Cloud Run Job (v2)

gcp-cloud-run-job

Cloud Run v2 Job — run-to-completion container workloads (batch processing, database migrations, scheduled/cron tasks) with the security and reliability wiring hand-rolled configs skip: a dedicated runtime service account (never the project default compute SA), least-privilege Secret Manager accessor grants on exactly the secrets the job references, Direct VPC egress or connector support, a bounded retry count and per-task timeout, and deletion protection on by default. Works with Terraform and OpenTofu (>= 1.6), Google provider >= 7.0, < 8.0.

Creating a job defines it but does not run it — execute it on demand (gcloud run jobs execute <name>) or on a schedule via Cloud Scheduler, Workflows or Eventarc.

What you get per module call:

• One Cloud Run v2 job with configurable task count and parallelism
• A dedicated runtime service account (or supply your own)
• Plain and Secret-Manager-sourced env vars + secret volume mounts, with the accessor grants wired automatically
• VPC egress (connector or Direct VPC) for reaching private resources
• Bounded max_retries and task_timeout_seconds instead of unbounded defaults
• roles/run.invoker grants listing exactly who may execute the job

Requirements

Requirement	Version
Terraform / OpenTofu	>= 1.6
hashicorp/google	>= 7.0, < 8.0

The Cloud Run Admin API (run.googleapis.com) must be enabled on the project.

Verification

Static-validated (fmt, validate, tflint). Live apply/destroy testing pending cloud sandbox availability — see catalog status.

License

Commercial — IaC Bazaar EULA. © IaC Bazaar. Original work (not derived from a third-party module).