# Infrastructure Manager

> Google's managed Terraform runs the Applane module from git and keeps the state in your project. Needs one service account and roles/config.admin.

Source: https://docs.applane.dev/gcp-admins/setup/infrastructure-manager/

**Who:** GCP admin with roles/config.admin on the project  
**Time:** 15 minutes the first time

Infrastructure Manager runs the Applane Terraform module for you. State lives in a Cloud Storage bucket it creates in your project, and every revision is visible in the Cloud console under **Infrastructure Manager**.

Pick this when the project should be managed as code but nobody wants Terraform on a laptop.

## One-time setup

Infra Manager acts as a service account, which needs the rights to create what the module creates. Your own account needs `roles/config.admin` on the project.

```bash
gcloud services enable config.googleapis.com --project <GCP_PROJECT_ID>
gcloud iam service-accounts create applane-infra-manager --project <GCP_PROJECT_ID>
SA=applane-infra-manager@<GCP_PROJECT_ID>.iam.gserviceaccount.com
for role in roles/config.agent roles/serviceusage.serviceUsageAdmin \
            roles/resourcemanager.projectIamAdmin; do
  gcloud projects add-iam-policy-binding <GCP_PROJECT_ID> \
    --member=serviceAccount:$SA --role=$role --condition=None
done
# only if you pass billing_account_id (budget alert):
gcloud billing accounts add-iam-policy-binding <BILLING_ACCOUNT_ID> \
  --member=serviceAccount:$SA --role=roles/billing.costsManager
```

| Role | Why |
|---|---|
| `roles/config.agent` | Lets Infra Manager run Terraform as this account. |
| `roles/serviceusage.serviceUsageAdmin` | Enable the five APIs. |
| `roles/resourcemanager.projectIamAdmin` | The Vertex grant to the builders group. |
| `roles/billing.costsManager` on the billing account | The budget alert, only when one is requested. |

This service account is Infra Manager's, not Applane's. Applane never has access to it or to your project.

## Apply

```bash
gcloud infra-manager deployments apply projects/<GCP_PROJECT_ID>/locations/europe-west1/deployments/applane \
  --service-account=projects/<GCP_PROJECT_ID>/serviceAccounts/$SA \
  --git-source-repo=<APPLANE_SETUP_REPO_URL> \
  --git-source-directory=infra/terraform/customer-gcp \
  --git-source-ref=main \
  --input-values=project_id=<GCP_PROJECT_ID>,builders_group_email=applane-builders@<YOUR_DOMAIN>,billing_account_id=<BILLING_ACCOUNT_ID>,applane_extension_id=<APPLANE_EXTENSION_ID>
```

Leave `billing_account_id` out of `--input-values` to skip the budget. `europe-west1` is the default location; any Infra Manager region works.

If the repository is not reachable from Google, clone it and pass `--local-source=infra/terraform/customer-gcp` instead of the three `--git-source-*` flags.

## What it creates

The [Terraform module](https://docs.applane.dev/reference/terraform-module/): five `google_project_service` resources, one `google_project_iam_member`, and one `google_billing_budget` when a billing account is set.

## Verify

```bash
DEPLOYMENT=projects/<GCP_PROJECT_ID>/locations/europe-west1/deployments/applane
gcloud infra-manager deployments describe $DEPLOYMENT
gcloud infra-manager revisions list --deployment=$DEPLOYMENT
# outputs (redirect URIs, console steps) sit under applyResults.outputs of the latest revision:
gcloud infra-manager revisions describe $DEPLOYMENT/revisions/r-0 --format='yaml(applyResults.outputs)'
```

The deployment state should read `ACTIVE`. The `consent_screen_instructions` output tells you what to do next: the [OAuth consent screen](https://docs.applane.dev/gcp-admins/oauth-consent-screen/) and [OAuth client](https://docs.applane.dev/gcp-admins/oauth-client/). Then run the [setup checker](https://docs.applane.dev/gcp-admins/verify/).

## Remove it

```bash
gcloud infra-manager deployments delete $DEPLOYMENT
```

This removes the IAM grant and the budget. The APIs stay on (`disable_on_destroy = false` in the module), because other workloads may use them. Disable them by hand if the project is dedicated to Applane; see [Uninstall](https://docs.applane.dev/workspace-admins/uninstall/#gcp-admin).