{"id":19070814,"url":"https://github.com/mento-protocol/terraform-gcp-seed-project","last_synced_at":"2026-06-18T08:32:34.145Z","repository":{"id":254282645,"uuid":"843099910","full_name":"mento-protocol/terraform-gcp-seed-project","owner":"mento-protocol","description":null,"archived":false,"fork":false,"pushed_at":"2024-09-10T13:20:51.000Z","size":17,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-22T03:44:02.879Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mento-protocol.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-08-15T19:27:33.000Z","updated_at":"2024-09-10T13:26:59.000Z","dependencies_parsed_at":null,"dependency_job_id":"9136b740-d1eb-4e2e-b93a-8b695c119406","html_url":"https://github.com/mento-protocol/terraform-gcp-seed-project","commit_stats":null,"previous_names":["mento-protocol/terraform-gcp-seed-project"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/mento-protocol/terraform-gcp-seed-project","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mento-protocol%2Fterraform-gcp-seed-project","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mento-protocol%2Fterraform-gcp-seed-project/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mento-protocol%2Fterraform-gcp-seed-project/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mento-protocol%2Fterraform-gcp-seed-project/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mento-protocol","download_url":"https://codeload.github.com/mento-protocol/terraform-gcp-seed-project/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mento-protocol%2Fterraform-gcp-seed-project/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34483278,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-18T02:00:06.871Z","response_time":128,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-09T01:20:42.480Z","updated_at":"2026-06-18T08:32:34.127Z","avatar_url":"https://github.com/mento-protocol.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Terraform Google Cloud Seed Project\n\nThis repo houses the Terraform code for our Terraform Google Cloud Seed Project. It's based on the official [Terraform Google Bootstrap Module](https://registry.terraform.io/modules/terraform-google-modules/bootstrap/google/latest) maintained by Google, HashiCorp, and the Cloud Foundation.\n\nThe main benefits we get from this shared seed project are:\n\n- Centralized Terraform State Management: Manage the Terraform state of all our GCP projects in one place, ensuring consistency and preventing conflicts.\n- Shared Service Account: Use a single service account to provision resources across all our GCP projects.\n\n## Prerequisites\n\n### Permissions\n\nIn order to deploy this project, you will need the following permissions in our Google Cloud Organization:\n\n- `roles/resourcemanager.organizationAdmin` on the top-level GCP Organization\n- `roles/orgpolicy.policyAdmin` on the top-level GCP Organization\n- `roles/billing.admin` on the billing account connected to the project\n- Additionally, the gcloud user account running `terraform apply` should be a member of the group provided in `group_org_admins` variable, otherwise they will loose `roles/resourcemanager.projectCreator` access. Additional members can be added by using the `org_project_creators` input into the bootstrap module in `main.tf`.\n\n### Local Requirements\n\n1. Install the `gcloud` CLI\n\n   ```sh\n   # For macOS\n   brew install google-cloud-sdk\n\n   # For other systems, see https://cloud.google.com/sdk/docs/install\n   ```\n\n1. Install trunk (one linter to rule them all)\n\n   ```sh\n   # For macOS\n   brew install trunk-io\n\n   # For other systems, see https://docs.trunk.io/check/usage\n   ```\n\n   Optionally, you can also install the [Trunk VS Code Extension](https://marketplace.visualstudio.com/items?itemName=Trunk.io)\n\n1. Install `jq` (used in a few shell scripts)\n\n   ```sh\n   # On macOS\n   brew install jq\n\n   # For other systems, see https://jqlang.github.io/jq/\n   ```\n\n1. Install Terraform\n\n   ```sh\n   # On macOS\n   brew tap hashicorp/tap\n   brew install hashicorp/tap/terraform\n\n   # For other systems, see https://developer.hashicorp.com/terraform/install\n   ```\n\n### Setup Instructions\n\n1. Clone the repo:\n\n   ```sh\n   git clone https://github.com/mento-protocol/terraform-gcp-seed-project.git\n   cd terraform-gcp-seed-project\n   ```\n\n1. Configure `terraform.tfvars` (this is like a `.env` for Terraform):\n\n   ```sh\n   touch terraform.tfvars\n   # This file is `.gitignore`d to avoid accidentally leaking sensitive data\n   ```\n\n   Then set the required values in your terraform.tfvars:\n\n   ```hcl\n   # Get it via `gcloud organizations list`\n   org_id = \"\u003corg-id\u003e\"\n\n   # Get it via `gcloud billing accounts list` (pick the GmbH account)\n   billing_account = \"\u003cbilling-account\u003e\"\n\n   # Get it via `gcloud organizations get-iam-policy \u003cour-org-id\u003e --format=json | jq -r '.bindings[] | select(.role | startswith(\"roles/resourcemanager.organizationAdmin\"))  | .members[] | select(startswith(\"group:\")) | sub(\"^group:\"; \"\")'`\n   group_org_admins = \"\u003corg-admin-group\u003e\"\n\n   # Get it via `gcloud organizations get-iam-policy \u003cour-org-id\u003e --format=json | jq -r '.bindings[] | select(.role | startswith(\"roles/billing.admin\"))  | .members[] | select(startswith(\"group:\")) | sub(\"^group:\"; \"\")'`\n   group_billing_admins = \"billing-adming-group\"\n   ```\n\n1. Initialize Terraform: Initialize the Terraform working directory and install required providers\n\n   ```sh\n   terraform init\n   ```\n\n## Deploying \u0026 Updating the Seed Project\n\nIt's plain old Terraform, the process is:\n\n1. Make the desired changes to your `*.tf` files\n1. Run `terraform plan` to see a dry run of the expected changes\n1. Run `terraform apply` to deploy the changes to Google Cloud\n\n\u003c!-- markdownlint-disable MD036 --\u003e\n\n**🚨 Be careful to not accidentally delete or otherwise change the terraform state bucket created by the bootstrap module as this houses state from all our GCP projects 🚨**\n\n\u003c!-- markdownlint-enable MD036 --\u003e\n\n## Service Account Impersonation\n\nInstead of having to figure out and manage individual permissions for everyone, Devs can just impersonate a shared service account and not suffer through any \"works on my machine\" problems locally.\n\n### The advantages of impersonation\n\nImpersonation does not require any service account keys to be generated or distributed (i.e. in form of `credentials.json` files). While Terraform does support the use of service account keys, generating and distributing those keys introduces some security risks that are minimized with impersonation. Instead of administrators creating, tracking, and rotating keys, the access to the service account is centralized to its corresponding IAM policy. By using impersonation, the code becomes portable and usable by anyone on the project with the Service Account Token Creator role, which can be easily granted and revoked by an administrator.\n\nFor more details about the SA impersonation approach see this blog post: [**\"Using Google Cloud Service Account impersonation in your Terraform code\"**](https://cloud.google.com/blog/topics/developers-practitioners/using-google-cloud-service-account-impersonation-your-terraform-code)\n\n### How to impersonate the service account in other projects\n\nThere are two approaches.\n\n1. Setting a local Env Var\n\n   \u003c!-- markdownlint-disable MD034 --\u003e\n\n   If you set the following env var in your local shell, all `terraform` commands will be executed with the service account's permissions (and not your own \u003cname@mentolabs.xyz\u003e gcloud user account).\n   \u003c!-- markdownlint-enable MD034 --\u003e\n\n   ```sh\n   # You can find the service account email via:\n   # `terraform state show \"module.bootstrap.google_service_account.org_terraform[0]\" | grep email`\n   export GOOGLE_IMPERSONATE_SERVICE_ACCOUNT=\u003cterraform-service-account-email\u003e\n   ```\n\n   It’s a quick and easy way to run Terraform as a service account, but you’ll have to remember to set that variable each time you restart your terminal session.\n\n2. Provider Config\n\n   Alternatively, you can add some extra configuration to your project's terraform files like:\n\n   ```hcl\n   provider \"google\" {\n       project          = YOUR_PROJECT_ID\n       access_token     = data.google_service_account_access_token.default.access_token\n       request_timeout  = \"60s\"\n   }\n   ```\n\n   There's a few other things to set, consult the following blog post for step-by-step instructions: [**\"Using Google Cloud Service Account impersonation in your Terraform code\"**](https://cloud.google.com/blog/topics/developers-practitioners/using-google-cloud-service-account-impersonation-your-terraform-code)\n\n### Using the shared Terraform State Bucket\n\nWe should store all Terraform state configuration in this seed project. To be able to access the bucket containing\nthe Terraform state files, set the following in your Terraform backend configuration:\n\n```hcl\nterraform {\n    backend \"gcs\" {\n        # Find it via `terraform state show module.bootstrap.google_storage_bucket.org_terraform_state | grep name`\n        bucket                      = \"\u003cgcp-seed-project-bucket-name\u003e\"\n\n        # Find it via `terraform state show \"module.bootstrap.google_service_account.org_terraform[0]\" | grep email`\n        impersonate_service_account = \"\u003cterraform-service-account\u003e\"\n    }\n}\n```\n\n## Troubleshooting\n\n### Permission problems when creating new projects\n\nFor troubleshooting permission issues when using the Terraform Service Account to create new projects,\nsee: \u003chttps://github.com/terraform-google-modules/terraform-google-project-factory/blob/master/docs/TROUBLESHOOTING.md\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmento-protocol%2Fterraform-gcp-seed-project","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmento-protocol%2Fterraform-gcp-seed-project","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmento-protocol%2Fterraform-gcp-seed-project/lists"}