feat(gcp): set up a connection with Terraform, and sign log pushes instead of a URL secret

.github/workflows/terraform-google-maple.yml

@@ -0,0 +1,37 @@
+name: Terraform module (Google Cloud)
+
+on:
+    push:
+        branches: [main]
+        paths:
+            - "deploy/terraform-google-maple/**"
+            - ".github/workflows/terraform-google-maple.yml"
+    pull_request:
+        paths:
+            - "deploy/terraform-google-maple/**"
+            - ".github/workflows/terraform-google-maple.yml"
+    workflow_dispatch:
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+    cancel-in-progress: true
+
+permissions:
+    contents: read
+
+jobs:
+    test:
+        name: Format, validate and plan against mocked providers
+        runs-on: ubuntu-latest
+        defaults:
+            run:
+                working-directory: deploy/terraform-google-maple
+        steps:
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+            - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
+              with:
+                  tofu_version: 1.13.1
+            - run: tofu fmt -recursive -check -diff
+            - run: tofu init -backend=false
+            - run: tofu validate
+            - run: tofu test

apps/api/src/routes/v2/integrations-gcp.http.test.ts

@@ -216,11 +216,26 @@ describe("v2 gcp integration over HTTP", () => {
 			application_logs: ["cloud_run", "cloud_functions", "app_engine", "gke"],
 		})
 		expect(both.status).toBe(200)
-		expect(Object.keys(both.body).sort()).toEqual(["cleanup_script", "object", "setup_script"])
+		expect(Object.keys(both.body).sort()).toEqual([
+			"cleanup_script",
+			"object",
+			"setup_script",
+			"terraform",
+		])
 		expect(both.body.object).toBe("gcp_connector.setup_scripts")
+		// The subscription is given no secret; only the script's own reports carry it.
 		expect(both.body.setup_script).toMatch(
-			/PUSH_ENDPOINT='https:\/\/ingest\.test\/v1\/logpush\/gcp\/[0-9a-f-]{36}\?secret=maple_gcp_/,
+			/PUSH_ENDPOINT='https:\/\/ingest\.test\/v1\/logpush\/gcp\/[0-9a-f-]{36}'\n/,
 		)
+		expect(both.body.setup_script).toMatch(
+			/REPORT_ENDPOINT='https:\/\/ingest\.test\/v1\/logpush\/gcp\/[0-9a-f-]{36}\?secret=maple_gcp_/,
+		)
+		expect(both.body.terraform).toMatch(/^ {2}scope_type += "folder"$/m)
+		expect(both.body.terraform).toMatch(/^ {2}project_id += "acme-host"$/m)
+		expect(both.body.terraform).toContain(
+			'NOT protoPayload.methodName=\\"io.k8s.coordination.v1.leases.update\\"',
+		)
+		expect(both.body.terraform).not.toMatch(/maple_gcp_[A-Za-z0-9_-]{32}|secret=/)
 		expect(both.body.setup_script).toContain("PROJECT_ID='acme-host'")
 		expect(both.body.setup_script).toContain("SCOPE_ID='123456789012'")
 		expect(both.body.setup_script).toContain('--folder="$SCOPE_ID" --include-children')
@@ -262,7 +277,7 @@ describe("v2 gcp integration over HTTP", () => {
 		expect(reader.body.setup_script).toContain(
 			"MAPLE_SERVICE_ACCOUNT='collector@maple-prod.iam.gserviceaccount.com'",
 		)
-		expect(reader.body.setup_script).not.toContain("service-accounts delete")
+		expect(reader.body.setup_script).not.toContain('service-accounts delete "$SERVICE_ACCOUNT_EMAIL"')
 		await harness.dispose()
 	})
 
@@ -295,6 +310,11 @@ describe("v2 gcp integration over HTTP", () => {
 		const turnOff = await harness.request("PATCH", path, admin.secret, { logs_enabled: false })
 		expect(turnOff.status).toBe(400)
 		expect(turnOff.body.error.code).toBe("integration_request_invalid")
+
+		// Without a Google identity there is no account to read as.
+		const check = await harness.request("POST", `${path}/check_access`, admin.secret)
+		expect(check.status).toBe(409)
+		expect(check.body.error.code).toBe("gcp_metrics_unavailable")
 		await harness.dispose()
 	})
 
@@ -310,6 +330,7 @@ describe("v2 gcp integration over HTTP", () => {
 			["POST", CONNECTORS, { scope_type: "project", scope_id: "other-project" }],
 			["PATCH", path, { metrics_enabled: true }],
 			["POST", `${path}/setup_scripts`, {}],
+			["POST", `${path}/check_access`, undefined],
 			["DELETE", path, undefined],
 		] as const) {
 			const asMember = await harness.request(method, target, member.secret, body)

apps/api/src/routes/v2/integrations-gcp.http.ts

@@ -1,5 +1,5 @@
 import { HttpApiBuilder } from "effect/http-api"
-import { CurrentTenant } from "@maple/domain/http"
+import { CurrentTenant, GcpMetricsUnavailableError } from "@maple/domain/http"
 import type { V2GcpConnector } from "@maple/domain/http/v2"
 import {
 	MapleApiV2,
@@ -14,6 +14,7 @@ import {
 	GcpConnectorService,
 	type GcpConnector,
 } from "@maple/backend/services/integrations/GcpConnectorService"
+import { GcpPromQlService } from "@maple/backend/services/integrations/GcpPromQlService"
 
 // Reading the status is open to every member. Everything else is admin-only: a connector decides
 // what may write logs into the org and what Maple reads, and its setup script carries the push
@@ -51,6 +52,7 @@ const auditMetadata = (connector: GcpConnector) => ({
 export const HttpV2GcpIntegrationsLive = HttpApiBuilder.group(MapleApiV2, "gcpIntegration", (handlers) =>
 	Effect.gen(function* () {
 		const gcp = yield* GcpConnectorService
+		const gcpPromQl = yield* GcpPromQlService
 
 		return handlers
 			.handle("status", () =>
@@ -109,9 +111,24 @@ export const HttpV2GcpIntegrationsLive = HttpApiBuilder.group(MapleApiV2, "gcpIn
 						object: "gcp_connector.setup_scripts" as const,
 						setup_script: scripts.setupScript,
 						cleanup_script: scripts.cleanupScript,
+						terraform: scripts.terraform,
 					}
 				}),
 			)
+			.handle("checkAccess", ({ params }) =>
+				Effect.gen(function* () {
+					const tenant = yield* CurrentTenant.Context
+					yield* requireAdmin(tenant.roles, adminOnly)
+					const checked = yield* gcpPromQl
+						.checkAccess(tenant.orgId, params.id)
+						.pipe(
+							Effect.catchTag("@maple/http/errors/GcpPromQlUnavailableError", (error) =>
+								Effect.fail(new GcpMetricsUnavailableError({ message: error.message })),
+							),
+						)
+					return { object: "gcp_connector.access_check" as const, ...checked }
+				}),
+			)
 			.handle("deleteConnector", ({ params }) =>
 				Effect.gen(function* () {
 					const tenant = yield* CurrentTenant.Context

apps/api/src/routes/v2/v2-test-support.ts

@@ -45,6 +45,7 @@ import { HttpV2ChatIntegrationsLive } from "./integrations-chat.http"
 import { HttpV2GcpIntegrationsLive } from "./integrations-gcp.http"
 import { HttpV2PlanetScaleIntegrationsLive } from "./integrations.http"
 import { GcpConnectorService } from "@maple/backend/services/integrations/GcpConnectorService"
+import { GcpPromQlService } from "@maple/backend/services/integrations/GcpPromQlService"
 import { HttpV2ErrorIssuesLive } from "./error-issues.http"
 import { HttpV2AnomaliesLive } from "./anomalies.http"
 import { HttpV2InvestigationsLive } from "./investigations.http"
@@ -158,7 +159,9 @@ const v2GroupLayersExceptOnboardingChecklist = (chatWorkspace: Layer.Layer<ChatW
 		),
 		HttpV2AgentFeedbackLive.pipe(Layer.provide(AgentFeedbackService.layer)),
 		// Same, plus the Env every harness provides as well.
-		HttpV2GcpIntegrationsLive.pipe(Layer.provide(GcpConnectorService.layer)),
+		HttpV2GcpIntegrationsLive.pipe(
+			Layer.provide(Layer.mergeAll(GcpConnectorService.layer, GcpPromQlService.layer)),
+		),
 		// Real reads over whichever `WarehouseQueryService` stub the test provides.
 		HttpV2SessionReplaysLive.pipe(
 			Layer.provide(

apps/ingest/Cargo.toml

@@ -60,6 +60,9 @@ tokio-postgres = "0.7"
 deadpool-postgres = "0.14"
 tokio-postgres-rustls = "0.13"
 rustls = { version = "0.23", features = ["ring"] }
+# RS256 signatures of the ID tokens Pub/Sub signs its GCP pushes with. Already
+# in the tree through rustls.
+ring = "0.17"
 webpki-roots = "0.26"
 # Opt-in profiler (https://hotpath.rs). Every macro is a no-op and no profiler
 # code is compiled unless `--features hotpath` is passed; the `tokio` and