Inyecta Secretos en Cloud Run sin exponer credenciales

terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 7.0"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

variable "project_id" {
  type        = string
  description = "Google Cloud project ID"
}

variable "region" {
  type        = string
  default     = "europe-west1"
}

# -------------------------------------------------------------------
# 1. Secret Manager
# -------------------------------------------------------------------

resource "google_secret_manager_secret" "db_password" {
  secret_id = "orders-db-password"

  replication {
    auto {}
  }
}

# En un entorno real, evita introducir valores productivos
# directamente en el código Terraform.
resource "google_secret_manager_secret_version" "db_password" {
  secret      = google_secret_manager_secret.db_password.name
  secret_data = var.db_password
}

variable "db_password" {
  type      = string
  sensitive = true
}

# -------------------------------------------------------------------
# 2. Identidad específica para Cloud Run
# -------------------------------------------------------------------

resource "google_service_account" "cloud_run" {
  account_id   = "orders-api-runtime"
  display_name = "Runtime identity for Orders API"
}

# -------------------------------------------------------------------
# 3. Mínimo privilegio: acceso únicamente al secreto necesario
# -------------------------------------------------------------------

resource "google_secret_manager_secret_iam_member" "db_password_accessor" {
  secret_id = google_secret_manager_secret.db_password.id
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.cloud_run.email}"
}

# -------------------------------------------------------------------
# 4. Cloud Run
# -------------------------------------------------------------------

resource "google_cloud_run_v2_service" "orders_api" {
  name     = "orders-api"
  location = var.region

  template {
    service_account = google_service_account.cloud_run.email

    containers {
      image = "europe-west1-docker.pkg.dev/PROJECT_ID/apps/orders-api:1.0.0"

      env {
        name = "DB_PASSWORD"

        value_source {
          secret_key_ref {
            secret  = google_secret_manager_secret.db_password.id
            version = google_secret_manager_secret_version.db_password.version
          }
        }
      }

      env {
        name  = "APP_ENV"
        value = "production"
      }
    }
  }

  depends_on = [
    google_secret_manager_secret_iam_member.db_password_accessor
  ]
}

import os
from dataclasses import dataclass


@dataclass(frozen=True)
class Settings:
    database_url: str
    db_password: str
    environment: str


def load_settings() -> Settings:
    """
    Lee configuración inyectada por el entorno de ejecución.

    La aplicación no necesita llamar directamente a Secret Manager.
    Cloud Run resuelve el secreto antes de iniciar la instancia.
    """
    password = os.getenv("DB_PASSWORD")

    if not password:
        raise RuntimeError(
            "DB_PASSWORD is required but was not provided"
        )

    database_url = os.getenv(
        "DATABASE_URL",
        "postgresql://orders-db:5432/orders"
    )

    environment = os.getenv(
        "APP_ENV",
        "development"
    )

    return Settings(
        database_url=database_url,
        db_password=password,
        environment=environment,
    )


settings = load_settings()