bring unmanaged GCP resources under Terraform

vault-kms.tf: KMS keyring/key for Vault auto-unseal + vault-unseal SA and IAM bindings — all imported from existing GCP resources. prevent_destroy=true on the crypto key to protect against accidental deletion. unmanaged-secrets.tf: 8 secrets that were referenced by live Cloud Run services but had no TF resource — anthropic-api-key, resend-api-key, supabase-service-key, docuseal-webhook-token, stripe-price-professional, stripe-price-founding, stripe-price-family-child, gitea-runner-token. service-account.tf: 4 manually-created SAs — neuron-workspace-dwd, docuseal-storage, analytics-reader, harmonic-search-console.
2026-05-04 09:57:33 -05:00
parent 7e092d4686
commit 89564ccec7
3 changed files with 164 additions and 0 deletions
@@ -0,0 +1,46 @@
+# ── Vault KMS Auto-Unseal ─────────────────────────────────────────────────────
+# Vault running on Legion uses GCP KMS for auto-unseal. Configured in:
+#   servers/legion/apps/vault.yaml (seal "gcpckms" block)
+# Key ring: vault, key: vault-unseal, location: global
+#
+# CRITICAL: prevent_destroy = true on the crypto key.
+# Deleting this key makes Vault permanently sealed — all secrets inaccessible.
+#
+# These resources were created manually and are imported into TF state.
+# Values already exist in GCP — TF is just taking ownership.
+
+resource "google_kms_key_ring" "vault" {
+  name     = "vault"
+  location = "global"
+  project  = var.project_id
+}
+
+resource "google_kms_crypto_key" "vault_unseal" {
+  name            = "vault-unseal"
+  key_ring        = google_kms_key_ring.vault.id
+  purpose         = "ENCRYPT_DECRYPT"
+  rotation_period = "7776000s" # 90 days
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "google_service_account" "vault_unseal" {
+  account_id   = "vault-unseal"
+  display_name = "Vault KMS Auto-Unseal"
+  description  = "Service account for Vault auto-unseal via GCP KMS. Used by the Vault pod on Legion."
+  project      = var.project_id
+}
+
+resource "google_kms_crypto_key_iam_member" "vault_unseal_encrypter_decrypter" {
+  crypto_key_id = google_kms_crypto_key.vault_unseal.id
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member        = "serviceAccount:${google_service_account.vault_unseal.email}"
+}
+
+resource "google_kms_crypto_key_iam_member" "vault_unseal_viewer" {
+  crypto_key_id = google_kms_crypto_key.vault_unseal.id
+  role          = "roles/cloudkms.viewer"
+  member        = "serviceAccount:${google_service_account.vault_unseal.email}"
+}