
  • Cloud Build Worker Pool Owner: roles/cloudbuild.workerPoolOwner
  • Pub/Sub Admin: roles/pubsub.admin
  • Storage Admin: roles/storage.admin
  • Service Usage Admin: roles/serviceusage.serviceUsageAdmin
  • Eventarc Developer: roles/eventarc.developer
  • Organization Policy Administrator: roles/orgpolicy.policyAdmin
  • Project IAM Admin: roles/resourcemanager.projectIamAdmin