Cloud Workflows (least-privilege identity)
A Cloud Workflows workflow that runs as a dedicated least-privilege service account instead of the broad Compute Engine default, with inline YAML, deletion protection, and call logging.
Verification
Live-testedReally deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan test superseded by live test
Provenance
- SHA-256 checksum
- Cosign signature
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-06-30 · how we verify
Verify this download
cosign · sha-256Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.
# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub
# 2. This module's Sigstore bundle
curl -o gcp-workflows-1.0.0.sigstore.json \
https://www.iac-bazaar.com/api/artifacts/gcp-workflows/signature
# 3. Verify the tarball you downloaded
cosign verify-blob \
--key cosign.pub \
--bundle gcp-workflows-1.0.0.sigstore.json \
gcp-workflows-1.0.0.tar.gz
# → Verified OK
# 4. (optional) confirm the checksum too
echo "29ee6b7914ee5fc6ecb51da7ce318f55b18d9dce0a9ee7c42b90daa95c8e9bdc gcp-workflows-1.0.0.tar.gz" | sha256sum -cUse it from the registry
terraform · opentofumodule "workflows" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-workflows/gcp"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/gcp-workflows?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, live-tested on IaC Bazaar: [Cloud Workflows (least-privilege identity)](https://www.iac-bazaar.com/catalog/gcp-workflows?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "workflows" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-workflows/gcp"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
gcp-workflows
A Cloud Workflows workflow with its execution identity done right: instead of
falling back to the broadly-privileged Compute Engine default service account,
this module provisions a dedicated, role-free service account for the
workflow (or uses one you pass in), so you grant it only the roles its steps
actually need. The workflow body is inline YAML. Works with Terraform and
OpenTofu (>= 1.6), Google provider >= 7.0, < 8.0.
Secure defaults:
- A dedicated least-privilege service account (the broad Compute Engine default SA is avoided).
deletion_protectionon, so the workflow can't be destroyed by accident.- Call logging at errors-only (raise to
LOG_ALL_CALLSwhile debugging).
Requirements
| Requirement | Version |
|---|---|
| Terraform / OpenTofu | >= 1.6 |
hashicorp/google | >= 7.0, < 8.0 |
The Workflows API (workflows.googleapis.com) must be enabled; the IAM
API (iam.googleapis.com) is needed when the module creates the service
account (the default).
License
Commercial — IaC Bazaar EULA. © IaC Bazaar. Original work (not derived from a third-party module).
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
- Inputs
- Outputs
Related modules
gcp-dataflow
on_delete defaults to cancel, which discards every element in flight on a streaming pipeline the moment the job is destroyed or replaced; workers get public IPs by default; and the default worker identity is the Compute Engine default account. Drain on delete, private workers with Private Google Access, a dedicated service account with the default refused, and a customer-managed key.
gcp-cloud-deploy
require_approval defaults to false on every target, so a release rolls into production the moment somebody promotes it with nobody signing off; the verify flag defaults off, so skaffold verify has never run. Treats the last stage as production and refuses a pipeline whose last target skips approval, verifies after every rollout, and refuses the Compute default service account as the runner.
gcp-cloud-build
A trigger with no service account runs every step - including code from the pull request under test - as the broadest identity in the project; a trigger that deploys on push deploys whatever lands; the shared default pool has external IPs. A dedicated runner with the defaults refused, a private worker pool with no external addresses, and approval required on any trigger marked as deploying.
gcp-composer
Managed Apache Airflow on Cloud Composer 2 with small-by-default sizing, worker autoscaling pinned for predictable cost, and an opt-in private environment posture.
gcp-dataproc
A single-node Dataproc cluster (1 master, 0 workers), the cheapest managed Spark/Hadoop cluster that still applies and destroys cleanly, with internal-only IPs and deletion protection on.
ansible-google-cloud-cli
gcloud, gsutil and bq on EL 10 from the versioned tarball, checked against a SHA-256 pinned beside the version: Google's yum key has a SHA-1 self-signature that rpm on EL 10 refuses, so the repository only installs with the GPG check off. Usage reporting and update nagging off installation-wide, read back through gcloud config get. Original role, live-tested on Rocky Linux 10.