decomposer: generate deliverable files for Discover and structure the solution's functional requirements, non-functional requirements, constraints, assumptions, and open questions without selecting cloud products.; Select Google Cloud products from the confirmed requirements and produce the solution architecture, Mermaid diagram, architecture description, and Terraform infrastructure-as-code.; Validate the Terraform infrastructure and architecture artifacts without deploying resources by running formatting checks, Terraform validation, and a dry-run or plan-oriented deployment check.; Package the approved requirements, architecture, Mermaid diagram, Terraform IaC, and validation results into solution-architecture-guide.md in the gcp_solution_architecture_agent repository.; Verify that the gcp_solution_architecture_agent repository contains the packaged solution-architecture-guide.md with the approved workflow outputs.; Verify that the repository is derived from the workflow_agent template and implements the complete four-phase Google Cloud solution architecture workflow alongside the packaged guide.; Publish the verified gcp_solution_architecture_agent repository with its completed workflow implementation and solution architecture guide.; Verify that the published repository revision contains the completed workflow implementation and solution architecture guide.

terraform/main.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.6.0, < 2.0.0"
+  required_version = ">= 1.6.0"
   required_providers {
     google = {
       source  = "hashicorp/google"
@@ -13,83 +13,115 @@ provider "google" {
   region  = var.region
 }
 
-resource "google_project_service" "services" {
+resource "google_project_service" "required" {
   for_each = toset([
-    "artifactregistry.googleapis.com",
-    "logging.googleapis.com",
-    "monitoring.googleapis.com",
-    "pubsub.googleapis.com",
     "run.googleapis.com",
-    "storage.googleapis.com",
+    "pubsub.googleapis.com",
+    "sqladmin.googleapis.com",
+    "secretmanager.googleapis.com",
+    "artifactregistry.googleapis.com",
+    "vpcaccess.googleapis.com",
   ])
   project            = var.project_id
   service            = each.value
   disable_on_destroy = false
 }
 
+resource "google_compute_network" "app" {
+  name                    = "${var.name}-network"
+  auto_create_subnetworks = false
+}
+
+resource "google_vpc_access_connector" "app" {
+  name          = "${var.name}-vpc"
+  region        = var.region
+  network       = google_compute_network.app.name
+  ip_cidr_range = var.connector_cidr
+  depends_on    = [google_project_service.required]
+}
+
+resource "google_sql_database_instance" "orders" {
+  name             = "${var.name}-postgres"
+  database_version = "POSTGRES_15"
+  region           = var.region
+  settings {
+    tier              = var.sql_tier
+    availability_type = "ZONAL"
+    ip_configuration { ipv4_enabled = false }
+    backup_configuration { enabled = true }
+  }
+  deletion_protection = false
+  depends_on           = [google_project_service.required]
+}
+
+resource "google_sql_database" "orders" {
+  name     = "orders"
+  instance = google_sql_database_instance.orders.name
+}
+
+resource "google_sql_user" "orders" {
+  name     = var.db_user
+  instance = google_sql_database_instance.orders.name
+  password = var.db_password
+}
+
+resource "google_pubsub_topic" "orders" {
+  name = "${var.name}-orders"
+}
+
+resource "google_pubsub_topic" "dead_letter" {
+  name = "${var.name}-orders-dead-letter"
+}
+
+resource "google_pubsub_subscription" "worker" {
+  name  = "${var.name}-worker"
+  topic = google_pubsub_topic.orders.name
+  dead_letter_policy { dead_letter_topic = google_pubsub_topic.dead_letter.id max_delivery_attempts = 5 }
+  ack_deadline_seconds = 60
+}
+
 resource "google_service_account" "runtime" {
-  account_id   = "event-runtime"
-  display_name = "Event runtime identity"
-  depends_on   = [google_project_service.services]
+  account_id   = "${var.name}-runtime"
+  display_name = "Order service runtime identity"
 }
 
-resource "google_storage_bucket" "raw_events" {
-  name                        = "${var.project_id}-${var.environment}-raw-events"
-  location                    = var.region
-  storage_class               = "STANDARD"
-  uniform_bucket_level_access = true
-  force_destroy               = false
-  retention_policy { retention_period = var.retention_seconds }
-  lifecycle_rule {
-    condition { age = var.retention_days }
-    action { type = "Delete" }
-  }
-  versioning { enabled = true }
-  depends_on = [google_project_service.services]
+resource "google_project_iam_member" "publisher" {
+  project = var.project_id
+  role    = "roles/pubsub.publisher"
+  member  = "serviceAccount:${google_service_account.runtime.email}"
 }
 
-resource "google_pubsub_topic" "events" {
-  name       = "${var.environment}-events"
-  depends_on = [google_project_service.services]
+resource "google_secret_manager_secret" "db_password" {
+  secret_id = "${var.name}-db-password"
+  replication { auto {} }
 }
 
-resource "google_pubsub_subscription" "events" {
-  name                       = "${var.environment}-event-worker"
-  topic                      = google_pubsub_topic.events.id
-  ack_deadline_seconds       = 60
-  message_retention_duration = "604800s"
-  retry_policy {
-    minimum_backoff = "10s"
-    maximum_backoff = "600s"
-  }
+resource "google_secret_manager_secret_version" "db_password" {
+  secret      = google_secret_manager_secret.db_password.id
+  secret_data = var.db_password
 }
 
-resource "google_artifact_registry_repository" "containers" {
-  location      = var.region
-  repository_id = "${var.environment}-containers"
-  format        = "DOCKER"
-  depends_on    = [google_project_service.services]
-}
-
-resource "google_cloud_run_v2_service" "ingress" {
-  name     = "${var.environment}-event-ingress"
+resource "google_cloud_run_v2_service" "api" {
+  name     = "${var.name}-api"
   location = var.region
   ingress  = "INGRESS_TRAFFIC_ALL"
   template {
     service_account = google_service_account.runtime.email
-    scaling { max_instance_count = var.max_instances }
-    containers {
-      image = var.container_image
-      env { name = "EVENT_TOPIC" value = google_pubsub_topic.events.id }
-      env { name = "RAW_BUCKET" value = google_storage_bucket.raw_events.name }
-    }
+    scaling { max_instance_count = var.api_max_instances }
+    vpc_access { connector = google_vpc_access_connector.app.id egress = "PRIVATE_RANGES_ONLY" }
+    containers { image = var.api_image env { name = "ORDERS_TOPIC" value = google_pubsub_topic.orders.id } }
   }
-  depends_on = [google_project_service.services]
+  depends_on = [google_project_service.required]
 }
 
-resource "google_cloud_run_v2_service_iam_member" "ingress_invoker" {
-  name     = google_cloud_run_v2_service.ingress.name
-  location = google_cloud_run_v2_service.ingress.location
-  role     = "roles/run.invoker"
-  member   = "serviceAccount:${var.invoker_service_account}"
+resource "google_cloud_run_v2_service" "worker" {
+  name     = "${var.name}-worker"
+  location = var.region
+  template {
+    service_account = google_service_account.runtime.email
+    scaling { max_instance_count = var.worker_max_instances }
+    vpc_access { connector = google_vpc_access_connector.app.id egress = "PRIVATE_RANGES_ONLY" }
+    containers { image = var.worker_image }
+  }
+  depends_on = [google_project_service.required]
 }

terraform/outputs.tf

@@ -1,7 +1,3 @@
-output "ingress_url" {
-  value       = google_cloud_run_v2_service.ingress.uri
-  description = "HTTPS endpoint for authenticated producers."
-}
-
-output "raw_events_bucket" { value = google_storage_bucket.raw_events.name }
-output "events_topic" { value = google_pubsub_topic.events.name }
+output "api_uri" { value = google_cloud_run_v2_service.api.uri }
+output "orders_topic" { value = google_pubsub_topic.orders.name }
+output "database_instance" { value = google_sql_database_instance.orders.name }

terraform/variables.tf

@@ -1,32 +1,11 @@
-variable "project_id" {
-  description = "Existing Google Cloud project ID."
-  type        = string
-  validation { condition = length(var.project_id) > 0 error_message = "project_id must not be empty." }
-}
-
-variable "region" {
-  description = "Regional placement for runtime and data."
-  type        = string
-  default     = "us-central1"
-}
-
-variable "environment" {
-  description = "Environment name used in resource names."
-  type        = string
-  default     = "dev"
-}
-
-variable "container_image" {
-  description = "Externally built image used by Cloud Run."
-  type        = string
-  default     = "us-docker.pkg.dev/cloudrun/container/hello"
-}
-
-variable "invoker_service_account" {
-  description = "Producer identity allowed to invoke ingress."
-  type        = string
-}
-
-variable "retention_days" { type = number default = 30 }
-variable "retention_seconds" { type = number default = 2592000 }
-variable "max_instances" { type = number default = 20 }
+variable "project_id" { type = string }
+variable "region" { type = string default = "us-central1" }
+variable "name" { type = string default = "orders" }
+variable "connector_cidr" { type = string default = "10.8.0.0/28" }
+variable "sql_tier" { type = string default = "db-custom-1-3840" }
+variable "db_user" { type = string default = "orders_app" }
+variable "db_password" { type = string sensitive = true }
+variable "api_image" { type = string default = "us-docker.pkg.dev/cloudrun/container/placeholder-api:latest" }
+variable "worker_image" { type = string default = "us-docker.pkg.dev/cloudrun/container/placeholder-worker:latest" }
+variable "api_max_instances" { type = number default = 20 }
+variable "worker_max_instances" { type = number default = 20 }