gcp-reference-platform — verified, never applied

What this proves — and what it does not

Proves

The configuration is valid for hashicorp/google and passes terraform test assertions that encode security posture.
Resource wiring composes: modules accept typed, validated inputs and the dev/prod roots plan without unknown-value errors.
IAM, network and recovery choices are reviewable as code and are pinned by version.

Does not prove

That any resource exists, or that an apply would succeed. Quotas, org policy, API enablement and IAM propagation are never exercised.
That the numbers sized here are right for a real workload.
That the application connects to Cloud SQL — that needs a deployed VPC and instance.

Verification

Each unit below was initialised with -backend=false, validated, and tested with command = plan against a mocked provider.

Loading recorded verification output…

Raw verification logs

Modules

Inputs and outputs are generated by terraform-docs during CI, not written by hand.

Module documentation not present in this build.

Dependency graph

Produced by terraform graph on the production composition.

Graph not present in this build.

Security posture

Control	Where it is enforced	Asserted by a test
No public database address	`cloud-sql-postgres`: `ipv4_enabled = false`, private services access	yes
Point-in-time recovery and backups	`cloud-sql-postgres`: `backup_configuration`	yes
Deletion protection in prod	`envs/prod` → module input	yes
No database passwords	Cloud SQL IAM auth; secrets by reference only	partial — see ADR 0003
One identity per workload	`cloud-run-service`, `cloud-run-job`	yes
No anonymous invocation	`cloud-run-service`: `allow_unauthenticated = false`	yes
Secrets never in tfvars	Secret Manager references in `secret_env`	yes
Keyless CI federation, pinned to repo and ref	`github-wif`: `attribute_condition`	yes
No primitive roles	Explicit predefined roles only	yes
Bounded redelivery	`pubsub`: dead-letter policy and retry backoff	yes

Decision records

ADR list not present in this build.

Reproduce

git clone https://github.com/slayyyyer/gcp-reference-platform
cd gcp-reference-platform
# Terraform 1.17.x, no credentials needed
./scripts/verify.sh        # fmt, init -backend=false, validate, terraform test, tflint
./scripts/build-docs.sh    # assembles dist/ (needs terraform-docs + graphviz for full output)

There is no apply step, no backend and no state. That is the point: the repository is an auditable artefact, not a deployed platform.