Terraform module

Source: github.com/<ORG>/applane//infra/terraform/customer-gcp. How to use it: Terraform or Infrastructure Manager. Verified with Terraform 1.15 and hashicorp/google 6.50.

Inputs

Name	Default	Notes
project_id	required	Existing project in your Workspace organisation.
builders_group_email	required	Google Group of people allowed to build.
billing_account_id	null	XXXXXX-XXXXXX-XXXXXX. The budget is created only when set.
budget_amount	50	Monthly, in the billing account’s currency.
enable_apis	true	false if another module already manages google_project_service on this project.
existing_project	true	false when the project is created in the same apply, which skips the billing check at plan time.
applane_extension_id	<APPLANE_EXTENSION_ID>	From the Applane console. Only feeds the redirect URI output.
admin_console_probe_uri	https://admin.applane.dev/oauth-probe	The second redirect URI (the console’s test sign-in). Override only for a non-production console.

Outputs

Name	What
oauth_redirect_uris	Both URIs the OAuth client needs.
consent_screen_instructions	The two console steps, as text.
next_steps	What to do after apply.
enabled_apis	The five API names.
vertex_binding	The IAM member and role.
budget_name	The budget resource name, or empty.
project_id	Echo of the input.

Resources

Resource	What	Why
google_project_service x5	script, aiplatform, sheets, drive, docs .googleapis.com	The APIs the extension calls. disable_on_destroy = false: destroying the module never switches an API off.
google_project_iam_member	roles/aiplatform.user to group:<builders_group_email>	Lets builders call Gemini on Vertex AI.
google_billing_budget	50%, 90%, 100% of budget_amount per month	Only when billing_account_id is set. Alerts only. Also enables billingbudgets.googleapis.com.
data "google_project"	Read	Checks that billing is linked and fails the plan with a clear message if not. Skipped with existing_project = false.

Not in the module

The OAuth consent screen and the OAuth client. Google has no API for either; the provider’s IAP client resources do not work with the extension’s sign-in. They are two console steps: OAuth consent screen, OAuth client.

Destroy

Removes the IAM binding and the budget. The APIs stay on. See Uninstall.