Cloud Run Service

gcp-cloud-run-service

Cloud Run v2 service with autoscaling, secret and VPC egress wiring, custom domain and invoker IAM done right. One module call gives you a production revision template: a dedicated runtime service account, Secret Manager env vars/volumes with least-privilege accessor grants wired automatically, direct VPC egress or connector support, a cost-capping max-instance default, and a domain mapping whose DNS records come back as an output. Works with Terraform and OpenTofu (>= 1.6), Google provider >= 7.0, < 8.0.

Secure defaults:

• Dedicated runtime service account (never the default compute SA)
• Private by default: no invoker IAM unless you list members; allUsers only via the explicit allow_unauthenticated = true opt-in
• Secret access granted per referenced secret, not project-wide
• max_instances = 10 cost cap, gen2 execution environment, startup CPU boost
• deletion_protection = true

Requirements

Requirement	Version
Terraform / OpenTofu	>= 1.6
hashicorp/google	>= 7.0, < 8.0

Verification

Static-validated (fmt, validate, tflint). Live apply/destroy testing pending cloud sandbox availability — see catalog status.

License

Commercial — IaC Bazaar EULA. © IaC Bazaar. Original work (not derived from a third-party module).