Skip to content

googleCloudfunctions2Function

A Cloud Function that contains user computation executed in response to an event.

To get more information about function, see:

Example Usage - Cloudfunctions2 Basic

import * as cdktf from "cdktf";
/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const project = "my-project-name";
const googleStorageBucketBucket = new google.storageBucket.StorageBucket(
  this,
  "bucket",
  {
    location: "US",
    name: `\${${project}}-gcf-source`,
    uniform_bucket_level_access: true,
  }
);
const googleStorageBucketObjectObject =
  new google.storageBucketObject.StorageBucketObject(this, "object", {
    bucket: googleStorageBucketBucket.name,
    name: "function-source.zip",
    source: "function-source.zip",
  });
const googleCloudfunctions2FunctionFunction =
  new google.cloudfunctions2Function.Cloudfunctions2Function(this, "function", {
    build_config: [
      {
        entry_point: "helloHttp",
        runtime: "nodejs16",
        source: [
          {
            storage_source: [
              {
                bucket: googleStorageBucketBucket.name,
                object: googleStorageBucketObjectObject.name,
              },
            ],
          },
        ],
      },
    ],
    description: "a new function",
    location: "us-central1",
    name: "function-v2",
    service_config: [
      {
        available_memory: "256M",
        max_instance_count: 1,
        timeout_seconds: 60,
      },
    ],
  });
new cdktf.TerraformOutput(this, "function_uri", {
  value: `\${${googleCloudfunctions2FunctionFunction.serviceConfig.fqn}[0].uri}`,
});

Example Usage - Cloudfunctions2 Full

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const project = "my-project-name";
const googlePubsubTopicTopic = new google.pubsubTopic.PubsubTopic(
  this,
  "topic",
  {
    name: "functions2-topic",
  }
);
const googleServiceAccountAccount = new google.serviceAccount.ServiceAccount(
  this,
  "account",
  {
    account_id: "gcf-sa",
    display_name: "Test Service Account",
  }
);
const googleStorageBucketBucket = new google.storageBucket.StorageBucket(
  this,
  "bucket",
  {
    location: "US",
    name: `\${${project}}-gcf-source`,
    uniform_bucket_level_access: true,
  }
);
const googleStorageBucketObjectObject =
  new google.storageBucketObject.StorageBucketObject(this, "object", {
    bucket: googleStorageBucketBucket.name,
    name: "function-source.zip",
    source: "function-source.zip",
  });
new google.cloudfunctions2Function.Cloudfunctions2Function(this, "function", {
  build_config: [
    {
      entry_point: "helloPubSub",
      environment_variables: [
        {
          BUILD_CONFIG_TEST: "build_test",
        },
      ],
      runtime: "nodejs16",
      source: [
        {
          storage_source: [
            {
              bucket: googleStorageBucketBucket.name,
              object: googleStorageBucketObjectObject.name,
            },
          ],
        },
      ],
    },
  ],
  description: "a new function",
  event_trigger: [
    {
      event_type: "google.cloud.pubsub.topic.v1.messagePublished",
      pubsub_topic: googlePubsubTopicTopic.id,
      retry_policy: "RETRY_POLICY_RETRY",
      trigger_region: "us-central1",
    },
  ],
  location: "us-central1",
  name: "gcf-function",
  service_config: [
    {
      all_traffic_on_latest_revision: true,
      available_cpu: "4",
      available_memory: "4Gi",
      environment_variables: [
        {
          SERVICE_CONFIG_TEST: "config_test",
        },
      ],
      ingress_settings: "ALLOW_INTERNAL_ONLY",
      max_instance_count: 3,
      max_instance_request_concurrency: 80,
      min_instance_count: 1,
      service_account_email: googleServiceAccountAccount.email,
      timeout_seconds: 60,
    },
  ],
});

Example Usage - Cloudfunctions2 Basic Gcs

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const googleServiceAccountAccount = new google.serviceAccount.ServiceAccount(
  this,
  "account",
  {
    account_id: "gcf-sa",
    display_name:
      "Test Service Account - used for both the cloud function and eventarc trigger in the test",
  }
);
const googleStorageBucketSourceBucket = new google.storageBucket.StorageBucket(
  this,
  "source-bucket",
  {
    location: "US",
    name: "gcf-source-bucket",
    uniform_bucket_level_access: true,
  }
);
const googleStorageBucketTriggerBucket = new google.storageBucket.StorageBucket(
  this,
  "trigger-bucket",
  {
    location: "us-central1",
    name: "gcf-trigger-bucket",
    uniform_bucket_level_access: true,
  }
);
const googleStorageBucketObjectObject =
  new google.storageBucketObject.StorageBucketObject(this, "object", {
    bucket: googleStorageBucketSourceBucket.name,
    name: "function-source.zip",
    source: "function-source.zip",
  });
const dataGoogleStorageProjectServiceAccountGcsAccount =
  new google.dataGoogleStorageProjectServiceAccount.DataGoogleStorageProjectServiceAccount(
    this,
    "gcs_account",
    {}
  );
const googleProjectIamMemberGcsPubsubPublishing =
  new google.projectIamMember.ProjectIamMember(this, "gcs-pubsub-publishing", {
    member: `serviceAccount:\${${dataGoogleStorageProjectServiceAccountGcsAccount.emailAddress}}`,
    project: "my-project-name",
    role: "roles/pubsub.publisher",
  });
const googleProjectIamMemberInvoking =
  new google.projectIamMember.ProjectIamMember(this, "invoking", {
    depends_on: [`\${${googleProjectIamMemberGcsPubsubPublishing.fqn}}`],
    member: `serviceAccount:\${${googleServiceAccountAccount.email}}`,
    project: "my-project-name",
    role: "roles/run.invoker",
  });
const googleProjectIamMemberEventReceiving =
  new google.projectIamMember.ProjectIamMember(this, "event-receiving", {
    depends_on: [`\${${googleProjectIamMemberInvoking.fqn}}`],
    member: `serviceAccount:\${${googleServiceAccountAccount.email}}`,
    project: "my-project-name",
    role: "roles/eventarc.eventReceiver",
  });
const googleProjectIamMemberArtifactregistryReader =
  new google.projectIamMember.ProjectIamMember(
    this,
    "artifactregistry-reader",
    {
      depends_on: [`\${${googleProjectIamMemberEventReceiving.fqn}}`],
      member: `serviceAccount:\${${googleServiceAccountAccount.email}}`,
      project: "my-project-name",
      role: "roles/artifactregistry.reader",
    }
  );
new google.cloudfunctions2Function.Cloudfunctions2Function(this, "function", {
  build_config: [
    {
      entry_point: "entryPoint",
      environment_variables: [
        {
          BUILD_CONFIG_TEST: "build_test",
        },
      ],
      runtime: "nodejs12",
      source: [
        {
          storage_source: [
            {
              bucket: googleStorageBucketSourceBucket.name,
              object: googleStorageBucketObjectObject.name,
            },
          ],
        },
      ],
    },
  ],
  depends_on: [
    `\${${googleProjectIamMemberEventReceiving.fqn}}`,
    `\${${googleProjectIamMemberArtifactregistryReader.fqn}}`,
  ],
  description: "a new function",
  event_trigger: [
    {
      event_filters: [
        {
          attribute: "bucket",
          value: googleStorageBucketTriggerBucket.name,
        },
      ],
      event_type: "google.cloud.storage.object.v1.finalized",
      retry_policy: "RETRY_POLICY_RETRY",
      service_account_email: googleServiceAccountAccount.email,
      trigger_region: "us-central1",
    },
  ],
  location: "us-central1",
  name: "gcf-function",
  service_config: [
    {
      all_traffic_on_latest_revision: true,
      available_memory: "256M",
      environment_variables: [
        {
          SERVICE_CONFIG_TEST: "config_test",
        },
      ],
      ingress_settings: "ALLOW_INTERNAL_ONLY",
      max_instance_count: 3,
      min_instance_count: 1,
      service_account_email: googleServiceAccountAccount.email,
      timeout_seconds: 60,
    },
  ],
});

Example Usage - Cloudfunctions2 Basic Auditlogs

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const googleServiceAccountAccount = new google.serviceAccount.ServiceAccount(
  this,
  "account",
  {
    account_id: "gcf-sa",
    display_name:
      "Test Service Account - used for both the cloud function and eventarc trigger in the test",
  }
);
const googleStorageBucketAuditLogBucket =
  new google.storageBucket.StorageBucket(this, "audit-log-bucket", {
    location: "us-central1",
    name: "gcf-auditlog-bucket",
    uniform_bucket_level_access: true,
  });
const googleStorageBucketSourceBucket = new google.storageBucket.StorageBucket(
  this,
  "source-bucket",
  {
    location: "US",
    name: "gcf-source-bucket",
    uniform_bucket_level_access: true,
  }
);
const googleStorageBucketObjectObject =
  new google.storageBucketObject.StorageBucketObject(this, "object", {
    bucket: googleStorageBucketSourceBucket.name,
    name: "function-source.zip",
    source: "function-source.zip",
  });
const googleProjectIamMemberInvoking =
  new google.projectIamMember.ProjectIamMember(this, "invoking", {
    member: `serviceAccount:\${${googleServiceAccountAccount.email}}`,
    project: "my-project-name",
    role: "roles/run.invoker",
  });
const googleProjectIamMemberEventReceiving =
  new google.projectIamMember.ProjectIamMember(this, "event-receiving", {
    depends_on: [`\${${googleProjectIamMemberInvoking.fqn}}`],
    member: `serviceAccount:\${${googleServiceAccountAccount.email}}`,
    project: "my-project-name",
    role: "roles/eventarc.eventReceiver",
  });
const googleProjectIamMemberArtifactregistryReader =
  new google.projectIamMember.ProjectIamMember(
    this,
    "artifactregistry-reader",
    {
      depends_on: [`\${${googleProjectIamMemberEventReceiving.fqn}}`],
      member: `serviceAccount:\${${googleServiceAccountAccount.email}}`,
      project: "my-project-name",
      role: "roles/artifactregistry.reader",
    }
  );
new google.cloudfunctions2Function.Cloudfunctions2Function(this, "function", {
  build_config: [
    {
      entry_point: "entryPoint",
      environment_variables: [
        {
          BUILD_CONFIG_TEST: "build_test",
        },
      ],
      runtime: "nodejs12",
      source: [
        {
          storage_source: [
            {
              bucket: googleStorageBucketSourceBucket.name,
              object: googleStorageBucketObjectObject.name,
            },
          ],
        },
      ],
    },
  ],
  depends_on: [
    `\${${googleProjectIamMemberEventReceiving.fqn}}`,
    `\${${googleProjectIamMemberArtifactregistryReader.fqn}}`,
  ],
  description: "a new function",
  event_trigger: [
    {
      event_filters: [
        {
          attribute: "serviceName",
          value: "storage.googleapis.com",
        },
        {
          attribute: "methodName",
          value: "storage.objects.create",
        },
        {
          attribute: "resourceName",
          operator: "match-path-pattern",
          value: `/projects/_/buckets/\${${googleStorageBucketAuditLogBucket.name}}/objects/*.txt`,
        },
      ],
      event_type: "google.cloud.audit.log.v1.written",
      retry_policy: "RETRY_POLICY_RETRY",
      service_account_email: googleServiceAccountAccount.email,
      trigger_region: "us-central1",
    },
  ],
  location: "us-central1",
  name: "gcf-function",
  service_config: [
    {
      all_traffic_on_latest_revision: true,
      available_memory: "256M",
      environment_variables: [
        {
          SERVICE_CONFIG_TEST: "config_test",
        },
      ],
      ingress_settings: "ALLOW_INTERNAL_ONLY",
      max_instance_count: 3,
      min_instance_count: 1,
      service_account_email: googleServiceAccountAccount.email,
      timeout_seconds: 60,
    },
  ],
});

Example Usage - Cloudfunctions2 Secret Env

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const project = "my-project-name";
const googleSecretManagerSecretSecret =
  new google.secretManagerSecret.SecretManagerSecret(this, "secret", {
    replication: [
      {
        user_managed: [
          {
            replicas: [
              {
                location: "us-central1",
              },
            ],
          },
        ],
      },
    ],
    secret_id: "secret",
  });
const googleSecretManagerSecretVersionSecret =
  new google.secretManagerSecretVersion.SecretManagerSecretVersion(
    this,
    "secret_1",
    {
      enabled: true,
      secret: googleSecretManagerSecretSecret.name,
      secret_data: "secret",
    }
  );
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
googleSecretManagerSecretVersionSecret.overrideLogicalId("secret");
const googleStorageBucketBucket = new google.storageBucket.StorageBucket(
  this,
  "bucket",
  {
    location: "US",
    name: `\${${project}}-gcf-source`,
    uniform_bucket_level_access: true,
  }
);
const googleStorageBucketObjectObject =
  new google.storageBucketObject.StorageBucketObject(this, "object", {
    bucket: googleStorageBucketBucket.name,
    name: "function-source.zip",
    source: "function-source.zip",
  });
new google.cloudfunctions2Function.Cloudfunctions2Function(this, "function", {
  build_config: [
    {
      entry_point: "helloHttp",
      runtime: "nodejs16",
      source: [
        {
          storage_source: [
            {
              bucket: googleStorageBucketBucket.name,
              object: googleStorageBucketObjectObject.name,
            },
          ],
        },
      ],
    },
  ],
  depends_on: [`\${${googleSecretManagerSecretVersionSecret.fqn}}`],
  description: "a new function",
  location: "us-central1",
  name: "function-secret",
  service_config: [
    {
      available_memory: "256M",
      max_instance_count: 1,
      secret_environment_variables: [
        {
          key: "TEST",
          project_id: project,
          secret: googleSecretManagerSecretSecret.secretId,
          version: "latest",
        },
      ],
      timeout_seconds: 60,
    },
  ],
});

Example Usage - Cloudfunctions2 Secret Volume

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const project = "my-project-name";
const googleSecretManagerSecretSecret =
  new google.secretManagerSecret.SecretManagerSecret(this, "secret", {
    replication: [
      {
        user_managed: [
          {
            replicas: [
              {
                location: "us-central1",
              },
            ],
          },
        ],
      },
    ],
    secret_id: "secret",
  });
const googleSecretManagerSecretVersionSecret =
  new google.secretManagerSecretVersion.SecretManagerSecretVersion(
    this,
    "secret_1",
    {
      enabled: true,
      secret: googleSecretManagerSecretSecret.name,
      secret_data: "secret",
    }
  );
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
googleSecretManagerSecretVersionSecret.overrideLogicalId("secret");
const googleStorageBucketBucket = new google.storageBucket.StorageBucket(
  this,
  "bucket",
  {
    location: "US",
    name: `\${${project}}-gcf-source`,
    uniform_bucket_level_access: true,
  }
);
const googleStorageBucketObjectObject =
  new google.storageBucketObject.StorageBucketObject(this, "object", {
    bucket: googleStorageBucketBucket.name,
    name: "function-source.zip",
    source: "function-source.zip",
  });
new google.cloudfunctions2Function.Cloudfunctions2Function(this, "function", {
  build_config: [
    {
      entry_point: "helloHttp",
      runtime: "nodejs16",
      source: [
        {
          storage_source: [
            {
              bucket: googleStorageBucketBucket.name,
              object: googleStorageBucketObjectObject.name,
            },
          ],
        },
      ],
    },
  ],
  depends_on: [`\${${googleSecretManagerSecretVersionSecret.fqn}}`],
  description: "a new function",
  location: "us-central1",
  name: "function-secret",
  service_config: [
    {
      available_memory: "256M",
      max_instance_count: 1,
      secret_volumes: [
        {
          mount_path: "/etc/secrets",
          project_id: project,
          secret: googleSecretManagerSecretSecret.secretId,
        },
      ],
      timeout_seconds: 60,
    },
  ],
});

Example Usage - Cloudfunctions2 Private Workerpool

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const project = "my-project-name";
const googleCloudbuildWorkerPoolPool =
  new google.cloudbuildWorkerPool.CloudbuildWorkerPool(this, "pool", {
    location: "us-central1",
    name: "workerpool",
    worker_config: [
      {
        disk_size_gb: 100,
        machine_type: "e2-standard-8",
        no_external_ip: false,
      },
    ],
  });
const googleStorageBucketBucket = new google.storageBucket.StorageBucket(
  this,
  "bucket",
  {
    location: "US",
    name: `\${${project}}-gcf-source`,
    uniform_bucket_level_access: true,
  }
);
const googleStorageBucketObjectObject =
  new google.storageBucketObject.StorageBucketObject(this, "object", {
    bucket: googleStorageBucketBucket.name,
    name: "function-source.zip",
    source: "function-source.zip",
  });
new google.cloudfunctions2Function.Cloudfunctions2Function(this, "function", {
  build_config: [
    {
      entry_point: "helloHttp",
      runtime: "nodejs16",
      source: [
        {
          storage_source: [
            {
              bucket: googleStorageBucketBucket.name,
              object: googleStorageBucketObjectObject.name,
            },
          ],
        },
      ],
      worker_pool: googleCloudbuildWorkerPoolPool.id,
    },
  ],
  description: "a new function",
  location: "us-central1",
  name: "function-workerpool",
  service_config: [
    {
      available_memory: "256M",
      max_instance_count: 1,
      timeout_seconds: 60,
    },
  ],
});

Argument Reference

The following arguments are supported:

  • name - (Required) A user-defined name of the function. Function names must be unique globally and match pattern projects/*/locations/*/functions/*.

  • description - (Optional) User-provided description of a function.

  • buildConfig - (Optional) Describes the Build step of the function that builds a container from the given source. Structure is documented below.

  • serviceConfig - (Optional) Describes the Service being deployed. Structure is documented below.

  • eventTrigger - (Optional) An Eventarc trigger managed by Google Cloud Functions that fires events in response to a condition in another service. Structure is documented below.

  • labels - (Optional) A set of key/value label pairs associated with this Cloud Function.

  • location - (Optional) The location of this cloud function.

  • project - (Optional) The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

The buildConfig block supports:

  • build - (Output) The Cloud Build name of the latest successful deployment of the function.

  • runtime - (Optional) The runtime in which to run the function. Required when deploying a new function, optional when updating an existing function.

  • entryPoint - (Optional) The name of the function (as defined in source code) that will be executed. Defaults to the resource name suffix, if not specified. For backward compatibility, if function with given name is not found, then the system will try to use function named "function". For Node.js this is name of a function exported by the module specified in source_location.

  • source - (Optional) The location of the function source code. Structure is documented below.

  • workerPool - (Optional) Name of the Cloud Build Custom Worker Pool that should be used to build the function.

  • environmentVariables - (Optional) User-provided build-time environment variables for the function.

  • dockerRepository - (Optional) User managed repository created in Artifact Registry optionally with a customer managed encryption key.

The source block supports:

  • storageSource - (Optional) If provided, get the source from this location in Google Cloud Storage. Structure is documented below.

  • repoSource - (Optional) If provided, get the source from this location in a Cloud Source Repository. Structure is documented below.

The storageSource block supports:

  • bucket - (Optional) Google Cloud Storage bucket containing the source

  • object - (Optional) Google Cloud Storage object containing the source.

  • generation - (Optional) Google Cloud Storage generation for the object. If the generation is omitted, the latest generation will be used.

The repoSource block supports:

  • projectId - (Optional) ID of the project that owns the Cloud Source Repository. If omitted, the project ID requesting the build is assumed.

  • repoName - (Optional) Name of the Cloud Source Repository.

  • branchName - (Optional) Regex matching branches to build.

  • tagName - (Optional) Regex matching tags to build.

  • commitSha - (Optional) Regex matching tags to build.

  • dir - (Optional) Directory, relative to the source root, in which to run the build.

  • invertRegex - (Optional) Only trigger a build if the revision regex does NOT match the revision regex.

The serviceConfig block supports:

  • service - (Optional) Name of the service associated with a Function.

  • timeoutSeconds - (Optional) The function execution timeout. Execution is considered failed and can be terminated if the function is not completed at the end of the timeout period. Defaults to 60 seconds.

  • availableMemory - (Optional) The amount of memory available for a function. Defaults to 256M. Supported units are k, M, G, Mi, Gi. If no unit is supplied the value is interpreted as bytes.

  • maxInstanceRequestConcurrency - (Optional) Sets the maximum number of concurrent requests that each instance can receive. Defaults to 1.

  • availableCpu - (Optional) The number of CPUs used in a single container instance. Default value is calculated from available memory.

  • environmentVariables - (Optional) Environment variables that shall be available during function execution.

  • maxInstanceCount - (Optional) The limit on the maximum number of function instances that may coexist at a given time.

  • minInstanceCount - (Optional) The limit on the minimum number of function instances that may coexist at a given time.

  • vpcConnector - (Optional) The Serverless VPC Access connector that this cloud function can connect to.

  • vpcConnectorEgressSettings - (Optional) Available egress settings. Possible values are vpcConnectorEgressSettingsUnspecified, privateRangesOnly, and allTraffic.

  • ingressSettings - (Optional) Available ingress settings. Defaults to "ALLOW_ALL" if unspecified. Default value is allowAll. Possible values are allowAll, allowInternalOnly, and allowInternalAndGclb.

  • uri - (Output) URI of the Service deployed.

  • gcfUri - (Output) URIs of the Service deployed

  • serviceAccountEmail - (Optional) The email of the service account for this function.

  • allTrafficOnLatestRevision - (Optional) Whether 100% of traffic is routed to the latest revision. Defaults to true.

  • secretEnvironmentVariables - (Optional) Secret environment variables configuration. Structure is documented below.

  • secretVolumes - (Optional) Secret volumes configuration. Structure is documented below.

The secretEnvironmentVariables block supports:

  • key - (Required) Name of the environment variable.

  • projectId - (Required) Project identifier (preferrably project number but can also be the project ID) of the project that contains the secret. If not set, it will be populated with the function's project assuming that the secret exists in the same project as of the function.

  • secret - (Required) Name of the secret in secret manager (not the full resource name).

  • version - (Required) Version of the secret (version number or the string 'latest'). It is recommended to use a numeric version for secret environment variables as any updates to the secret value is not reflected until new instances start.

The secretVolumes block supports:

  • mountPath - (Required) The path within the container to mount the secret volume. For example, setting the mountPath as /etc/secrets would mount the secret value files under the /etc/secrets directory. This directory will also be completely shadowed and unavailable to mount any other secrets. Recommended mount path: /etc/secrets

  • projectId - (Required) Project identifier (preferrably project number but can also be the project ID) of the project that contains the secret. If not set, it will be populated with the function's project assuming that the secret exists in the same project as of the function.

  • secret - (Required) Name of the secret in secret manager (not the full resource name).

  • versions - (Optional) List of secret versions to mount for this secret. If empty, the latest version of the secret will be made available in a file named after the secret under the mount point.' Structure is documented below.

The versions block supports:

  • version - (Required) Version of the secret (version number or the string 'latest'). It is preferable to use latest version with secret volumes as secret value changes are reflected immediately.

  • path - (Required) Relative path of the file under the mount path where the secret value for this version will be fetched and made available. For example, setting the mountPath as '/etc/secrets' and path as secret_foo would mount the secret value file at /etc/secrets/secret_foo.

The eventTrigger block supports:

  • trigger - (Output) Output only. The resource name of the Eventarc trigger.

  • triggerRegion - (Optional) The region that the trigger will be in. The trigger will only receive events originating in this region. It can be the same region as the function, a different region or multi-region, or the global region. If not provided, defaults to the same region as the function.

  • eventType - (Optional) Required. The type of event to observe.

  • eventFilters - (Optional) Criteria used to filter events. Structure is documented below.

  • pubsubTopic - (Optional) The name of a Pub/Sub topic in the same project that will be used as the transport topic for the event delivery.

  • serviceAccountEmail - (Optional) The email of the service account for this function.

  • retryPolicy - (Optional) Describes the retry policy in case of function's execution failure. Retried execution is charged as any other execution. Possible values are retryPolicyUnspecified, retryPolicyDoNotRetry, and retryPolicyRetry.

The eventFilters block supports:

  • attribute - (Required) 'Required. The name of a CloudEvents attribute. Currently, only a subset of attributes are supported for filtering. Use the gcloudEventarcProvidersDescribe command to learn more about events and their attributes. Do not filter for the 'type' attribute here, as this is already achieved by the resource's eventType attribute.

  • value - (Required) Required. The value for the attribute. If the operator field is set as matchPathPattern, this value can be a path pattern instead of an exact value.

  • operator - (Optional) Optional. The operator used for matching the events with the value of the filter. If not specified, only events that have an exact key-value pair specified in the filter are matched. The only allowed value is matchPathPattern. See documentation on path patterns here'

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

  • id - an identifier for the resource with format projects/{{project}}/locations/{{location}}/functions/{{name}}

  • environment - The environment the function is hosted on.

  • state - Describes the current state of the function.

  • updateTime - The last update timestamp of a Cloud Function.

Timeouts

This resource provides the following Timeouts configuration options:

  • create - Default is 60 minutes.
  • update - Default is 60 minutes.
  • delete - Default is 60 minutes.

Import

function can be imported using any of these accepted formats:

$ terraform import google_cloudfunctions2_function.default projects/{{project}}/locations/{{location}}/functions/{{name}}
$ terraform import google_cloudfunctions2_function.default {{project}}/{{location}}/{{name}}
$ terraform import google_cloudfunctions2_function.default {{location}}/{{name}}

User Project Overrides

This resource supports User Project Overrides.