FACTUAL ACTIVITY RECORD · An activity record based on work that took place
Adopting least-privilege image access for Cloud Run deployment
Establishing the apply-identity, fixed-repository, and creation-dependency boundaries in Terraform
Purpose
The repair for the initial deployment's 403 needed to become an adopted state where the Terraform module, specification, and audits expressed the same least-privilege boundary.
Implementation
The adopted Terraform grants Reader only on the fixed Artifact Registry repository to the apply identity and creates Cloud Run only after that IAM binding exists. The runtime identity does not receive the permission.
Terraform source, GCP documentation, the integrated specification, and static verification were aligned with the same permission boundary.
Rendering diagram…
What was confirmed
Verification results
Terraform formatting, backend-free initialization, validation, GCP configuration verification, secret scanning, and specification auditing passed.
Across the adopted seven-file state, the permission recipient, scope, and creation order agreed.
Broker build, planning, and Cloud Run creation from this state occurred after the cutoff and are not included.
Basis for completion
This scope ended when minimal read access to the fixed repository and its creation dependency were consistently adopted across source, documentation, and audits.