$ show terraform-google-modules/terraform-google-project-factory
This is a Terraform module, published on the Terraform Registry as `terraform-google-modules/project-factory/google`, that automates the creation and configuration of Google Cloud Platform (GCP) projects. It follows a modular architecture with a root module orchestrating several submodules such as `core_project_factory`, `project_services`, `shared_vpc_access`, `budget`, `quota_manager`, `essential_contacts`, `gsuite_enabled`, and `svpc_service_project`. The module handles project creation, billing association, IAM policy management, Shared VPC attachment, API enablement with service identities, budget alerts, consumer quota overrides, essential contacts, and G Suite group integration (via the third-party `DeviaVir/gsuite` provider). Entry points are the root `main.tf` and the submodule directories; usage is through standard Terraform workflow (`terraform init`, `plan`, `apply`). External dependencies include the `hashicorp/google`, `hashicorp/google-beta`, and optionally `DeviaVir/gsuite` Terraform providers. The repository also provides helper scripts for seed service account setup (`helpers/setup-sa.sh`), state migration (`helpers/migrate.py`, `helpers/migrate4.py`), and prerequisite validation (`helpers/preconditions/preconditions.py`). The codebase is well-structured with extensive use of locals, `for_each` loops, and separation of concerns, making individual submodules reusable across different projects. Despite being infrastructure-as-code, it exhibits strong software engineering practices including semantic versioning, automated testing (Go, InSpec, Python), and CI/CD pipelines.
The LLM identified 4 files worth highlighting for reuse:
Manages Google Cloud API activation and service identity creation. Uses `for_each` to iterate over a list of service APIs, enabling them via `google_project_service` and creating service accounts via `google_project_service_identity`. The pattern is clean, idempotent, and easily reusable for any set of APIs. It demonstrates efficient use of Terraform's count and for_each to avoid repetitive hardcoding.
Grants IAM roles on a Shared VPC host project and its subnets. Uses `google_compute_subnetwork_iam_member` and `google_project_iam_member` with dynamic subnets and roles. The design cleanly separates subnet-level permissions from project-level ones, and the module can be reused across different host projects and service projects. Demonstrates a composable pattern for granting granular network access.
Creates a billing budget with configurable amount, credits, and alert thresholds using `google_billing_budget`. Supports multiple threshold rules with `spend_basis` options. The module is self-contained and can be applied to any billing account. It showcases Terraform's ability to manage complex cloud resource configurations with clear parameterization.
A standalone Python script that validates GCP project prerequisites (e.g., API enablement, IAM roles, billing account state) before Terraform execution. It performs checks via the Cloud Resource Manager and Billing APIs. The script is reusable for any GCP automation workflow that requires initial environment validation, not just this Terraform module. It demonstrates a practical pattern for fail-fast validation in infrastructure projects.