Infrastructure &
GCP Architecture
— every resource in code.

# modules/security/iam.tf
# Workload Identity Federation — no service account key files
# Cloud Run services authenticate via WIF, not key files

resource "google_service_account" "contractguard_sa" {
  project      = var.project_id
  account_id   = "contractguard-sa"
  display_name = "ContractGuard Agent Service Account"
  description  = "Least-privilege SA for ContractGuard Cloud Run service. No key files created."
}

# Workload Identity binding — Cloud Run service → SA
resource "google_service_account_iam_member" "contractguard_wif" {
  service_account_id = google_service_account.contractguard_sa.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "serviceAccount:${var.project_id}.svc.id.goog[${var.namespace}/contractguard]"
}

# Minimal permissions — only what ContractGuard needs
resource "google_project_iam_member" "contractguard_permissions" {
  for_each = toset([
    "roles/datastore.user",           # Firestore read/write
    "roles/bigquery.dataEditor",       # BigQuery audit writes
    "roles/storage.objectViewer",      # GCS contract bucket read
    "roles/secretmanager.secretAccessor", # Secret Manager read
    "roles/aiplatform.user",           # Vertex AI endpoint invoke
    "roles/cloudkms.cryptoKeyDecrypter", # CMEK decrypt (own key ring only)
  ])
  project = var.project_id
  role    = each.value
  member  = "serviceAccount:${google_service_account.contractguard_sa.email}"
}

# Org policy: deny SA key creation — enforced at org root
resource "google_org_policy_policy" "deny_sa_key_creation" {
  name   = "organizations/${var.org_id}/policies/iam.disableServiceAccountKeyCreation"
  parent = "organizations/${var.org_id}"
  spec {
    rules { enforce { enforce = true } }
  }
}

# modules/compute/cloud_run.tf
# ContractGuard agent service — stateless, VPC-native, CMEK

resource "google_cloud_run_v2_service" "contractguard" {
  project  = var.project_id
  location = var.region   # europe-west3 — enforced by org policy
  name     = "contractguard-${var.env}"

  template {
    service_account = google_service_account.contractguard_sa.email

    scaling {
      min_instance_count = 0   # scale-to-zero in non-prod
      max_instance_count = 10
    }

    vpc_access {
      connector = google_vpc_access_connector.ae_connector.id
      egress    = "PRIVATE_RANGES_ONLY"
    }

    containers {
      image = "${var.region}-docker.pkg.dev/${var.project_id}/ae-agents/contractguard:${var.image_tag}"

      resources {
        limits = {
          cpu    = "2"
          memory = "4Gi"
        }
        cpu_idle          = true   # CPU only allocated during request
        startup_cpu_boost = true
      }

      env {
        name = "PROJECT_ID"
        value = var.project_id
      }
      env {
        name = "SFDC_TOKEN_SECRET"
        value_source {
          secret_key_ref {
            secret  = google_secret_manager_secret.sfdc_oauth_token.secret_id
            version = "latest"
          }
        }
      }
    }

    labels = {
      module              = "contractguard"
      env                 = var.env
      cost-centre         = var.cost_centre
      data-classification = "confidential"
    }
  }

  traffic {
    type    = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"
    percent = 100
  }
}

# modules/security/kms.tf
# CMEK key ring and keys — ClaraVis holds custody
# Rotation: 90 days. Google cannot access encrypted data.

resource "google_kms_key_ring" "claravis_ae" {
  project  = var.project_id
  name     = "claravis-ae-keyring"
  location = var.region   # europe-west3 — keys stay in EU
}

resource "google_kms_crypto_key" "bigquery_cmek" {
  name     = "bigquery-cmek"
  key_ring = google_kms_key_ring.claravis_ae.id

  rotation_period = "7776000s"  # 90 days in seconds

  version_template {
    algorithm        = "GOOGLE_SYMMETRIC_ENCRYPTION"
    protection_level = "HSM"    # Hardware Security Module
  }

  labels = {
    module              = "platform"
    data-classification = "restricted"
  }
}

resource "google_kms_crypto_key" "firestore_cmek" {
  name     = "firestore-cmek"
  key_ring = google_kms_key_ring.claravis_ae.id
  rotation_period = "7776000s"
  version_template {
    algorithm        = "GOOGLE_SYMMETRIC_ENCRYPTION"
    protection_level = "HSM"
  }
}

# BigQuery dataset with CMEK
resource "google_bigquery_dataset" "audit" {
  project     = var.project_id
  dataset_id  = "ae_audit"
  location    = var.region
  description = "Immutable audit trail — all agent actions, HITL events, SHAP explanations"

  default_encryption_configuration {
    kms_key_name = google_kms_crypto_key.bigquery_cmek.id
  }

  labels = {
    module              = "platform"
    env                 = var.env
    data-classification = "restricted"
    cost-centre         = var.cost_centre
  }
}