Keyless Access (Workload Identity)

# Bluejay integration: keyless access via Workload Identity Federation.
#
# Apply this in YOUR OWN GCP project. It creates a Workload Identity Pool and
# an OIDC provider that trust Bluejay's issuer, plus a dedicated service
# account that Bluejay impersonates after a successful token exchange.
#
# No keys are created anywhere in this design. Revoke all access at any time by
# removing the workloadIdentityUser binding, or by running terraform destroy.

terraform {
  required_version = ">= 1.5"

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = ">= 5.0"
    }
  }
}

provider "google" {
  project = var.project_id
}

locals {
  pool_id     = "bluejay"
  provider_id = "bluejay"

  # Resource path of the OIDC provider. This is the value you paste back into
  # Bluejay as the workload identity provider (no scheme, no host).
  provider_path = "projects/${var.project_number}/locations/global/workloadIdentityPools/${local.pool_id}/providers/${local.provider_id}"

  # Full resource name. Google STS requires the token audience to equal this
  # exact string; Bluejay derives it from provider_path when minting tokens.
  provider_resource_name = "//iam.googleapis.com/${local.provider_path}"

  # Role bundles per capability. Read and run only, never admin.
  # Only the roles for services listed in var.enabled_services are granted.
  service_roles = {
    dialogflow = ["roles/dialogflow.reader", "roles/dialogflow.client"]
    ces        = ["roles/ces.viewer", "roles/ces.client"]
    logging    = ["roles/logging.viewer"]
    storage    = ["roles/storage.objectViewer"]
    bigquery   = ["roles/bigquery.jobUser", "roles/bigquery.dataViewer"]
    vertex     = ["roles/aiplatform.user"]
  }

  role_grants = flatten([
    for svc in var.enabled_services : [
      for role in lookup(local.service_roles, svc, []) : {
        key  = "${svc}:${role}"
        role = role
      }
    ]
  ])
}

# --- Workload Identity Pool -------------------------------------------------

resource "google_iam_workload_identity_pool" "bluejay" {
  project                   = var.project_id
  workload_identity_pool_id = local.pool_id
  display_name              = "Bluejay"
  description               = "Federated identity pool trusting the Bluejay OIDC issuer for keyless access."
}

# --- OIDC provider ----------------------------------------------------------

resource "google_iam_workload_identity_pool_provider" "bluejay" {
  project                            = var.project_id
  workload_identity_pool_id          = google_iam_workload_identity_pool.bluejay.workload_identity_pool_id
  workload_identity_pool_provider_id = local.provider_id
  display_name                       = "Bluejay OIDC"
  description                        = "OIDC provider for Bluejay federated tokens."

  # Map Bluejay's JWT claims onto Google attributes. google.subject is required.
  attribute_mapping = {
    "google.subject"           = "assertion.sub"
    "attribute.tenant_id"      = "assertion.tenant_id"
    "attribute.integration_id" = "assertion.integration_id"
    "attribute.environment"    = "assertion.environment"
  }

  # This is the security boundary. Google evaluates this expression before it
  # will issue a federated credential, pinning the incoming token's tenant_id
  # claim to YOUR Bluejay tenant id and requiring environment == "production".
  #
  # Without it, the provider would accept any token Bluejay's issuer signs, so
  # a different Bluejay tenant could exchange a token here and impersonate your
  # service account. The condition makes your project trust exactly one tenant,
  # not the issuer at large.
  attribute_condition = "assertion.tenant_id == \"${var.bluejay_tenant_id}\" && assertion.environment == \"production\""

  oidc {
    issuer_uri = "https://api.getbluejay.ai"

    # The token audience must be the provider resource name itself. Google
    # rejects tokens whose aud is anything else, which stops a token minted for
    # one customer's provider from being replayed against another's.
    allowed_audiences = [local.provider_resource_name]
  }
}

# --- Dedicated service account ----------------------------------------------

resource "google_service_account" "bluejay_integration" {
  project      = var.project_id
  account_id   = "bluejay-integration"
  display_name = "Bluejay Integration"
  description  = "Impersonated by Bluejay via Workload Identity Federation. No keys are issued for this account."
}

# --- Allow the federated identity to impersonate the service account --------

# workloadIdentityUser is granted to a principalSet scoped to
# attribute.tenant_id, not to the whole pool. The provider condition above
# already pins tenant_id; scoping the binding as well is defense in depth, so
# the impersonation grant itself is limited to this one tenant.
resource "google_service_account_iam_member" "workload_identity_user" {
  service_account_id = google_service_account.bluejay_integration.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.bluejay.name}/attribute.tenant_id/${var.bluejay_tenant_id}"
}

# --- Least privilege role grants --------------------------------------------

# One binding per (service, role) pair for the services you enabled. These are
# project level. For storage and bigquery, prefer narrowing to the specific
# bucket(s) and dataset(s) Bluejay reads.
resource "google_project_iam_member" "service_roles" {
  for_each = { for g in local.role_grants : g.key => g }

  project = var.project_id
  role    = each.value.role
  member  = "serviceAccount:${google_service_account.bluejay_integration.email}"
}

# Always granted. Voice simulations run through Bluejay's LiveKit bridge, which
# sets a quota project on its Dialogflow credentials. That makes Google enforce
# serviceusage.services.use, and without this role every voice call fails at
# connect time with USER_PROJECT_DENIED. It permits consuming quota in this
# project and grants no access to any data.
resource "google_project_iam_member" "service_usage_consumer" {
  project = var.project_id
  role    = "roles/serviceusage.serviceUsageConsumer"
  member  = "serviceAccount:${google_service_account.bluejay_integration.email}"
}

variable "bluejay_tenant_id" {
  type        = string
  description = <<-EOT
    Your Bluejay tenant id, copied from Bluejay under
    Settings > Integrations > Google Agents.

    This value is pinned inside the provider attribute_condition and inside the
    principalSet used for the workloadIdentityUser binding. It is the security
    boundary: only Bluejay tokens whose tenant_id claim equals this value can
    exchange through this provider and impersonate the service account. Do not
    invent or change it. Use exactly what Bluejay shows.
  EOT

  validation {
    condition     = length(var.bluejay_tenant_id) > 0
    error_message = "bluejay_tenant_id must be the non empty value shown in Bluejay."
  }
}

variable "project_id" {
  type        = string
  description = "The GCP project id where these resources are created, for example acme-voice-prod."
}

variable "project_number" {
  type        = string
  description = <<-EOT
    The numeric project number for project_id, for example 123456789012.

    Google Workload Identity Federation resource names use the numeric project
    number, not the project id. Find it with:
      gcloud projects describe <project_id> --format='value(projectNumber)'
  EOT
}

variable "enabled_services" {
  type        = set(string)
  description = <<-EOT
    Which capability bundles to grant the Bluejay service account. Each entry
    turns on the least privilege roles for that Google surface.

    Supported values:
      dialogflow  Dialogflow CX read + run  (roles/dialogflow.reader, roles/dialogflow.client)
      ces         CES read + run            (roles/ces.viewer, roles/ces.client)
      logging     Cloud Logging read        (roles/logging.viewer)
      storage     GCS object read           (roles/storage.objectViewer)
      bigquery    BigQuery read + run jobs  (roles/bigquery.jobUser, roles/bigquery.dataViewer)
      vertex      Vertex AI use             (roles/aiplatform.user)

    Grant only what Bluejay actually needs.
  EOT
  default     = ["dialogflow"]

  validation {
    condition = alltrue([
      for s in var.enabled_services :
      contains(["dialogflow", "ces", "logging", "storage", "bigquery", "vertex"], s)
    ])
    error_message = "enabled_services entries must be one of: dialogflow, ces, logging, storage, bigquery, vertex."
  }
}

# Values you paste back into Bluejay after apply. All three are non secret
# metadata: a resource path, an email, and a number. Never a key.

output "workload_identity_provider" {
  description = "Resource path of the OIDC provider (projects/<number>/locations/global/workloadIdentityPools/bluejay/providers/bluejay). Paste it into Bluejay as is."
  value       = local.provider_path
}

output "service_account_email" {
  description = "Email of the service account Bluejay impersonates."
  value       = google_service_account.bluejay_integration.email
}

output "project_number" {
  description = "Numeric project number, echoed back for Bluejay's records."
  value       = var.project_number
}