CloudOps

GCP-first cloud DevOps config for a fictional product, Thistle Analytics. The service is insights-api: it accepts product events and returns in-process counts. AWS is a thin secondary parallel (Lambda, API Gateway HTTP API, CodeBuild). This repository does not deploy either path.

Configs are real and offline-validated. They are not deployed to any cloud account.

Thistle Analytics is fictional. There are no customers, no traffic figures, no prices, and no SLA in this demo.

What is checked

make check unsets cloud credential variables, then runs yamllint, actionlint, ruff, conftest, a JSON Schema check of the monitoring policies, terraform fmt / init -backend=false / validate / test with mock_provider, tflint, checkov, and pytest. results/checks.json is written by that run. The label is recorded: build-time, with an Asia/Shanghai timestamp.

cd cloudops
      make tools
      make check
      make showcase
      make test

make showcase writes site/cloudops/ from results/checks.json. Run it after make check, then make test, so the page numbers match the file.

Nothing in the Makefile calls gcloud, the AWS CLI, terraform apply, or a remote host.

Layout

• app/ — FastAPI process. No database and no outbound HTTP.
• gcp/ — Cloud Run, Cloud Build, IAM, Secret Manager, Monitoring, Logging, Workload Identity Federation, and a Terraform expression of the same intent.
• aws/ — secondary. The README in that directory says so in the first section.
• policies/ — Rego and the monitoring JSON Schema.
• fixtures/ — compliant IAM documents and negative ones that conftest must reject.
• docs/RUNBOOK.md — what a real deploy would touch. Service names only. No amounts.

Next step for a real project

Read docs/RUNBOOK.md. Replace thistle-analytics-demo, project number 000000000000, and the placeholder KMS key name with values from an account you are allowed to change. Pin the Cloud Run secret version. Do not grant public run.admin.