# --------------------------------------------------------- 1. Basic information about the template ---------------------------------------------------------
terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "7.45.0"
    }
  }
}

provider "google" {
  region = var.Region
}

# --------------------------------------------------------- 2. RegionMap ---------------------------------------------------------
locals {
  RegionMap = {
    "us-west1" = {
      RegionName      = "us-west1"
      EndpointService = "projects/nifty-jet-418508/regions/us-west1/serviceAttachments/selectdb-byoc-us-west1-endpointservice-https"
      Bucket          = "selectdb-cloud-online-us-west-1"
      SampleBucket    = "selectdb-online-import-data-us-west1"
    }
    "us-east4" = {
      RegionName      = "us-east4"
      EndpointService = "projects/nifty-jet-418508/regions/us-east4/serviceAttachments/pls-rv23q67r-https"
      Bucket          = "selectdb-cloud-online-us-east-4"
      SampleBucket    = "selectdb-online-import-data-us-east-4"
    }
    "asia-southeast1" = {
      RegionName      = "asia-southeast1"
      EndpointService = "projects/nifty-jet-418508/regions/asia-southeast1/serviceAttachments/pls-pek0hd99-https"
      Bucket          = "velodb-cloud-online-asia-southeast1"
      SampleBucket    = "velodb-online-import-asia-southeast1"
    }
    "us-central1" = {
      RegionName      = "us-central1"
      EndpointService = "projects/nifty-jet-418508/regions/us-central1/serviceAttachments/pls-q3u07fp7-https"
      Bucket          = "velodb-cloud-online-us-central1"
      SampleBucket    = "velodb-online-import-data-us-central1"
    }
    "europe-west3" = {
      RegionName      = "europe-west3"
      EndpointService = "projects/nifty-jet-418508/regions/europe-west3/serviceAttachments/pls-44u4qo0z-https"
      Bucket          = "velodb-cloud-online-europe-west3"
      SampleBucket    = "velodb-online-import-data-europe-west3"
    }
    "us-west4" = {
      RegionName      = "us-west4"
      EndpointService = "projects/nifty-jet-418508/regions/us-west4/serviceAttachments/pls-g4sibc2l-https"
      Bucket          = "velodb-cloud-online-us-west4"
      SampleBucket    = "velodb-online-import-data-us-west4"
    }
    "asia-east2" = {
      RegionName      = "asia-east2"
      EndpointService = "projects/nifty-jet-418508/regions/asia-east2/serviceAttachments/pls-s0n6s96z-https"
      Bucket          = "velodb-cloud-online-asia-east2"
      SampleBucket    = "velodb-online-import-data-asia-east2"
    }
  }
}

# --------------------------------------------------------- 3. Parameter ---------------------------------------------------------
# 3.0 Deploy region
variable "Region" {
  type        = string
  description = "The region where the BYOC warehouse is deployed"
  nullable    = false
}

# 3.1 A token generated by Manage that identifies a unique user VPC
variable "Token" {
  type        = string
  description = "The token generated by VeloDB Cloud uniquely identifies the your VPC. Please do not modify it."
  nullable    = false
}

# 3.2 The VPC name selected by the user
variable "VPC" {
  type        = string
  description = "Please enter the VPC name where you want to deploy the BYOC warehouse in this region."
  nullable    = false
}

# 3.3 The VPC ID selected by the user
variable "VPCID" {
  type     = string
  nullable = false
}

# 3.4 The Subnet name selected by the user
variable "Subnet" {
  type        = string
  description = "Please enter the Subnet name where you want to deploy the BYOC warehouse. Currently, you can create in all available zones within this region."
  nullable    = false
}

# 3.5 The Az ID selected by the user
variable "Zone" {
  type        = string
  description = "Please enter the Availability Zone ID where you want to deploy the BYOC warehouse. This is an optional parameter. If not provided, the default value will be used."
  nullable    = false
}

# 3.6 The zone IDs used for multi-az warehouse placement
variable "MultiZones" {
  type        = list(string)
  description = "The availability zone IDs used for multi-az warehouse placement."
  nullable    = false
}

# 3.7 The directory name
variable "Directory" {
  type        = string
  description = "The directory name generated by shell script."
  nullable    = false
}

# 3.8 The selected instance type
variable "InstanceType" {
  type        = string
  description = "The instance type of agent."
  nullable    = false
}

# Do some preprocessing on the input variables
locals {
  VPC         = trimspace(var.VPC)
  VPCID       = trimspace(var.VPCID)
  SUBNET      = trimspace(var.Subnet)
  ZONE        = trimspace(var.Zone)
  MULTI_ZONES = [for zone in var.MultiZones : trimspace(zone) if trimspace(zone) != ""]
}

# --------------------------------------------------------- 4. Resource ---------------------------------------------------------
# Get the project ID
data "google_project" "VeloDBProject" {
}

# Get subnet info
data "google_compute_subnetwork" "VeloDBSubnet" {
  name   = local.SUBNET
  region = var.Region
}

resource "random_id" "rand" {
  byte_length = 4
}

locals {
# Use the first 12 characters of the MD5 hash of the VPC ID as the suffix.
  suffix = lower(substr(md5(local.VPCID), 0, 12))
  # Replace the horizontal line with the down line
  suffix_v2 = replace("${local.suffix}_${random_id.rand.hex}", "-", "_")

  # Get the project name
  project = split("/", data.google_project.VeloDBProject.id)[1]
}

# ---------------------------------------- 4.1 Create two firewall and set outbound inbound rules ----------------------------------------
# Allow traffic from the same network tag to access all ports each other
resource "google_compute_firewall" "VeloDBSecurityGroupIngressSelf" {
  project     = data.google_project.VeloDBProject.project_id
  name        = "velodb-sg-ingress-self-${local.suffix}"
  network     = local.VPC
  direction   = "INGRESS"
  description = "Allow traffic from the same network tag to access all ports each other"
  # All velodb machines will set this network flag so that they will apply this rule
  target_tags   = ["velodb-sg-ingress-${local.suffix}"]
  source_tags   = ["velodb-sg-ingress-${local.suffix}"]
  source_ranges = ["209.85.152.0/22", "209.85.204.0/22", "35.191.0.0/16", "130.211.0.0/22"]
  allow {
    protocol = "tcp"
    ports    = ["1-65535"]
  }
}

# Allow traffic from the same subnet to access specified ports
resource "google_compute_firewall" "VeloDBSecurityGroupIngress" {
  project     = data.google_project.VeloDBProject.project_id
  name        = "velodb-sg-ingress-${local.suffix}"
  network     = local.VPC
  direction   = "INGRESS"
  description = "Allow traffic from the same subnet to access specified ports"
  # All velodb machines will set this network flag so that they will apply this rule
  target_tags   = ["velodb-sg-ingress-${local.suffix}"]
  source_ranges = [data.google_compute_subnetwork.VeloDBSubnet.ip_cidr_range]
  allow {
    protocol = "tcp"
    ports    = ["8000-10000","443"]
  }
}

# Allow traffic to all addresses
resource "google_compute_firewall" "VeloDBSecurityGroupEgress" {
  project     = data.google_project.VeloDBProject.project_id
  name        = "velodb-sg-egress-${local.suffix}"
  network     = local.VPC
  direction   = "EGRESS"
  description = "Allow traffic to all addresses"
  target_tags = ["velodb-sg-egress-${local.suffix}"]
  allow {
    protocol = "tcp"
    ports    = ["1-65535"]
  }
}

# ---------------------------------------- 4.2 Create a vpc endpoint to connect to the control plane ----------------------------------------
# Reserved ip address
resource "google_compute_address" "VeloDBEndpointIP" {
  name         = "velodb-endpoint-ip-${local.suffix}"
  subnetwork   = local.SUBNET
  address_type = "INTERNAL"
  description  = "This ip address is used by the vpc endpoint."
  labels = {
    "resource-created-by"    = "velodb"
    "cloud-resource-profile" = "online"
    "resource-used-by-app"   = "byoc"
  }
}

# Create a vpc endpoint
resource "google_compute_forwarding_rule" "VeloDBEndpoint" {
  name                    = "velodb-endpoint-${local.suffix}"
  region                  = var.Region
  load_balancing_scheme   = ""
  description             = "This vpc endpoint is used to establish privatelink with the endpoint-service provided by control plane."
  target                  = local.RegionMap[var.Region].EndpointService
  network                 = local.VPC
  ip_address              = google_compute_address.VeloDBEndpointIP.id
  allow_psc_global_access = true
}

# ---------------------------------------- 4.3 Create a bucket ----------------------------------------
resource "google_storage_bucket" "VeloDBBucket" {
  project                     = data.google_project.VeloDBProject.project_id
  name                        = "velodb-bucket-${local.suffix}"
  location                    = upper(var.Region)
  force_destroy               = true
  uniform_bucket_level_access = true
  labels = {
    "resource-created-by"    = "velodb"
    "cloud-resource-profile" = "online"
    "resource-used-by-app"   = "byoc"
  }
}

# ---------------------------------------- 4.4 Create two service account, one for control plane and one for data access ----------------------------------------
# 4.4.1 Create a service account for control plane
resource "google_service_account" "VeloDBControlPlaneRole" {
  project                      = data.google_project.VeloDBProject.project_id
  account_id                   = "velodb-cp-role-${local.suffix}"
  display_name                 = "velodb-control-plane-role-${local.suffix}"
  description                  = "This service account is used to bind to the Agent machine so that the Agent can use this identity to perform subsequent operations to manage."
  create_ignore_already_exists = true
}

# Add a short delay to ensure the control plane SA is fully available
resource "null_resource" "wait_for_control_plane_sa" {
  depends_on = [
    google_service_account.VeloDBControlPlaneRole
  ]

  provisioner "local-exec" {
    command = "sleep 60"  # 延时 60 秒
  }
}

# Create a custom role for control plane
resource "google_project_iam_custom_role" "VeloDBControlPlaneRolePolicy" {
  project     = data.google_project.VeloDBProject.project_id
  role_id     = "velodb_compute_role_${local.suffix_v2}"
  title       = "velodb-compute-role-${local.suffix}"
  stage       = "GA"
  description = "The agent instance will play this role and can perform related management and control operations."
  permissions = [
    "compute.addresses.create",
    "compute.addresses.createInternal",
    "compute.addresses.delete",
    "compute.addresses.deleteInternal",
    "compute.addresses.setLabels",
    "compute.addresses.get",
    "compute.addresses.list",
    "compute.addresses.use",
    "compute.addresses.useInternal",
    "compute.disks.create",
    "compute.disks.createTagBinding",
    "compute.disks.delete",
    "compute.disks.deleteTagBinding",
    "compute.disks.get",
    "compute.disks.list",
    "compute.disks.resize",
    "compute.disks.setLabels",
    "compute.disks.use",
    "compute.firewalls.create",
    "compute.firewalls.createTagBinding",
    "compute.firewalls.delete",
    "compute.firewalls.deleteTagBinding",
    "compute.firewalls.get",
    "compute.firewalls.list",
    "compute.firewalls.update",
    "compute.forwardingRules.create",
    "compute.forwardingRules.delete",
    "compute.forwardingRules.update",
    "compute.forwardingRules.get",
    "compute.forwardingRules.setLabels",
    "compute.instanceGroups.create",
    "compute.instanceGroups.delete",
    "compute.instanceGroups.get",
    "compute.instanceGroups.update",
    "compute.instanceGroups.use",
    "compute.instances.attachDisk",
    "compute.instances.create",
    "compute.instances.createTagBinding",
    "compute.instances.delete",
    "compute.instances.deleteTagBinding",
    "compute.instances.detachDisk",
    "compute.instances.get",
    "compute.instances.getEffectiveFirewalls",
    "compute.instances.list",
    "compute.instances.listTagBindings",
    "compute.instances.osAdminLogin",
    "compute.instances.osLogin",
    "compute.instances.reset",
    "compute.instances.resume",
    "compute.instances.setDiskAutoDelete",
    "compute.instances.setLabels",
    "compute.instances.setMachineType",
    "compute.instances.setMetadata",
    "compute.instances.setName",
    "compute.instances.setServiceAccount",
    "compute.instances.setTags",
    "compute.instances.start",
    "compute.instances.stop",
    "compute.instances.suspend",
    "compute.instances.update",
    "compute.instances.use",
    "compute.networks.get",
    "compute.networks.list",
    "compute.networks.updatePolicy",
    "compute.networks.use",
    "compute.regions.get",
    "compute.regionBackendServices.create",
    "compute.regionBackendServices.createTagBinding",
    "compute.regionBackendServices.delete",
    "compute.regionBackendServices.deleteTagBinding",
    "compute.regionBackendServices.get",
    "compute.regionBackendServices.getIamPolicy",
    "compute.regionBackendServices.list",
    "compute.regionBackendServices.update",
    "compute.regionBackendServices.use",
    "compute.regionHealthChecks.create",
    "compute.regionHealthChecks.delete",
    "compute.regionHealthChecks.useReadOnly",
    "compute.subnetworks.get",
    "compute.subnetworks.list",
    "compute.subnetworks.use",
    "compute.zoneOperations.get",
    "compute.zones.get",
    "compute.zones.list"
  ]
}

# Bind the Custom Role to the control plane service account
resource "google_project_iam_member" "VeloDBControlPlaneCustomRoleIamBinding" {
  depends_on = [
    google_service_account.VeloDBControlPlaneRole,
    google_project_iam_custom_role.VeloDBControlPlaneRolePolicy,
    null_resource.wait_for_control_plane_sa
  ]
  project = data.google_project.VeloDBProject.project_id
  member  = google_service_account.VeloDBControlPlaneRole.member
  role    = google_project_iam_custom_role.VeloDBControlPlaneRolePolicy.id
}

# Bind the Bucket Owner Role to the control plane service account
resource "google_storage_bucket_iam_member" "VeloDBControlPlaneBucketOwnerRoleIamBinding" {
  depends_on = [
    google_storage_bucket.VeloDBBucket,
    google_service_account.VeloDBControlPlaneRole,
    null_resource.wait_for_control_plane_sa
  ]
  bucket = google_storage_bucket.VeloDBBucket.id
  member = google_service_account.VeloDBControlPlaneRole.member
  // todo modify to only lifecycle permissions
  role = "roles/storage.admin"
  condition {
    expression  = "resource.name.startsWith('projects/_/buckets/${google_storage_bucket.VeloDBBucket.name}')"
    title       = "Bucket Policy"
    description = "Permission related to a Bucket, and the resource is restricted to the Bucket that is currently created."
  }
}

# Bind the IAM ServiceAccountUser Role to the control plane service account
resource "google_project_iam_member" "VeloDBControlPlaneServiceAccountUserRoleIamBinding" {
  depends_on = [
    google_service_account.VeloDBControlPlaneRole,
    null_resource.wait_for_control_plane_sa
  ]
  project = data.google_project.VeloDBProject.project_id
  member  = google_service_account.VeloDBControlPlaneRole.member
  role    = "roles/iam.serviceAccountUser"
}

# Create a Key for an associated service account for a Bucket Storage
resource "google_storage_hmac_key" "VeloDBControlPlaneRoleBucketKey" {
  depends_on = [
    google_service_account.VeloDBControlPlaneRole,
    google_storage_bucket_iam_member.VeloDBControlPlaneBucketOwnerRoleIamBinding
  ]
  service_account_email = google_service_account.VeloDBControlPlaneRole.email
}

# 4.4.2 Create a service account for data access
resource "google_service_account" "VeloDBDataAccessRole" {
  project                      = data.google_project.VeloDBProject.project_id
  account_id                   = "velodb-da-role-${local.suffix}"
  display_name                 = "velodb-data-access-role-${local.suffix}"
  description                  = "This service account is used to bind to the MS/FE/BE machine so that the VeloDB can use this identity to perform all operations to the bucket and data."
  create_ignore_already_exists = true
}

# Add a short delay to ensure the SA is fully available
resource "null_resource" "wait_for_data_access_sa" {
  depends_on = [
    google_service_account.VeloDBDataAccessRole
  ]

  provisioner "local-exec" {
    command = "sleep 60"  # 延时 60 秒
  }
}

# Bind the Bucket Owner Role to the data access service account
resource "google_storage_bucket_iam_member" "VeloDBDataAccessBucketOwnerRoleIamBinding" {
  depends_on = [
    google_storage_bucket.VeloDBBucket,
    google_service_account.VeloDBDataAccessRole,
    null_resource.wait_for_data_access_sa
  ]
  bucket = google_storage_bucket.VeloDBBucket.id
  role   = "roles/storage.admin"
  member = google_service_account.VeloDBDataAccessRole.member
  condition {
    expression  = "resource.name.startsWith('projects/_/buckets/${google_storage_bucket.VeloDBBucket.name}')"
    title       = "Bucket Policy"
    description = "Permission related to a Bucket, and the resource is restricted to the Bucket that is currently created."
  }
}

# Bind the IAM ServiceAccountUser Role to the data access service account
resource "google_project_iam_member" "VeloDBDataAccessServiceAccountUserRoleIamBinding" {
  depends_on = [
    google_service_account.VeloDBDataAccessRole,
    null_resource.wait_for_data_access_sa
  ]
  project = data.google_project.VeloDBProject.project_id
  member  = google_service_account.VeloDBDataAccessRole.member
  role    = "roles/iam.serviceAccountUser"
}

# Create a Key for an associated service account for a Bucket Storage
resource "google_storage_hmac_key" "VeloDBDateAccessRoleBucketKey" {
  depends_on = [
    google_service_account.VeloDBDataAccessRole,
    google_storage_bucket_iam_member.VeloDBDataAccessBucketOwnerRoleIamBinding
  ]
  service_account_email = google_service_account.VeloDBDataAccessRole.email
}

# ---------------------------------------- 4.5 Create a compute instance and deploy agent ----------------------------------------
locals {
  ENDPOINT_DNS                  = google_compute_address.VeloDBEndpointIP.address
  ENDPOINT_URL                  = join("", ["http://", google_compute_address.VeloDBEndpointIP.address])
  IMAGE_ENDPOINT_URL            = join("", ["https://storage.googleapis.com/", local.RegionMap[var.Region].Bucket])
  PROM_AGENT_WRITE              = join("", ["http://", google_compute_address.VeloDBEndpointIP.address, ":9090/api/v1/write"])
  MULTI_ZONE_CONFIGS            = join(";", [for zone in local.MULTI_ZONES : "${zone}:${local.SUBNET}"])
  PRIVATE_IP_GOOGLE_ACCESS_FLAG = data.google_compute_subnetwork.VeloDBSubnet.private_ip_google_access
}

# The private_ip_google_access attribute of the Subnet needs to be opened
resource "null_resource" "VeloDBEnablePGA" {
  triggers = {
    subnet_id = local.SUBNET
  }

  provisioner "local-exec" {
    command = <<EOF
        if [ "${local.PRIVATE_IP_GOOGLE_ACCESS_FLAG}" = "false" ]; then
          gcloud compute networks subnets update ${data.google_compute_subnetwork.VeloDBSubnet.name} \
            --region=${data.google_compute_subnetwork.VeloDBSubnet.region} \
            --enable-private-ip-google-access
        fi
    EOF
  }
}

# Create a compute instance
resource "google_compute_instance" "VeloDBAgent" {
  name         = "velodb-agent-${local.suffix}"
  zone         = local.ZONE
  machine_type = var.InstanceType
  tags = [
    google_compute_firewall.VeloDBSecurityGroupIngress.name,
    google_compute_firewall.VeloDBSecurityGroupEgress.name
  ]

  network_interface {
    network    = local.VPC
    subnetwork = local.SUBNET
  }

  boot_disk {
    auto_delete = true
    mode        = "READ_WRITE"
    initialize_params {
      image = "projects/norse-glow-418508/global/images/base-image-20241012001"
      labels = {
        "resource-created-by"    = "velodb"
        "cloud-resource-profile" = "online"
        "resource-used-by-app"   = "byoc"
      }
    }
  }

  allow_stopping_for_update = true
  desired_status            = "RUNNING"
  description               = "This compute instance is used to run the agent."
  deletion_protection       = false

  service_account {
    # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
    email  = google_service_account.VeloDBControlPlaneRole.email
    scopes = ["cloud-platform"]
  }

  labels = {
    "resource-created-by"    = "velodb"
    "cloud-resource-profile" = "online"
    "resource-used-by-app"   = "byoc"
  }

  metadata = {
    startup-script = <<-EOF
              #!/bin/bash -xe
              # check
              echo "Start of User Data Script" date '+%Y-%m-%d %H:%M:%S' echo "My first GCP Instance" echo "End of User Data Script" date '+%Y-%m-%d %H:%M:%S'

              # add linux user
              useradd -m -s /bin/bash velodb
              mkdir -p /home/velodb/.ssh
              chown velodb:velodb /home/velodb/.ssh
              chmod 700 /home/velodb/.ssh

              touch /home/velodb/.ssh/authorized_keys
              chown velodb:velodb /home/velodb/.ssh/authorized_keys
              chmod 600 /home/velodb/.ssh/authorized_keys

              # create sudoers for velodb
              echo "velodb ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/velodb

              # env
              export VPC_ID=${local.VPCID}
              export SUBNET_ID=${local.SUBNET}
              export BUCKET_ID=${google_storage_bucket.VeloDBBucket.id}
              export USER_AK=${google_storage_hmac_key.VeloDBControlPlaneRoleBucketKey.access_id}
              export USER_SK=${google_storage_hmac_key.VeloDBControlPlaneRoleBucketKey.secret}
              export BYOC_TOKEN=${var.Token}
              export ENDPOINT_DNS=${local.ENDPOINT_DNS}
              export ENDPOINT_URL=${local.ENDPOINT_URL}
              export IMAGE_ENDPOINT_URL=${local.IMAGE_ENDPOINT_URL}
              export ROLE_NAME=${google_service_account.VeloDBDataAccessRole.email}
              export PROVIDER='gcp'
              export REGION=${var.Region}
              export SAMPLE_BUCKET=${local.RegionMap[var.Region].SampleBucket}
              export PROJECT=${local.project}
              export ZONE=${local.ZONE}
              export MULTI_ZONE_CONFIGS='${local.MULTI_ZONE_CONFIGS}'
              export STACK_ID=${var.Directory}
              export STACK_NAME=${var.Directory}
              export SG_ID=${join(",", [
                google_compute_firewall.VeloDBSecurityGroupIngress.name,
                google_compute_firewall.VeloDBSecurityGroupEgress.name
              ])}
              export LOGICAL_ENDPOINT="apps-api.$REGION.$PROVIDER.velodb.cloud"

              # install
              AGENT_DOWNLOAD='https://storage.googleapis.com/${local.RegionMap[var.Region].Bucket}/selectdb/packages/agent.tar.gz'
              wget -O configure_agent_byoc.sh https://storage.googleapis.com/${local.RegionMap[var.Region].Bucket}/selectdb/packages/configure_agent_byoc_velodb.sh
              chmod +x ./configure_agent_byoc.sh
              ./configure_agent_byoc.sh $AGENT_DOWNLOAD $VPC_ID $SUBNET_ID $BUCKET_ID $USER_AK $USER_SK $BYOC_TOKEN $ENDPOINT_URL $IMAGE_ENDPOINT_URL "" $ROLE_NAME $PROVIDER $REGION $SAMPLE_BUCKET $PROJECT $ZONE $STACK_ID $STACK_NAME "" "" $SG_ID "" "" "" "" "online" "$MULTI_ZONE_CONFIGS"

              wget -O configure_byoc_modules.sh  https://storage.googleapis.com/${local.RegionMap[var.Region].Bucket}/selectdb/packages/configure_byoc_modules.sh
              chmod +x ./configure_byoc_modules.sh
              ./configure_byoc_modules.sh $IMAGE_ENDPOINT_URL $PROVIDER $REGION $VPC_ID $LOGICAL_ENDPOINT $BYOC_TOKEN

              # ssh
              sudo sed -i 's/PermitRootLogin no/PermitRootLogin prohibit-password/g' /etc/ssh/sshd_config
              sudo systemctl restart sshd

              EOF
  }
}

# --------------------------------------------------------- 5. Output ---------------------------------------------------------
# Control Plane Role ID
output "ControlPlaneRoleID" {
  value       = google_service_account.VeloDBControlPlaneRole.id
  description = "Control Plane Service Account ID"
}

# Data Access Role ID
output "DataAccessRoleID" {
  value       = google_service_account.VeloDBDataAccessRole.id
  description = "Data Access Service Account ID"
}

# Bucket ID
output "BucketID" {
  value       = google_storage_bucket.VeloDBBucket.id
  description = "Bucket ID"
}

# Bucket ARN
output "BucketARN" {
  value       = google_storage_bucket.VeloDBBucket.self_link
  description = "Bucket ARN"
}

# Bucket HMAC Key ID
output "AccessKeyId" {
  value       = google_storage_hmac_key.VeloDBControlPlaneRoleBucketKey.access_id
  description = "Bucket HMAC Key ID"
}

# Selected Instance Type
output "InstanceType" {
  value       = var.InstanceType
  description = "The instance type of agent"
}