Service Onboarding Apigee Module

This module provisions Apigee onboarding resources for an application component:

1. Apigee Runtime Service Account (apigee_runtime_sa):

   • Creates a dedicated Service Account in the shared Apigee Org project for deploying Apigee proxies.
   • Grants roles/iam.serviceAccountTokenCreator to the Apigee service agent.
   • Grants roles/iam.serviceAccountUser to the proxy deployment CI/CD workload identity.
   • Grants roles/logging.logWriter in the Apigee Org project.
   • Assigns custom IAM roles on target component projects (e.g., roles/aiplatform.user, roles/secretmanager.secretAccessor).

2. Apigee Developer & Developer Apps (apigee_developer_app):

   • Creates an Apigee Developer identity in the shared organization.
   • Provisions Apigee Developer App(s) subscribed to required API products.
   • Delivers generated consumer credentials (key, secret, token endpoint) into Secret Manager in target projects.
   • Configures IAM permissions for specified accessor Service Accounts to access the secrets.

3. Apigee API Product Shells (apigee_products):

   • Provisions deny-by-default API product shells owned by the component.

Usage Example

module "service_onboarding_apigee" {
  source = "../../../../../modules/service-onboarding-apigee"

  config = {
    default     = var.config_default
    environment = var.config_environment
    component   = var.config_component
  }

  apigee_runtime_sa = {
    name        = "sa-acd-runtime"
    deploy_repo = "demos"
    permissions = {
      "aiplatform" = [
        "roles/aiplatform.user",
        "roles/secretmanager.secretAccessor",
      ]
    }
  }

  apigee_developer_app = {
    token_endpoint = "https://apigee.${var.config_default.dns_domain}/oauth/v1/token"
    apps = {
      "market-research-agent" = {
        products       = ["llm-standard"]
        secret_id      = "apigee-market-research-agent-credentials"
        target_project = "aiplatform"
        accessor_sas   = []
      }
    }
  }

  apigee_products = {
    "agent-api-standard" = {
      display_name  = "Agent API Standard"
      description   = "Standard API product for agents-cli service"
      approval_type = "auto"
    }
  }
}