decomposer: generate deliverable files for Discover and structure the solution's functional requirements, non-functional requirements, constraints, assumptions, and open questions without selecting cloud products.; Select Google Cloud products from the confirmed requirements and produce the solution architecture, Mermaid diagram, architecture description, and Terraform infrastructure-as-code.; Validate the Terraform infrastructure and architecture artifacts without deploying resources by running formatting checks, Terraform validation, and a dry-run or plan-oriented deployment check.; Package the approved requirements, architecture, Mermaid diagram, Terraform IaC, and validation results into solution-architecture-guide.md in the gcp_solution_architecture_agent repository.; Verify that the gcp_solution_architecture_agent repository contains the packaged solution-architecture-guide.md with the approved workflow outputs.; Verify that the repository is derived from the workflow_agent template and implements the complete four-phase Google Cloud solution architecture workflow alongside the packaged guide.; Publish the verified gcp_solution_architecture_agent repository with its completed workflow implementation and solution architecture guide.; Verify that the published repository revision contains the completed workflow implementation and solution architecture guide.

terraform/main.tf

@@ -0,0 +1,95 @@
+terraform {
+  required_version = ">= 1.6.0, < 2.0.0"
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 6.0"
+    }
+  }
+}
+
+provider "google" {
+  project = var.project_id
+  region  = var.region
+}
+
+resource "google_project_service" "services" {
+  for_each = toset([
+    "artifactregistry.googleapis.com",
+    "logging.googleapis.com",
+    "monitoring.googleapis.com",
+    "pubsub.googleapis.com",
+    "run.googleapis.com",
+    "storage.googleapis.com",
+  ])
+  project            = var.project_id
+  service            = each.value
+  disable_on_destroy = false
+}
+
+resource "google_service_account" "runtime" {
+  account_id   = "event-runtime"
+  display_name = "Event runtime identity"
+  depends_on   = [google_project_service.services]
+}
+
+resource "google_storage_bucket" "raw_events" {
+  name                        = "${var.project_id}-${var.environment}-raw-events"
+  location                    = var.region
+  storage_class               = "STANDARD"
+  uniform_bucket_level_access = true
+  force_destroy               = false
+  retention_policy { retention_period = var.retention_seconds }
+  lifecycle_rule {
+    condition { age = var.retention_days }
+    action { type = "Delete" }
+  }
+  versioning { enabled = true }
+  depends_on = [google_project_service.services]
+}
+
+resource "google_pubsub_topic" "events" {
+  name       = "${var.environment}-events"
+  depends_on = [google_project_service.services]
+}
+
+resource "google_pubsub_subscription" "events" {
+  name                       = "${var.environment}-event-worker"
+  topic                      = google_pubsub_topic.events.id
+  ack_deadline_seconds       = 60
+  message_retention_duration = "604800s"
+  retry_policy {
+    minimum_backoff = "10s"
+    maximum_backoff = "600s"
+  }
+}
+
+resource "google_artifact_registry_repository" "containers" {
+  location      = var.region
+  repository_id = "${var.environment}-containers"
+  format        = "DOCKER"
+  depends_on    = [google_project_service.services]
+}
+
+resource "google_cloud_run_v2_service" "ingress" {
+  name     = "${var.environment}-event-ingress"
+  location = var.region
+  ingress  = "INGRESS_TRAFFIC_ALL"
+  template {
+    service_account = google_service_account.runtime.email
+    scaling { max_instance_count = var.max_instances }
+    containers {
+      image = var.container_image
+      env { name = "EVENT_TOPIC" value = google_pubsub_topic.events.id }
+      env { name = "RAW_BUCKET" value = google_storage_bucket.raw_events.name }
+    }
+  }
+  depends_on = [google_project_service.services]
+}
+
+resource "google_cloud_run_v2_service_iam_member" "ingress_invoker" {
+  name     = google_cloud_run_v2_service.ingress.name
+  location = google_cloud_run_v2_service.ingress.location
+  role     = "roles/run.invoker"
+  member   = "serviceAccount:${var.invoker_service_account}"
+}

terraform/outputs.tf

@@ -0,0 +1,7 @@
+output "ingress_url" {
+  value       = google_cloud_run_v2_service.ingress.uri
+  description = "HTTPS endpoint for authenticated producers."
+}
+
+output "raw_events_bucket" { value = google_storage_bucket.raw_events.name }
+output "events_topic" { value = google_pubsub_topic.events.name }

terraform/terraform.tfvars.example

@@ -0,0 +1,5 @@
+project_id               = "replace-with-existing-project"
+region                   = "us-central1"
+environment              = "dev"
+invoker_service_account  = "producer@example.iam.gserviceaccount.com"
+container_image          = "us-central1-docker.pkg.dev/replace-with-existing-project/dev-containers/ingress: approved-tag"

terraform/variables.tf

@@ -0,0 +1,32 @@
+variable "project_id" {
+  description = "Existing Google Cloud project ID."
+  type        = string
+  validation { condition = length(var.project_id) > 0 error_message = "project_id must not be empty." }
+}
+
+variable "region" {
+  description = "Regional placement for runtime and data."
+  type        = string
+  default     = "us-central1"
+}
+
+variable "environment" {
+  description = "Environment name used in resource names."
+  type        = string
+  default     = "dev"
+}
+
+variable "container_image" {
+  description = "Externally built image used by Cloud Run."
+  type        = string
+  default     = "us-docker.pkg.dev/cloudrun/container/hello"
+}
+
+variable "invoker_service_account" {
+  description = "Producer identity allowed to invoke ingress."
+  type        = string
+}
+
+variable "retention_days" { type = number default = 30 }
+variable "retention_seconds" { type = number default = 2592000 }
+variable "max_instances" { type = number default = 20 }