# Terraform module

> Inputs, outputs and resources of the customer-gcp Terraform module: five APIs, one IAM binding, an optional budget, and why the OAuth client is not in it.

Source: https://docs.applane.dev/reference/terraform-module/

Source: `github.com/<ORG>/applane//infra/terraform/customer-gcp`. How to use it: [Terraform](https://docs.applane.dev/gcp-admins/setup/terraform/) or [Infrastructure Manager](https://docs.applane.dev/gcp-admins/setup/infrastructure-manager/). Verified with Terraform 1.15 and `hashicorp/google` 6.50.

## Inputs

| Name | Default | Notes |
|---|---|---|
| `project_id` | required | Existing project in your Workspace organisation. |
| `builders_group_email` | required | Google Group of people allowed to build. |
| `billing_account_id` | `null` | `XXXXXX-XXXXXX-XXXXXX`. The budget is created only when set. |
| `budget_amount` | `50` | Monthly, in the billing account's currency. |
| `enable_apis` | `true` | `false` if another module already manages `google_project_service` on this project. |
| `existing_project` | `true` | `false` when the project is created in the same apply, which skips the billing check at plan time. |
| `applane_extension_id` | `<APPLANE_EXTENSION_ID>` | From the Applane console. Only feeds the redirect URI output. |
| `admin_console_probe_uri` | `https://admin.applane.dev/oauth-probe` | The second redirect URI (the console's test sign-in). Override only for a non-production console. |

## Outputs

| Name | What |
|---|---|
| `oauth_redirect_uris` | Both URIs the OAuth client needs. |
| `consent_screen_instructions` | The two console steps, as text. |
| `next_steps` | What to do after apply. |
| `enabled_apis` | The five API names. |
| `vertex_binding` | The IAM member and role. |
| `budget_name` | The budget resource name, or empty. |
| `project_id` | Echo of the input. |

## Resources

| Resource | What | Why |
|---|---|---|
| `google_project_service` x5 | `script`, `aiplatform`, `sheets`, `drive`, `docs` `.googleapis.com` | The APIs the extension calls. `disable_on_destroy = false`: destroying the module never switches an API off. |
| `google_project_iam_member` | `roles/aiplatform.user` to `group:<builders_group_email>` | Lets builders call Gemini on Vertex AI. |
| `google_billing_budget` | 50%, 90%, 100% of `budget_amount` per month | Only when `billing_account_id` is set. Alerts only. Also enables `billingbudgets.googleapis.com`. |
| `data "google_project"` | Read | Checks that billing is linked and fails the plan with a clear message if not. Skipped with `existing_project = false`. |

## Not in the module

The OAuth consent screen and the OAuth client. Google has no API for either; the provider's IAP client resources do not work with the extension's sign-in. They are two console steps: [OAuth consent screen](https://docs.applane.dev/gcp-admins/oauth-consent-screen/), [OAuth client](https://docs.applane.dev/gcp-admins/oauth-client/).

## Destroy

Removes the IAM binding and the budget. The APIs stay on. See [Uninstall](https://docs.applane.dev/workspace-admins/uninstall/#gcp-admin).