SignalDesk Cloud Launch: Keyless, Policy-Gated GCP Delivery
A lean service business needed a secure booking API without operating servers or Kubernetes. Manual console changes, permanent CI keys, unbounded scaling, and an internet-addressable database would create avoidable security, reliability, and cost risk.
Solution
Built and deployed a production-minded GCP foundation and FastAPI booking service using Terraform and GitHub Actions. The delivery path authenticates with short-lived OIDC credentials, checks real Terraform plans with OPA, scans infrastructure and images, generates an SBOM, deploys an immutable Cloud Run candidate with zero traffic, verifies database-backed readiness, and promotes only the tested revision.
Architecture
Cloud Run serves the API and reaches PostgreSQL 18 on Cloud SQL through Direct VPC egress and Private Service Access. Cloud SQL has no public IPv4 address. Secret Manager supplies the generated database password. Artifact Registry stores immutable images. Cloud Logging, Monitoring uptime checks, VPC flow logs, automated backups, point-in-time recovery, and a $10 budget provide operational controls. Terraform state and short-lived reviewed plans live in a private versioned GCS bucket.
Verified proof
Explore the deployed service, implementation, and verification evidence behind this case study.
Stack
Services Used
Outcomes
- Deployed a live booking API with zero long-lived CI keys
- Kept Cloud SQL private with Direct VPC egress
- Promoted only a smoke-tested zero-traffic candidate
- Verified Terraform with a no-change policy-gated apply
- Correlated a live request through structured Cloud Logging
- Enforced a $10 monthly budget and three-instance cap
0
Long-lived CI keys
10/10
OPA tests
0
Checkov failures
3
Cloud Run max instances
$10
Monthly budget