Skip to content

Latest commit

 

History

History
196 lines (124 loc) · 6.97 KB

README.md

File metadata and controls

196 lines (124 loc) · 6.97 KB
Raw

Configuring a New GCP Project

This section will detail the creation and configuration of a new GCP project to houes all of the Terraform-managed resources for the storefront.

Table of Contents

  1. Create the project
  2. Assign a billing account
  3. Create a storage bucket for Terraform
  4. Create an Artifact Registry docker repository
  5. Create a service account for Terraform

1. Create the project

Create a new GCP project by following the official instructions.

Upon creation, make a note of the project id (not the project number). We will need this later when configuring Github Secrets.

project id

2. Assign a billing account

If there is not already a billing acount set up for your organization, create one now.

Once a billing account is available, select "Billing" in the sidebar menu.

select billing

Then select "Link a billing account".

link billing account

Select your billing account in the dropdown menu and then click "Set account".

set billing account

3. Create a bucket

Now that we have a billing account assigned to the project, we can create additional resources, including a new Cloud Storage bucket in which Terraform can store its state file.

In the sidebar menu, select "Cloud Storage".

select cloud storage

Select "Create bucket".

create bucket

Give the bucket a unique name and then click "Continue" (not "Create").

supply name

After choosing a region and the "Standard" storage class, selecting "Continue" on each screen, we now want to make sure to select "Enforce public access prevention on this bucket".

Terraform's state file is not encrypted, and it will contain any secret variable we supply it. Therefore, we need to be doubly certain that the state file can only be accessed by those who have permission via IAM, etc.

You can configure the "Access control" or "Choose how to protect object data" however you'd like, and once done select "Create".

enforce access prevention

4. Create a docker repository

In your GCP project, open the services menu.

open menu

Scroll down to the "CI/CD" section and click "Artifact Registry".

00

Being a new GCP project, you will need to click "Enable".

01

Now click "Create repository".

click create

Here, assign the repository a name, make sure "Docker" is selected, and assign a region. (Most likely same as project region.). Then click "Create".

fill in form

Once created, click the repository name in the table to go to the repository details.

select the repository

Find the registry name - it will look something like <region>-docker.pkg.dev.

record the registry

5. Create a service account

The service account is an identity that Terraform can use to perform GCP API operations. In this step, we'll create a new account with the required roles and download a JSON file with the private key.

Disclaimer: Service account roles should only give terraform the absolute minimum power necessary to perform all functions. The roles outlined farther below are believed to be the minimum set, but there is a chance that they might be more elevated than they need to be.

Feel free to try restricting them further - if there is a less-priviledged set of roles that still allow full resource management, please let us know so that we can update the instructions accordingly.

In your GCP project, open the services menu.

open menu

Then, scroll down to IAM and select "Service Accounts".

select service accounts

From here, click "Create Service Account".

create account

Give the account a recognizable name and, if desired, a description. When done, click "Create and Continue".

name and continue

Now "Add Another Role" until the following four are assigned, and then click "Continue".

add roles

You can choose to assign users or groups to this account so they can perform actions with it if you'd like. If not, or once done, click "Done".

done

Now find the service account in the list and click the email to go to the account details screen.

select account

Once there, click on "Keys".

select keys

Select "Add Key" and click "Create new key".

create key

Make sure that JSON is selected and then click "Create". You will be prompted to open or download the resulting key - make sure to save it because you cannot recover it later.

select json

You should have a JSON file that looks approximately like this:

{
  "type": "service_account",
  "project_id": "<project-id>",
  "private_key_id": "abc..snip...xyz",
  "private_key": "-----BEGIN PRIVATE KEY-----\nABC... snip ...XYZ\n-----END PRIVATE KEY-----\n",
  "client_email": "<user>@<project-id>.iam.gserviceaccount.com",
  "client_id": "123... snip ...789",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/<user>%40<project-id>.iam.gserviceaccount.com"
}

Notice that this file contains new-lines. It is vitally important to retain newlines in the JSON key wherever we use it - even in an environment variable, even if we base-64 encode it.

Without newlines, terraform cannot authenticate. For whatever reason, Google tools require them.

Next Up

Registering custom domains