Infrastructure Manager

Who

GCP admin with roles/config.admin on the project

Time

15 minutes the first time

Infrastructure Manager runs the Applane Terraform module for you. State lives in a Cloud Storage bucket it creates in your project, and every revision is visible in the Cloud console under Infrastructure Manager.

Pick this when the project should be managed as code but nobody wants Terraform on a laptop.

One-time setup

Infra Manager acts as a service account, which needs the rights to create what the module creates. Your own account needs roles/config.admin on the project.

gcloud services enable config.googleapis.com --project <GCP_PROJECT_ID>
gcloud iam service-accounts create applane-infra-manager --project <GCP_PROJECT_ID>
SA=applane-infra-manager@<GCP_PROJECT_ID>.iam.gserviceaccount.com
for role in roles/config.agent roles/serviceusage.serviceUsageAdmin \
            roles/resourcemanager.projectIamAdmin; do
  gcloud projects add-iam-policy-binding <GCP_PROJECT_ID> \
    --member=serviceAccount:$SA --role=$role --condition=None
done
# only if you pass billing_account_id (budget alert):
gcloud billing accounts add-iam-policy-binding <BILLING_ACCOUNT_ID> \
  --member=serviceAccount:$SA --role=roles/billing.costsManager

Role	Why
roles/config.agent	Lets Infra Manager run Terraform as this account.
roles/serviceusage.serviceUsageAdmin	Enable the five APIs.
roles/resourcemanager.projectIamAdmin	The Vertex grant to the builders group.
roles/billing.costsManager on the billing account	The budget alert, only when one is requested.

This service account is Infra Manager’s, not Applane’s. Applane never has access to it or to your project.

Apply

gcloud infra-manager deployments apply projects/<GCP_PROJECT_ID>/locations/europe-west1/deployments/applane \
  --service-account=projects/<GCP_PROJECT_ID>/serviceAccounts/$SA \
  --git-source-repo=<APPLANE_SETUP_REPO_URL> \
  --git-source-directory=infra/terraform/customer-gcp \
  --git-source-ref=main \
  --input-values=project_id=<GCP_PROJECT_ID>,builders_group_email=applane-builders@<YOUR_DOMAIN>,billing_account_id=<BILLING_ACCOUNT_ID>,applane_extension_id=<APPLANE_EXTENSION_ID>

Leave billing_account_id out of --input-values to skip the budget. europe-west1 is the default location; any Infra Manager region works.

If the repository is not reachable from Google, clone it and pass --local-source=infra/terraform/customer-gcp instead of the three --git-source-* flags.

What it creates

The Terraform module: five google_project_service resources, one google_project_iam_member, and one google_billing_budget when a billing account is set.

Verify

DEPLOYMENT=projects/<GCP_PROJECT_ID>/locations/europe-west1/deployments/applane
gcloud infra-manager deployments describe $DEPLOYMENT
gcloud infra-manager revisions list --deployment=$DEPLOYMENT
# outputs (redirect URIs, console steps) sit under applyResults.outputs of the latest revision:
gcloud infra-manager revisions describe $DEPLOYMENT/revisions/r-0 --format='yaml(applyResults.outputs)'

The deployment state should read ACTIVE. The consent_screen_instructions output tells you what to do next: the OAuth consent screen and OAuth client. Then run the setup checker.

Remove it

gcloud infra-manager deployments delete $DEPLOYMENT

This removes the IAM grant and the budget. The APIs stay on (disable_on_destroy = false in the module), because other workloads may use them. Disable them by hand if the project is dedicated to Applane; see Uninstall.