Make IT Work Cloud GCP OpenTofu root

This root creates and manages the Make IT Work Cloud GCP project, its GCS OpenTofu backend, the Cloud KMS key used by SOPS, GitHub Actions Workload Identity Federation, project API enablement, restricted API keys, and an optional billing budget.

Bootstrap

Use user Application Default Credentials for the one-time bootstrap. Do not create a service-account key file.

1. Confirm the project ID is available and that the active identity can create a project, attach the configured billing account, enable services, and grant IAM roles.
2. Run make bootstrap-plan. This creates an ignored, backend-free local copy solely for the initial stateful bootstrap.
3. Review and explicitly approve the local-state plan, then run make bootstrap-apply.
4. After the state bucket exists, run make bootstrap-migrate to move state to GCS and remove the local bootstrap workspace.
5. Configure GitHub Actions with the github_workload_identity_provider and terraformer_service_account_email outputs. Protect main, because any workflow in this repository can impersonate the automation account.

terraformer_project_roles defaults to roles/owner so the root can manage all project resources. This is intentionally explicit and should be narrowed once the required resource set is established.

API keys

api_keys defaults to an empty map. Any key created by this root must define at least one allowed API service and exactly one application restriction type: HTTP referrers for browser clients or source IP addresses for server clients. Use generativelanguage.googleapis.com as the API target for Gemini Developer API keys. API key strings are never declared in source or outputs, but provider state can still contain sensitive key material; protect the GCS backend accordingly.

SOPS

After the initial apply creates the KMS key, create encrypted application configuration under secrets/ with the recipient defined in .sops.yaml. Never commit plaintext secrets or decrypt them to terminal output.

Requirements

Name	Version
terraform	> 1.3
google	~> 7.0

Providers

Name	Version
google	~> 7.0

Modules

No modules.

Resources

Name	Type
google_apikeys_key.this	resource
google_billing_budget.project	resource
google_iam_workload_identity_pool.github	resource
google_iam_workload_identity_pool_provider.github	resource
google_kms_crypto_key.sops	resource
google_kms_key_ring.sops	resource
google_project.this	resource
google_project_iam_member.terraformer	resource
google_project_service.this	resource
google_service_account.terraformer	resource
google_service_account_iam_member.github_workload_identity_user	resource
google_storage_bucket.state	resource

Inputs

Name	Description	Type	Default	Required
api_keys	Named API keys with mandatory API and application restrictions. API key strings are deliberately not output.	map(object({ display_name = string api_targets = set(string) allowed_referrers = optional(set(string), []) allowed_ips = optional(set(string), []) }))	{}	no
billing_account_id	Billing account ID without the billingAccounts/ prefix.	string	"01927F-E3CF2E-1488D3"	no
folder_id	Optional folder ID for the project. Leave null to create at the organization root.	string	null	no
monthly_budget_usd	Optional whole-dollar monthly billing budget. Set null to defer budget creation.	number	null	no
org_id	Optional organization ID for the project. Leave null for a standalone project.	string	null	no
project_id	Globally unique GCP project ID to create and manage.	string	"makeitworkcloud"	no
project_name	Human-readable GCP project name.	string	"Make IT Work Cloud"	no
region	Primary region for regional services, the state bucket, and the SOPS KMS key ring.	string	"us-west3"	no
state_bucket_name	Globally unique GCS bucket name for the migrated OpenTofu state backend.	string	"makeitworkcloud-tf-gcp-infra"	no
terraformer_project_roles	Project roles granted to the automation service account. Keep this explicit because broad roles affect all project resources.	set(string)	[ "roles/owner" ]	no
terraformer_service_account_id	Account ID of the GitHub Actions Workload Identity Federation service account.	string	"terraformer"	no

Outputs

Name	Description
github_workload_identity_provider	GitHub Actions Workload Identity Provider resource name.
project_id	Created GCP project ID.
sops_kms_resource	Cloud KMS resource for SOPS gcp_kms recipients.
state_bucket_name	GCS bucket to configure as the OpenTofu backend after bootstrap.
terraformer_service_account_email	GitHub Actions Workload Identity Federation service account email.