GCP Cloud Function

Creates a Cloud Function (gen2) from a source directory, with scaling, secrets, and invoker IAM.

Use this module when a Rabbit service needs a small HTTP endpoint that belongs in source control - webhook receivers, callbacks, and glue APIs that do not justify a container image.

Supported Features

• Source directory zipped and deployed by Terraform; source changes redeploy automatically via a content hash in the archive object name.
• Runtime, entry point, build-time environment variables, scaling, memory/CPU, timeout, and concurrency configuration.
• Environment variables, with Secret Manager-backed values via secret_env; an explicitly configured service_account is automatically granted roles/secretmanager.secretAccessor on exactly those secrets.
• roles/run.invoker grants via the invokers list, applied to the function's underlying Cloud Run service (gen2 invocations are authorized there, not on the function's own IAM policy).
• Ingress restriction and dedicated runtime service account.

Prerequisites

• GCP credentials with permission to manage Cloud Functions, Cloud Storage, and service IAM (roles/cloudfunctions.admin, roles/storage.admin, roles/run.admin, roles/iam.serviceAccountUser). With secret_env and a configured service_account, the automatic per-secret grants also require roles/secretmanager.admin.
• The cloudfunctions.googleapis.com, cloudbuild.googleapis.com, run.googleapis.com, and artifactregistry.googleapis.com APIs enabled on the project (enabled automatically via google_api_name and google_api_names).
• For secret_env: when service_account is set, the module grants it roles/secretmanager.secretAccessor on exactly the referenced secrets. When it is unset (compute default SA), grant access yourself.

Important Notes

• source_dir is read by the R2A runner at plan time. Use the #{Workspace} placeholder for paths inside the deployed repository checkout; absolute paths also work.
• The module creates a per-function source bucket (<project>-<function_name>-<region>-<hash>, 63-character cap with an 8-character hash of the full identity) and destroys it with the function; it only holds build artifacts.
• Changing the source tree changes the archive hash, which redeploys the function - no manual version bumping.
• Functions are IAM-gated by default: with no invokers, nothing can call the function. Add "allUsers" to invokers for public access and enforce application-level auth in code.
• secret_env always references the latest secret version; rotate by adding a new version.
• Renaming function_name recreates the function and changes its trigger URI.

Minimal Example

services:
  - name: "OTP Mailbox"
    module: "gcp-cloud-function"
    id: "otp-mailbox"
    configurations:
      function_name: "otp-mailbox"
      region: "us-east1"
      runtime: "nodejs22"
      entry_point: "otpMailbox"
      source_dir: "#{Workspace}/ci/otp-mailbox"
      secret_env:
        MAILBOX_SECRET: "otp-mailbox-secret"
      invokers:
        - "allUsers"

Outputs

Output	Description
function_name	Cloud Function name.
function_url	Deployed URL of the function (cloudfunctions.net).
service_uri	URI of the underlying Cloud Run service (run.app).
source_object	Name of the deployed source archive in the source bucket.

Full Configuration Schema

configurations:
  function_name: ""               # Required. Function name, unique per region.
  region: "us-central1"           # Optional. Deployment region.
  runtime: "nodejs22"             # Required. Gen2 runtime identifier.
  entry_point: ""                 # Required. Exported function to invoke.
  source_dir: ""                  # Required. Directory with the function source (zipped at plan time).
  # source_excludes: []           # Optional. Paths excluded from the source archive.

  # Scaling
  min_instances: 0                # Optional. Minimum instances (0 = scale to zero).
  max_instances: 3                # Optional. Maximum instances.

  # Resources
  memory: "256Mi"                 # Optional. Available memory per instance.
  cpu: "1"                        # Optional. Available CPU per instance.
  timeout_seconds: 60             # Optional. Request timeout in seconds.
  concurrency: 80                 # Optional. Max concurrent requests per instance.

  # Access: ALLOW_ALL, ALLOW_INTERNAL_ONLY, ALLOW_INTERNAL_AND_GCLB
  ingress: "ALLOW_ALL"

  # Runtime service account (defaults to the project's compute default SA)
  # service_account: "sa-my-function@my-project.iam.gserviceaccount.com"

  # Plain environment variables
  env: {}
    # TOPIC: "my-topic"

  # Environment variables sourced from Secret Manager (latest version)
  secret_env: {}
    # MAILBOX_SECRET: "my-mailbox-secret"

  # Build-time environment variables
  build_env: {}
    # NPM_CONFIG_FLAG: "value"

  # Members granted roles/run.invoker on this function
  invokers: []
    # - "allUsers"
    # - "serviceAccount:sa-caller@my-project.iam.gserviceaccount.com"