doc

Author: multani

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Jonathan Ballet
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,71 @@
+# Terraform module to manage Google Cloud Function
+
+This is a personal (opiniated) Terraform module to manage [Google Cloud Function](https://cloud.google.com/functions/docs/).
+
+## How to use?
+
+```hcl
+module "stuff" {
+  source  = "app.terraform.io/multani/function/google"
+  version = "1.0.0"
+
+  name        = "do-stuff"
+  description = "Do some stuff"
+
+  location    = "europe-west6"
+  runtime     = "python312"
+  entry_point = "stuff_doer"
+
+  source_code = {
+    bucket = module.functions.bucket
+    object = module.functions.object
+  }
+
+  environment_variables = {
+    SOMETHING = "stuff"
+  }
+}
+
+# Authorize stuff to read GCP secrets
+resource "google_project_iam_member" "stuff" {
+  role    = "roles/secretmanager.secretAccessor"
+  member  = "serviceAccount:${module.stuff.service_account_email}"
+  project = data.google_project.this.project_id
+}
+```
+
+### Help me, it doesn't work!
+
+> [!IMPORTANT]
+>
+> If you are trying to deploy this module and you authenticate on Google Cloud
+> using a GCP service account (for instance, when running Terraform via
+> Terraform Cloud or a similar service ; in the example below, the service
+> account is called `terraform-sa`), you may get the following error while
+> trying to deploy the function:
+>
+> > Error while updating cloudfunction configuration: googleapi: Error 403: Missing necessary permission `iam.serviceAccounts.actAs` for `terraform-sa` on the service account `fun-stuff@my-gcp-project.iam.gserviceaccount.com`.
+> >
+> > Grant the role `roles/iam.serviceAccountUser` to `terraform-sa` on the service account `functions@multani-admin.iam.gserviceaccount.com`.
+> > You can do that by running `gcloud iam service-accounts add-iam-policy-binding functions@multani-admin.iam.gserviceaccount.com --member=terraform-sa --role=roles/iam.serviceAccountUser`.
+> > In case the member is a service account please use the prefix `serviceAccount:` instead of `user:`.
+> >
+> > If this is a cross-project service account usage ask a project owner to grant you the `iam.serviceAccountUser` role on the service account and/or set the `iam.disableCrossProjectServiceAccountUsage` org policy to `NOT ENFORCED` on the service account project.
+> >
+> > Please visit https://cloud.google.com/functions/docs/troubleshooting for in-depth troubleshooting documentation.
+>
+> Read the [IAM Cloud Function
+> documentation](https://developer.hashicorp.com/terraform/cloud-docs/workspaces)
+> for more information.
+
+In this case, reconfigure the "deployer" service account with the following:
+
+```hcl
+resource "google_service_account_iam_binding" "stuff" {
+  service_account_id = module.stuff.service_account_name
+  role               = "roles/iam.serviceAccountUser"
+
+  # The service account that tries to deploy the Cloud Function
+  members = ["serviceAccount:${google_service_account.deployer.email}"]
+}
+```

modules/code/README.md

@@ -0,0 +1,26 @@
+# Terraform module to manage Google Cloud Function source code
+
+This is a personal (opiniated) Terraform module to manage source code for [Google Cloud Function](https://cloud.google.com/functions/docs/).
+
+It uploads source code to a Google Cloud Storage bucket and "version" it using a checksum.
+
+
+## How to use?
+
+```hcl
+module "functions" {
+  source  = "app.terraform.io/multani/function/google//modules/code"
+  version = "1.0.0"
+
+  name        = "my-functions"
+  source_dir  = "${path.module}/src"
+
+  # A previously created storage bucket
+  bucket_name = data.google_storage_bucket.functions.name
+}
+```
+
+Use the following output to create a Cloud Function:
+
+* `bucket`: the name of the bucket where the source code is stored
+* `object`: the name of the object inside the bucket, where the source code is stored