IaC Bazaar
Browse modules
Menu
Google CloudStatic-verified

The App Engine Application: One per Project, Forever

The application cannot be deleted and its region cannot be changed - destroy removes it from state and nothing else - and the region pins Firestore for the project. Without IAP every service is public on its appspot hostname. The permanent region must be accepted by name, IAP fronts every service unless public is stated, and a disabled serving status is a choice rather than an accident.

terraformGoogle Cloudgcp
gcp-app-enginevizier v1.2.0

Verification

Static-verified

Passed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).

Conformance

  • Static validation (fmt · validate · tflint)
  • No applicable security policies for this provider
  • Plan tests (mocked: validation rules · outputs)

Provenance

  • SHA-256 checksum
  • Signature (pending)

Functional

  • Live test pending (no cloud run yet)

Last verified 2026-09-14 · how we verify

Use it from the registry

terraform · opentofu
module "app_engine" {
  source  = "www.iac-bazaar.com/iac-bazaar/gcp-app-engine/gcp"
  version = "1.0.0"
}

Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.

Create a free account →Sign in

Documentation

gcp-app-engine

The App Engine application: one per project, forever, so the choices are made once. Works with Terraform and OpenTofu (>= 1.6), google provider >= 6.0, < 7.0.

This resource cannot be deleted, and its region is permanent. The module requires accept_permanent_location = true so the region is a reviewed decision.

The location also pins Firestore when database_type is set.

Without IAP, every service is public on its appspot.com hostname. IAP here, or accept_public_services.

serving_status = "USER_DISABLED" stops everything; needs accept_disabled_application.

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.

Usage code & full reference need an account

The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.

  • Usage
Create a free accountSign in

Related modules

Live-tested

gcp-cloud-function

Event-driven or HTTP gen2 function with source upload, dedicated runtime SA and Eventarc trigger wiring.

View module
Live-tested

gcp-cloud-run-job

A Cloud Run v2 Job for batch and run-to-completion workloads with a dedicated runtime service account, auto-wired Secret Manager accessor grants, VPC egress, bounded retries and per-task timeout.

View module
Live-tested

gcp-cloud-run-service

Cloud Run v2 service with autoscaling, secret and VPC egress wiring, custom domain and invoker IAM done right.

View module