GCP

# 1. Register the GCP Cloud Account. Autodiscovery is on by default. allow_gcs_access
#    with an empty gcs_buckets list grants log delivery to any bucket in the project;
#    set gcs_buckets to scope it.
resource "formal_integration_cloud" "gcp" {
  name = "production-gcp"

  gcp {
    project_id                              = "my-gcp-project"
    enable_compute_instances_autodiscovery  = true
    enable_gke_clusters_autodiscovery       = true
    enable_cloudsql_instances_autodiscovery = true
    allow_gcs_access                        = true
  }
}

# 2. Provision the GCP-side resources with the Formal-maintained module, driven by the
#    roles and buckets Formal derives from the capabilities enabled above.
module "formal_gcp" {
  source = "github.com/formalco/terraform-formal-gcp"

  integration_id  = formal_integration_cloud.gcp.id
  formal_role_arn = formal_integration_cloud.gcp.aws_formal_role_arn
  project_id      = "my-gcp-project"
  roles           = formal_integration_cloud.gcp.gcp_roles
  gcs_buckets     = formal_integration_cloud.gcp.gcp_gcs_buckets
}

# 3. Report the created resources back to Formal to activate the integration.
resource "formal_integration_cloud_gcp_activation" "gcp" {
  integration_id                  = formal_integration_cloud.gcp.id
  service_account_email           = module.formal_gcp.service_account_email
  workload_identity_pool_provider = module.formal_gcp.workload_identity_pool_provider
}