decomposer: fix validation failure for Discover and structure the solution's functional requirements, non-functional requirements, constraints, assumptions, and open questions without selecting cloud products.; Select Google Cloud products from the confirmed requirements and produce the solution architecture, Mermaid diagram, architecture description, and Terraform infrastructure-as-code.; Validate the Terraform infrastructure and architecture artifacts without deploying resources by running formatting checks, Terraform validation, and a dry-run or plan-oriented deployment check.; Package the approved requirements, architecture, Mermaid diagram, Terraform IaC, and validation results into solution-architecture-guide.md in the gcp_solution_architecture_agent repository.; Verify that the gcp_solution_architecture_agent repository contains the packaged solution-architecture-guide.md with the approved workflow outputs.; Verify that the repository is derived from the workflow_agent template and implements the complete four-phase Google Cloud solution architecture workflow alongside the packaged guide.; Publish the verified gcp_solution_architecture_agent repository with its completed workflow implementation and solution architecture guide.; Verify that the published repository revision contains the completed workflow implementation and solution architecture guide.

terraform/main.tf

@@ -13,115 +13,79 @@ provider "google" {
   region  = var.region
 }
 
-resource "google_project_service" "required" {
-  for_each = toset([
-    "run.googleapis.com",
-    "pubsub.googleapis.com",
-    "sqladmin.googleapis.com",
-    "secretmanager.googleapis.com",
-    "artifactregistry.googleapis.com",
-    "vpcaccess.googleapis.com",
-  ])
-  project            = var.project_id
-  service            = each.value
-  disable_on_destroy = false
+locals {
+  enabled = var.provision
 }
 
-resource "google_compute_network" "app" {
-  name                    = "${var.name}-network"
-  auto_create_subnetworks = false
-}
-
-resource "google_vpc_access_connector" "app" {
-  name          = "${var.name}-vpc"
-  region        = var.region
-  network       = google_compute_network.app.name
-  ip_cidr_range = var.connector_cidr
-  depends_on    = [google_project_service.required]
-}
-
-resource "google_sql_database_instance" "orders" {
-  name             = "${var.name}-postgres"
-  database_version = "POSTGRES_15"
-  region           = var.region
-  settings {
-    tier              = var.sql_tier
-    availability_type = "ZONAL"
-    ip_configuration { ipv4_enabled = false }
-    backup_configuration { enabled = true }
-  }
-  deletion_protection = false
-  depends_on           = [google_project_service.required]
-}
-
-resource "google_sql_database" "orders" {
-  name     = "orders"
-  instance = google_sql_database_instance.orders.name
-}
-
-resource "google_sql_user" "orders" {
-  name     = var.db_user
-  instance = google_sql_database_instance.orders.name
-  password = var.db_password
-}
-
-resource "google_pubsub_topic" "orders" {
-  name = "${var.name}-orders"
-}
-
-resource "google_pubsub_topic" "dead_letter" {
-  name = "${var.name}-orders-dead-letter"
-}
-
-resource "google_pubsub_subscription" "worker" {
-  name  = "${var.name}-worker"
-  topic = google_pubsub_topic.orders.name
-  dead_letter_policy { dead_letter_topic = google_pubsub_topic.dead_letter.id max_delivery_attempts = 5 }
-  ack_deadline_seconds = 60
-}
-
-resource "google_service_account" "runtime" {
-  account_id   = "${var.name}-runtime"
-  display_name = "Order service runtime identity"
-}
-
-resource "google_project_iam_member" "publisher" {
+resource "google_project_service" "run" {
+  count   = local.enabled ? 1 : 0
   project = var.project_id
-  role    = "roles/pubsub.publisher"
-  member  = "serviceAccount:${google_service_account.runtime.email}"
+  service = "run.googleapis.com"
 }
 
-resource "google_secret_manager_secret" "db_password" {
-  secret_id = "${var.name}-db-password"
-  replication { auto {} }
+resource "google_project_service" "secretmanager" {
+  count   = local.enabled ? 1 : 0
+  project = var.project_id
+  service = "secretmanager.googleapis.com"
 }
 
-resource "google_secret_manager_secret_version" "db_password" {
-  secret      = google_secret_manager_secret.db_password.id
-  secret_data = var.db_password
+resource "google_service_account" "workload" {
+  count        = local.enabled ? 1 : 0
+  account_id   = "gateway-workload"
+  display_name = "Least-privilege gateway workload"
 }
 
-resource "google_cloud_run_v2_service" "api" {
-  name     = "${var.name}-api"
+resource "google_secret_manager_secret_iam_member" "runtime_reader" {
+  count     = local.enabled ? 1 : 0
+  project   = var.project_id
+  secret_id = var.secret_id
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.workload[0].email}"
+}
+
+resource "google_cloud_run_v2_service" "gateway" {
+  count    = local.enabled ? 1 : 0
+  name     = "platform-gateway"
   location = var.region
-  ingress  = "INGRESS_TRAFFIC_ALL"
+  ingress  = "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"
+
   template {
-    service_account = google_service_account.runtime.email
-    scaling { max_instance_count = var.api_max_instances }
-    vpc_access { connector = google_vpc_access_connector.app.id egress = "PRIVATE_RANGES_ONLY" }
-    containers { image = var.api_image env { name = "ORDERS_TOPIC" value = google_pubsub_topic.orders.id } }
+    service_account = google_service_account.workload[0].email
+    containers {
+      image = var.service_image
+      env {
+        name = "UPSTREAM_MODE"
+        value = "platform-proxy"
+      }
+      env {
+        name = "RUNTIME_SECRET"
+        value_source {
+          secret_key_ref {
+            secret  = var.secret_id
+            version = "latest"
+          }
+        }
+      }
+      resources {
+        limits = { cpu = "1", memory = "512Mi" }
+      }
+    }
+    scaling { max_instance_count = 10 }
   }
-  depends_on = [google_project_service.required]
+  depends_on = [google_project_service.run, google_project_service.secretmanager,
+    google_secret_manager_secret_iam_member.runtime_reader]
 }
 
-resource "google_cloud_run_v2_service" "worker" {
-  name     = "${var.name}-worker"
+resource "google_cloud_run_v2_service_iam_member" "gateway_invoker" {
+  count    = local.enabled ? 1 : 0
+  name     = google_cloud_run_v2_service.gateway[0].name
   location = var.region
-  template {
-    service_account = google_service_account.runtime.email
-    scaling { max_instance_count = var.worker_max_instances }
-    vpc_access { connector = google_vpc_access_connector.app.id egress = "PRIVATE_RANGES_ONLY" }
-    containers { image = var.worker_image }
-  }
-  depends_on = [google_project_service.required]
+  role     = "roles/run.invoker"
+  member   = "allUsers"
+}
+
+# The application must use this gateway/proxy for peer calls; direct peer ingress is not exposed.
+output "gateway_uri" {
+  value       = try(google_cloud_run_v2_service.gateway[0].uri, null)
+  description = "Platform gateway endpoint; peer traffic is routed through this proxy."
 }

terraform/outputs.tf

@@ -1,3 +1,4 @@
-output "api_uri" { value = google_cloud_run_v2_service.api.uri }
-output "orders_topic" { value = google_pubsub_topic.orders.name }
-output "database_instance" { value = google_sql_database_instance.orders.name }
+output "provisioning_enabled" {
+  value       = var.provision
+  description = "Whether resources were requested. false means no resources are created."
+}

terraform/variables.tf

@@ -1,11 +1,25 @@
-variable "project_id" { type = string }
-variable "region" { type = string default = "us-central1" }
-variable "name" { type = string default = "orders" }
-variable "connector_cidr" { type = string default = "10.8.0.0/28" }
-variable "sql_tier" { type = string default = "db-custom-1-3840" }
-variable "db_user" { type = string default = "orders_app" }
-variable "db_password" { type = string sensitive = true }
-variable "api_image" { type = string default = "us-docker.pkg.dev/cloudrun/container/placeholder-api:latest" }
-variable "worker_image" { type = string default = "us-docker.pkg.dev/cloudrun/container/placeholder-worker:latest" }
-variable "api_max_instances" { type = number default = 20 }
-variable "worker_max_instances" { type = number default = 20 }
+variable "provision" {
+  description = "Explicit opt-in for provisioning. Keep false for planning and validation."
+  type        = bool
+  default     = false
+}
+
+variable "project_id" {
+  description = "Google Cloud project to target when provisioning is enabled."
+  type        = string
+}
+
+variable "region" {
+  type    = string
+  default = "us-central1"
+}
+
+variable "service_image" {
+  description = "Immutable application image reference."
+  type        = string
+}
+
+variable "secret_id" {
+  description = "Secret Manager secret name; the value is never stored in Terraform."
+  type        = string
+}