decomposer: generate deliverable files for Discover and structure the solution's functional requirements, non-functional requirements, constraints, assumptions, and open questions without selecting cloud products.; Select Google Cloud products from the confirmed requirements and produce the solution architecture, Mermaid diagram, architecture description, and Terraform infrastructure-as-code.; Validate the Terraform infrastructure and architecture artifacts without deploying resources by running formatting checks, Terraform validation, and a dry-run or plan-oriented deployment check.; Package the approved requirements, architecture, Mermaid diagram, Terraform IaC, and validation results into solution-architecture-guide.md in the gcp_solution_architecture_agent repository.; Verify that the gcp_solution_architecture_agent repository contains the packaged solution-architecture-guide.md with the approved workflow outputs.; Verify that the repository is derived from the workflow_agent template and implements the complete four-phase Google Cloud solution architecture workflow alongside the packaged guide.; Publish the verified gcp_solution_architecture_agent repository with its completed workflow implementation and solution architecture guide.; Verify that the published repository revision contains the completed workflow implementation and solution architecture guide.

terraform/main.tf

@@ -1,110 +1,106 @@
-terraform {
-  required_version = ">= 1.6.0, < 2.0.0"
-  required_providers {
-    google = {
-      source  = "hashicorp/google"
-      version = "~> 6.0"
-    }
-  }
-}
-
-provider "google" {
-  project = var.project_id
-  region  = var.region
-}
-
-resource "google_project_service" "services" {
-  for_each = toset([
-    "run.googleapis.com", "sqladmin.googleapis.com", "pubsub.googleapis.com",
-    "artifactregistry.googleapis.com", "secretmanager.googleapis.com",
-    "logging.googleapis.com", "monitoring.googleapis.com", "cloudtrace.googleapis.com"
+locals {
+  common_labels = merge({ managed_by = "terraform", workload = var.name }, var.labels)
+  services = toset([
+    "run.googleapis.com", "pubsub.googleapis.com", "storage.googleapis.com",
+    "firestore.googleapis.com", "artifactregistry.googleapis.com",
+    "logging.googleapis.com", "monitoring.googleapis.com", "vpcaccess.googleapis.com"
   ])
+}
+
+resource "google_project_service" "apis" {
+  for_each           = local.services
   project            = var.project_id
   service            = each.value
   disable_on_destroy = false
 }
 
-resource "google_artifact_registry_repository" "images" {
-  location      = var.region
-  repository_id = "${var.name}-images"
-  format        = "DOCKER"
-  depends_on    = [google_project_service.services]
+resource "google_compute_network" "app" {
+  name                    = "${var.name}-vpc"
+  auto_create_subnetworks = false
+  depends_on              = [google_project_service.apis]
 }
 
-resource "google_sql_database_instance" "primary" {
-  name             = "${var.name}-sql"
-  database_version = "POSTGRES_15"
-  region           = var.region
-  settings {
-    tier              = var.sql_tier
-    availability_type = var.sql_ha ? "REGIONAL" : "ZONAL"
-    disk_type         = "PD_SSD"
-    disk_autoresize   = true
-    backup_configuration { enabled = true }
-    ip_configuration { ipv4_enabled = true }
-  }
-  deletion_protection = var.deletion_protection
-  depends_on          = [google_project_service.services]
+resource "google_compute_subnetwork" "app" {
+  name          = "${var.name}-subnet"
+  ip_cidr_range = "10.10.0.0/24"
+  region        = var.region
+  network       = google_compute_network.app.id
 }
 
-resource "google_sql_database" "app" {
-  name     = var.name
-  instance = google_sql_database_instance.primary.name
-}
-
-resource "google_pubsub_topic" "events" { name = "${var.name}-events" }
-resource "google_pubsub_topic" "dead_letter" { name = "${var.name}-dead-letter" }
-
-resource "google_pubsub_subscription" "worker" {
-  name  = "${var.name}-worker"
-  topic = google_pubsub_topic.events.name
-  dead_letter_policy {
-    dead_letter_topic     = google_pubsub_topic.dead_letter.id
-    max_delivery_attempts = 10
-  }
-  ack_deadline_seconds = 30
-}
-
-resource "google_secret_manager_secret" "database_url" {
-  secret_id = "${var.name}-database-url"
-  replication { auto {} }
-  depends_on = [google_project_service.services]
+resource "google_vpc_access_connector" "app" {
+  name          = substr("${var.name}-connector", 0, 24)
+  region        = var.region
+  network       = google_compute_network.app.name
+  ip_cidr_range = "10.8.0.0/28"
+  depends_on    = [google_project_service.apis]
 }
 
 resource "google_service_account" "runtime" {
-  account_id   = "${var.name}-runtime"
+  account_id   = substr("${var.name}-runtime", 0, 30)
   display_name = "${var.name} runtime identity"
 }
 
-resource "google_project_iam_member" "runtime_log_writer" {
-  project = var.project_id
-  role    = "roles/logging.logWriter"
-  member  = "serviceAccount:${google_service_account.runtime.email}"
+resource "google_storage_bucket" "objects" {
+  name                        = "${var.project_id}-${var.name}-objects"
+  location                    = var.region
+  uniform_bucket_level_access = true
+  public_access_prevention    = "enforced"
+  labels                      = local.common_labels
+  lifecycle_rule {
+    condition { age = 365 }
+    action { type = "Delete" }
+  }
+  depends_on = [google_project_service.apis]
 }
 
-resource "google_cloud_run_v2_service" "api" {
-  name     = "${var.name}-api"
-  location = var.region
-  template {
-    service_account = google_service_account.runtime.email
-    containers {
-      image = var.api_image
-      env { name = "PUBSUB_TOPIC" value = google_pubsub_topic.events.name }
-      env { name = "DATABASE_SECRET" value = google_secret_manager_secret.database_url.secret_id }
-    }
-  }
-  depends_on = [google_project_service.services]
+resource "google_firestore_database" "app" {
+  project     = var.project_id
+  name        = "(default)"
+  location_id = var.region
+  type        = "FIRESTORE_NATIVE"
 }
 
-resource "google_cloud_run_v2_service" "worker" {
-  name     = "${var.name}-worker"
+resource "google_pubsub_topic" "events" {
+  name   = "${var.name}-events"
+  labels = local.common_labels
+}
+
+resource "google_pubsub_topic" "dead_letter" {
+  name   = "${var.name}-events-dead-letter"
+  labels = local.common_labels
+}
+
+resource "google_artifact_registry_repository" "containers" {
+  location      = var.region
+  repository_id = var.name
+  format        = "DOCKER"
+  labels        = local.common_labels
+}
+
+resource "google_cloud_run_v2_service" "app" {
+  name     = var.name
   location = var.region
+  ingress  = "INGRESS_TRAFFIC_ALL"
+  labels   = local.common_labels
   template {
     service_account = google_service_account.runtime.email
+    scaling { max_instance_count = 20 }
+    vpc_access {
+      connector = google_vpc_access_connector.app.id
+      egress    = "PRIVATE_RANGES_ONLY"
+    }
     containers {
-      image = var.worker_image
-      env { name = "DATABASE_SECRET" value = google_secret_manager_secret.database_url.secret_id }
+      image = var.container_image
+      ports { container_port = 8080 }
+      resources { limits = { cpu = "1", memory = "512Mi" } }
     }
   }
-  depends_on = [google_project_service.services]
+  depends_on = [google_project_service.apis]
+}
+
+resource "google_cloud_run_v2_service_iam_member" "public_invoker" {
+  name     = google_cloud_run_v2_service.app.name
+  location = var.region
+  role     = "roles/run.invoker"
+  member   = "allUsers"
 }