Security hardening: least-privilege IAM, plan/apply split, bucket protections

[Jeffreyhung]

Implements the agreed findings from the in-depth security review.

Changes

Item	Change
#1 Plan/apply SA split	New read-only gha-cf-tf-plan SA (viewer + state read/lock only) for PR terraform plan; privileged gha-cloud-functions-deployment reserved for apply. Workload-identity binding pins the apply SA to refs/heads/main; google.subject mapped to assertion.sub. Apply job gated behind the production GitHub Environment.
#3	Removed project-wide roles/iam.serviceAccountUser from the deploy SA (per-SA actAs already granted in each module).
#4	Removed project-wide roles/secretmanager.secretAccessor; replaced with a narrow custom role that creates/manages secrets + their IAM bindings without reading secret values.
#5	Protected the Terraform state bucket: force_destroy = false + lifecycle { prevent_destroy = true }.
#6	Fixed the staging-bucket IAM binding that wrongly targeted the state bucket; plan SA added to the authoritative state-bucket binding.
#8 (partial)	Removed the unnecessary project-wide monitoring.viewer from pub/sub SAs.
#9	Removed self-actAs bindings on function/workflow/eventarc SAs and a duplicate deploy-SA actAs in the workflow module.
UBLA	uniform_bucket_level_access = true on all buckets.
Dependabot	New config for github-actions, terraform, and pip.
Misc	Added required_version >= 1.5.0; renamed varables.tf → variables.tf.

README updated for the two-identity model, the production environment requirement, and state-bucket protection.

Not done: scoping the workflows.invoker grants

The remaining part of #8 is not achievable in Terraform today: the hashicorp/google provider exposes no google_workflows_workflow_iam_* resource in any version (verified v6 and v7.38), and Cloud Workflows does not support resource.name IAM Conditions. The grants stay project-wide with accurate in-code NOTEs. Residual risk is low — the role only permits executing workflows and is held by dedicated single-purpose SAs.

⚠️ Before merging / applying

• Validation was offline only (terraform validate + fmt against the v6.20 provider schema). Run a real terraform plan against the project to review the IAM diff before applying.
• Plan SA bootstrap: this PR's own plan job will fail at auth because gha-cf-tf-plan doesn't exist yet. Create it via an admin-run apply first (per the README initial-run flow), or merge despite the failing check so the apply creates it. Later PRs will plan cleanly. The merge-to-main apply keeps working — the old attribute.repository binding still covers main until this tightens it to refs/heads/main.
• Configure the production environment (Settings → Environments) with required reviewers + a main-only branch rule, or the approval gate won't enforce.
• The new custom role + IAM bindings are created by a privileged (owner) apply, same as the existing project-IAM bindings.

🤖 Generated with Claude Code

[github-actions]

Terraform plan in .

Plan: 1 to add, 1 to change, 1 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.functions.module.cloud_function_gen2["example-gen2-cron"].google_cloudfunctions2_function.function will be updated in-place
!~  resource "google_cloudfunctions2_function" "function" {
        id               = "projects/jeffreyhung-test/locations/us-west1/functions/example-gen2-cron"
        name             = "example-gen2-cron"
#        (11 unchanged attributes hidden)

!~      build_config {
#            (7 unchanged attributes hidden)

!~          source {
!~              storage_source {
!~                  object     = "src-90ebbf1bfdc8d1b0c1deff70132cdc47.zip" -> "src-03bdfabf8c7adb2ef887fe89f69a0dbe.zip"
#                    (2 unchanged attributes hidden)
                }
            }
        }

#        (1 unchanged block hidden)
    }

  # module.functions.module.cloud_function_gen2["example-gen2-cron"].google_storage_bucket_object.zip must be replaced
-/+ resource "google_storage_bucket_object" "zip" {
+       content             = (sensitive value)
!~      crc32c              = "N2/bfA==" -> (known after apply)
!~      detect_md5hash      = "kOu/G/3I0bDB3v9wEyzcRw==" -> "different hash"
-       event_based_hold    = false -> null
!~      generation          = 1782338383704324 -> (known after apply)
!~      id                  = "********************************************************************************" -> (known after apply)
+       kms_key_name        = (known after apply)
!~      md5hash             = "kOu/G/3I0bDB3v9wEyzcRw==" -> (known after apply)
!~      media_link          = "https://storage.googleapis.com/download/storage/v1/b/jeffreyhung-test-cloud-function-staging/o/src-90ebbf1bfdc8d1b0c1deff70132cdc47.zip?generation=1782338383704324&alt=media" -> (known after apply)
!~      name                = "src-90ebbf1bfdc8d1b0c1deff70132cdc47.zip" -> "src-03bdfabf8c7adb2ef887fe89f69a0dbe.zip" # forces replacement
!~      output_name         = "src-90ebbf1bfdc8d1b0c1deff70132cdc47.zip" -> (known after apply)
!~      self_link           = "https://www.googleapis.com/storage/v1/b/jeffreyhung-test-cloud-function-staging/o/src-90ebbf1bfdc8d1b0c1deff70132cdc47.zip" -> (known after apply)
!~      storage_class       = "STANDARD" -> (known after apply)
-       temporary_hold      = false -> null
#        (8 unchanged attributes hidden)
    }

Plan: 1 to add, 1 to change, 1 to destroy.

✅ Plan applied in Terraform Apply #47

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 232ffa2. Configure here.}