Cloud Workflows (least-privilege identity)
A Cloud Workflows workflow that runs as a dedicated least-privilege service account instead of the broad Compute Engine default, with inline YAML, deletion protection, and call logging.
Verification
Live-testedReally deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan test superseded by live test
Provenance
- SHA-256 checksum
- Cosign signature
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-06-30 · how we verify
Verify this download
cosign · sha-256Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.
# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub
# 2. This module's Sigstore bundle
curl -o gcp-workflows-1.0.0.sigstore.json \
https://www.iac-bazaar.com/api/artifacts/gcp-workflows/signature
# 3. Verify the tarball you downloaded
cosign verify-blob \
--key cosign.pub \
--bundle gcp-workflows-1.0.0.sigstore.json \
gcp-workflows-1.0.0.tar.gz
# → Verified OK
# 4. (optional) confirm the checksum too
echo "29ee6b7914ee5fc6ecb51da7ce318f55b18d9dce0a9ee7c42b90daa95c8e9bdc gcp-workflows-1.0.0.tar.gz" | sha256sum -cUse it from the registry
terraform · opentofumodule "workflows" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-workflows/gcp"
version = "1.0.0"
}Paid module — needs a purchase (or a subscription that covers it) plus a registry token from /account/tokens. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract — every input name, type, default and description, plus every output — is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every Free module. This one is Premium, so its contract unlocks when you buy it.
Documentation
gcp-workflows
A Cloud Workflows workflow with its execution identity done right: instead of
falling back to the broadly-privileged Compute Engine default service account,
this module provisions a dedicated, role-free service account for the
workflow (or uses one you pass in), so you grant it only the roles its steps
actually need. The workflow body is inline YAML. Works with Terraform and
OpenTofu (>= 1.6), Google provider >= 7.0, < 8.0.
Secure defaults:
- A dedicated least-privilege service account (the broad Compute Engine default SA is avoided).
deletion_protectionon, so the workflow can't be destroyed by accident.- Call logging at errors-only (raise to
LOG_ALL_CALLSwhile debugging).
Requirements
| Requirement | Version |
|---|---|
| Terraform / OpenTofu | >= 1.6 |
hashicorp/google | >= 7.0, < 8.0 |
The Workflows API (workflows.googleapis.com) must be enabled; the IAM
API (iam.googleapis.com) is needed when the module creates the service
account (the default).
License
Commercial — IaC Bazaar EULA. © IaC Bazaar. Original work (not derived from a third-party module).
Usage code & full reference unlock after purchase
The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.
- Usage
- Inputs
- Outputs
Related modules
Cloud Composer 2 (managed Airflow)
Managed Apache Airflow on Cloud Composer 2 with small-by-default sizing, worker autoscaling pinned for predictable cost, and an opt-in private environment posture.
Dataproc Single-Node Cluster
A single-node Dataproc cluster (1 master, 0 workers), the cheapest managed Spark/Hadoop cluster that still applies and destroys cleanly, with internal-only IPs and deletion protection on.