# Cloud Function Module
Cloud Function management, with support for IAM roles and optional bucket creation.
The GCS object used for deployment uses a hash of the bundle zip contents in its name, which ensures change tracking and avoids recreating the function if the GCS object is deleted and needs recreating.
## TODO
- [ ] add support for `source_repository`
## Examples
### HTTP trigger
This deploys a Cloud Function with an HTTP endpoint, using a pre-existing GCS bucket for deployment, setting the service account to the Cloud Function default one, and delegating access control to the containing project.
```hcl
module "cf-http" {
source = "./modules/cloud-function"
project_id = "my-project"
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
source_dir = "my-cf-source-folder"
output_path = "bundle.zip"
excludes = null
}
}
# tftest skip
```
### PubSub and non-HTTP triggers
Other trigger types other than HTTP are configured via the `trigger_config` variable. This example shows a PubSub trigger.
```hcl
module "cf-http" {
source = "./modules/cloud-function"
project_id = "my-project"
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
source_dir = "my-cf-source-folder"
output_path = "bundle.zip"
excludes = null
}
trigger_config = {
event = "google.pubsub.topic.publish"
resource = local.my-topic
retry = null
}
}
# tftest skip
```
### Controlling HTTP access
To allow anonymous access to the function, grant the `roles/cloudfunctions.invoker` role to the special `allUsers` identifier. Use specific identities (service accounts, groups, etc.) instead of `allUsers` to only allow selective access.
```hcl
module "cf-http" {
source = "./modules/cloud-function"
project_id = "my-project"
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
source_dir = "my-cf-source-folder"
output_path = "bundle.zip"
excludes = null
}
iam = {
"roles/cloudfunctions.invoker" = ["allUsers"]
}
}
# tftest skip
```
### GCS bucket creation
You can have the module auto-create the GCS bucket used for deployment via the `bucket_config` variable. Setting `bucket_config.location` to `null` will also use the function region for GCS.
```hcl
module "cf-http" {
source = "./modules/cloud-function"
project_id = "my-project"
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bucket_config = {
location = null
lifecycle_delete_age = 1
}
bundle_config = {
source_dir = "my-cf-source-folder"
output_path = "bundle.zip"
excludes = null
}
}
# tftest skip
```
### Service account management
To use a custom service account managed by the module, set `service_account_create` to `true` and leave `service_account` set to `null` value (default).
```hcl
module "cf-http" {
source = "./modules/cloud-function"
project_id = "my-project"
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
source_dir = "my-cf-source-folder"
output_path = "bundle.zip"
excludes = null
}
service_account_create = true
}
# tftest skip
```
To use an externally managed service account, pass its email in `service_account` and leave `service_account_create` to `false` (the default).
```hcl
module "cf-http" {
source = "./modules/cloud-function"
project_id = "my-project"
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
source_dir = "my-cf-source-folder"
output_path = "bundle.zip"
excludes = null
}
service_account = local.service_account_email
}
# tftest skip
```
### Custom bundle config
In order to help prevent `archive_zip.output_md5` from changing cross platform (e.g. Cloud Build vs your local development environment), you'll have to make sure that the files included in the zip are always the same.
```hcl
module "cf-http" {
source = "./modules/cloud-function"
project_id = "my-project"
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
source_dir = "my-cf-source-folder"
output_path = "bundle.zip"
excludes = ["__pycache__"]
}
}
# tftest skip
```
## Variables
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
| [bucket_name](variables.tf#L26) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | string
| ✓ | |
| [bundle_config](variables.tf#L31) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | object({…})
| ✓ | |
| [name](variables.tf#L88) | Name used for cloud function and associated resources. | string
| ✓ | |
| [project_id](variables.tf#L99) | Project id used for all resources. | string
| ✓ | |
| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | object({…})
| | null
|
| [description](variables.tf#L40) | Optional description. | string
| | "Terraform managed."
|
| [environment_variables](variables.tf#L46) | Cloud function environment variables. | map(string)
| | {}
|
| [function_config](variables.tf#L52) | Cloud function configuration. | object({…})
| | {…}
|
| [iam](variables.tf#L70) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string))
| | {}
|
| [ingress_settings](variables.tf#L76) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | string
| | null
|
| [labels](variables.tf#L82) | Resource labels. | map(string)
| | {}
|
| [prefix](variables.tf#L93) | Optional prefix used for resource names. | string
| | null
|
| [region](variables.tf#L104) | Region used for all resources. | string
| | "europe-west1"
|
| [service_account](variables.tf#L110) | Service account email. Unused if service account is auto-created. | string
| | null
|
| [service_account_create](variables.tf#L116) | Auto-create service account. | bool
| | false
|
| [trigger_config](variables.tf#L122) | Function trigger configuration. Leave null for HTTP trigger. | object({…})
| | null
|
| [vpc_connector](variables.tf#L132) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…})
| | null
|
| [vpc_connector_config](variables.tf#L142) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…})
| | null
|
## Outputs
| name | description | sensitive |
|---|---|:---:|
| [bucket](outputs.tf#L17) | Bucket resource (only if auto-created). | |
| [bucket_name](outputs.tf#L24) | Bucket name. | |
| [function](outputs.tf#L29) | Cloud function resources. | |
| [function_name](outputs.tf#L34) | Cloud function name. | |
| [service_account](outputs.tf#L39) | Service account resource. | |
| [service_account_email](outputs.tf#L44) | Service account email. | |
| [service_account_iam_email](outputs.tf#L49) | Service account email. | |
| [vpc_connector](outputs.tf#L57) | VPC connector resource if created. | |