{"id":21355006,"url":"https://github.com/salrashid123/terraform_vcs","last_synced_at":"2025-10-18T20:27:47.687Z","repository":{"id":91310197,"uuid":"282678922","full_name":"salrashid123/terraform_vcs","owner":"salrashid123","description":"Using Terraform Cloud Webhook with Google Cloud Logging","archived":false,"fork":false,"pushed_at":"2021-04-20T21:19:20.000Z","size":403,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-10-08T18:41:56.688Z","etag":null,"topics":["gcp","google","terraform"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/salrashid123.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-07-26T15:33:01.000Z","updated_at":"2023-05-12T20:00:12.000Z","dependencies_parsed_at":null,"dependency_job_id":"be2b93a5-872c-4c73-ab64-f9220221b0e7","html_url":"https://github.com/salrashid123/terraform_vcs","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/salrashid123/terraform_vcs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Fterraform_vcs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Fterraform_vcs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Fterraform_vcs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Fterraform_vcs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/salrashid123","download_url":"https://codeload.github.com/salrashid123/terraform_vcs/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Fterraform_vcs/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279609941,"owners_count":26199049,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-18T02:00:06.492Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["gcp","google","terraform"],"created_at":"2024-11-22T04:15:33.827Z","updated_at":"2025-10-18T20:27:47.656Z","avatar_url":"https://github.com/salrashid123.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Using Terraform Cloud Webhook with Google Cloud Logging\n\nTutorial to emit [Terraform Cloud](https://www.terraform.io/docs/cloud/index.html) webhook events to [Google Cloud Logging](https://cloud.google.com/logging/docs).\n\nThis repo isn't anything groundbreaking but just goes through the steps to setup terraform webhook such that they they appear in GCP Cloud Logging as [Structured logs](https://cloud.google.com/logging/docs/structured-logging).\n\nOne the logs are in GCP, you can export them to BQ or re-emit them as pubsub messages to kick off any secondary workflows.\n\nThe architecture is basic:\n\n(user or CI/CD) triggers `plan/apply` --\u003e `Terraform Cloud` --\u003e `Cloud Run` --\u003e `Cloud Logging`\n\nCloud Run will:\n* Accept only requests that carry the valid `HMAC-SHA256` that was configured in Terraform\n* Convert the Terraform JSON Payload to a GCP Structured log and emit them to its own log type.\n\n\n\u003e\u003e This repo is not supported by Google\n\n### Setup\n\nIts assumed you already have a Terraform Cloud account setup as well as a GCP project.\n\nThis tutorial will setup cloud run, cloud logging, terraform cloud which is triggered manually (or automatic) to run a basic terraform template.\n\n\n\u003e\u003e NOTE, this repo uses Terraform 0.13.0\n\n#### Create Service Account for Cloud run\n\n```bash\n$ export PROJECT_ID=`gcloud config get-value core/project`\n$ gcloud iam service-accounts create tf-run-server --display-name \"Service Account for Cloud Run\"\n$ gcloud projects add-iam-policy-binding $PROJECT_ID \\\n   --member=serviceAccount:tf-run-server@$PROJECT_ID.iam.gserviceaccount.com \\\n   --role=roles/logging.logWriter\n```\n\n#### Build and Deploy Cloud RUn\n\nFirst edit `server.go` and update the HMAC password to whatever you want\n\n```golang\nconst (\n  key               = \"password1\"\n)\n```\n\nbuild and deploy\n\n```bash\ndocker build -t gcr.io/$PROJECT_ID/tfevent .\ndocker pushgcr.io/$PROJECT_ID/tfevent\n\n\ngcloud beta run deploy tfevent \\\n  --image gcr.io/$PROJECT_ID/tfevent  \\\n  --allow-unauthenticated \\\n  --region us-central1  --platform=managed \n```\n\nNote, we are deploying cloud run without [authentication enabled](https://cloud.google.com/run/docs/authenticating/overview).  We're doing this because Terraform Cloud does not support the same auth mechanism Run uses (`OIDC`) but instead its `HMAC-SHA512` (see [Notification Authenticity](https://www.terraform.io/docs/cloud/api/notification-configurations.html#notification-authenticity))\n\nOnce you deploy, copy the Cloud Run URL.\n\n#### Configure Terraform Cloud for Webhook\n\n1. Configure a [Workspace in Terraform Cloud](https://www.terraform.io/docs/cloud/workspaces/index.html)\n  \n  In the following example, its `default-workspace`.  Set the Terraform Working Directory the path under the source.  In my case, its `hello_world`.\n\n  ![images/workspace.png]\n\n  The git repo used for this tutorial has has the terraform files under the `hello_world` directory.  (the script doesn't do anything, really (see for your self))\n  ```bash\n  $ git remote -v\n  origin\thttps://github.com/salrashid123/terraform_vcs.git (fetch)\n  origin\thttps://github.com/salrashid123/terraform_vcs.git (push)\n\n  $ tree\n  .\n  ├── hello_world\n  │   └── default.tf\n  └── README.md\n  ```\n\n2. Set version control source\n  \n  In the following, i used the git repo here on `master` branch\n\n  ![images/version.png](images/version.png)\n\n3. Configure Notifications\n\n   Setup a Notification with the URL of the Cloud Run instance and the HMAC passphrase you used.\n   Specify the \n\n   ![images/notifications.png](images/notifications.png)\n\n\n4. Trigger\n\n   In the following, the trigger was a \"Plan\" that was triggered manually.\n    \n\n\n### Verify Cloud Logging  \n\nThe trigger should have called cloud run.  You can check that cloud run was called by checking Run logs.\n\nHowever, this application will *reemit* the payload it receives from Terraform as structured logs to a custom resource_type called [generic_task](https://cloud.google.com/monitoring/api/resources#tag_generic_task).\n\nTo see structured logs for Terraform, navigate to `Generic Task` logs in cloud logging.  You should see all the various events emitted:\n\n![images/generic_task.png](images/generic_task.png)\n\n\n### Enhancements\n\nIn this case Cloud Run parsed the terraform event and resent it to Cloud Logging.  You can easily emit other types of data such as Pub/Sub, Cloud Task or even as a [Cloud Event](https://cloudevents.io/) downstream (see example [here](https://gist.github.com/salrashid123/92adfda447f3c023efdaf6c320603aa1#file-main-go-L69))\n\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsalrashid123%2Fterraform_vcs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsalrashid123%2Fterraform_vcs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsalrashid123%2Fterraform_vcs/lists"}