refactored: to utilise the google adk and production grade agent

terraform/main.tf

@@ -1,106 +1,72 @@
-locals {
-  common_labels = merge({ managed_by = "terraform", workload = var.name }, var.labels)
-  services = toset([
-    "run.googleapis.com", "pubsub.googleapis.com", "storage.googleapis.com",
-    "firestore.googleapis.com", "artifactregistry.googleapis.com",
-    "logging.googleapis.com", "monitoring.googleapis.com", "vpcaccess.googleapis.com"
-  ])
-}
-
-resource "google_project_service" "apis" {
-  for_each           = local.services
-  project            = var.project_id
-  service            = each.value
-  disable_on_destroy = false
-}
-
-resource "google_compute_network" "app" {
-  name                    = "${var.name}-vpc"
-  auto_create_subnetworks = false
-  depends_on              = [google_project_service.apis]
-}
-
-resource "google_compute_subnetwork" "app" {
-  name          = "${var.name}-subnet"
-  ip_cidr_range = "10.10.0.0/24"
-  region        = var.region
-  network       = google_compute_network.app.id
-}
-
-resource "google_vpc_access_connector" "app" {
-  name          = substr("${var.name}-connector", 0, 24)
-  region        = var.region
-  network       = google_compute_network.app.name
-  ip_cidr_range = "10.8.0.0/28"
-  depends_on    = [google_project_service.apis]
-}
-
-resource "google_service_account" "runtime" {
-  account_id   = substr("${var.name}-runtime", 0, 30)
-  display_name = "${var.name} runtime identity"
-}
-
-resource "google_storage_bucket" "objects" {
-  name                        = "${var.project_id}-${var.name}-objects"
-  location                    = var.region
-  uniform_bucket_level_access = true
-  public_access_prevention    = "enforced"
-  labels                      = local.common_labels
-  lifecycle_rule {
-    condition { age = 365 }
-    action { type = "Delete" }
-  }
-  depends_on = [google_project_service.apis]
-}
-
-resource "google_firestore_database" "app" {
-  project     = var.project_id
-  name        = "(default)"
-  location_id = var.region
-  type        = "FIRESTORE_NATIVE"
-}
-
-resource "google_pubsub_topic" "events" {
-  name   = "${var.name}-events"
-  labels = local.common_labels
-}
-
-resource "google_pubsub_topic" "dead_letter" {
-  name   = "${var.name}-events-dead-letter"
-  labels = local.common_labels
-}
-
-resource "google_artifact_registry_repository" "containers" {
-  location      = var.region
-  repository_id = var.name
-  format        = "DOCKER"
-  labels        = local.common_labels
-}
-
-resource "google_cloud_run_v2_service" "app" {
-  name     = var.name
-  location = var.region
-  ingress  = "INGRESS_TRAFFIC_ALL"
-  labels   = local.common_labels
-  template {
-    service_account = google_service_account.runtime.email
-    scaling { max_instance_count = 20 }
-    vpc_access {
-      connector = google_vpc_access_connector.app.id
-      egress    = "PRIVATE_RANGES_ONLY"
+# Google Cloud Solution Architecture Baseline
+terraform {
+  required_version = ">= 1.5.0"
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 5.0"
     }
+  }
+}
+
+provider "google" {
+  project = var.project_id
+  region  = var.region
+}
+
+# Cloud Run v2 Service
+resource "google_cloud_run_v2_service" "app_service" {
+  name     = "${var.environment}-app-service"
+  location = var.region
+
+  template {
     containers {
       image = var.container_image
-      ports { container_port = 8080 }
-      resources { limits = { cpu = "1", memory = "512Mi" } }
+      ports {
+        container_port = 8080
+      }
     }
   }
-  depends_on = [google_project_service.apis]
 }
 
-resource "google_cloud_run_v2_service_iam_member" "public_invoker" {
-  name     = google_cloud_run_v2_service.app.name
-  location = var.region
-  role     = "roles/run.invoker"
-  member   = "allUsers"
+# Pub/Sub Topic for Event Ingestion
+resource "google_pubsub_topic" "event_ingestion" {
+  name = "${var.environment}-event-ingestion-topic"
+  labels = {
+    environment = var.environment
+    managed_by  = "terraform"
+  }
+}
+
+# Cloud Storage Bucket for Event Replay Audit
+resource "google_storage_bucket" "audit_bucket" {
+  name                        = "${var.project_id}-${var.environment}-audit-bucket"
+  location                    = var.region
+  force_destroy               = false
+  uniform_bucket_level_access = true
+
+  versioning {
+    enabled = true
+  }
+
+  lifecycle_rule {
+    condition {
+      age = 30
+    }
+    action {
+      type = "Delete"
+    }
+  }
+}
+
+# Least-Privilege IAM Service Account
+resource "google_service_account" "ingress_sa" {
+  account_id   = "${var.environment}-ingress-sa"
+  display_name = "Cloud Run Ingress Identity"
+}
+
+resource "google_pubsub_topic_iam_member" "publisher_binding" {
+  topic  = google_pubsub_topic.event_ingestion.name
+  role   = "roles/pubsub.publisher"
+  member = "serviceAccount:${google_service_account.ingress_sa.email}"
 }