☁️ Google Cloud Document AI Processor Terraform Module

Provisions a single Document AI processor (google_document_ai_processor) — the OCR/form/ invoice/specialized document-extraction unit — targeting hashicorp/google ~> 7.0 on Terraform >= 1.12.0.

🧩 Overview

📄 Manages one Document AI processor — the GCP console/product name for google_document_ai_processor — the unit that runs a specific document-understanding task (OCR, form parsing, invoice extraction, and others).
🔐 Supports CMEK (kms_key_name), never defaulted to a specific key.
🧯 deletion_policy defaults to "PREVENT" — a house extension over the provider's own default; this resource has no separate deletion_protection boolean.
🧬 First module in our Document AI domain slice — pairs with terraform-google-document-ai-processor-default-version to pin a serving version.

💡 Why it matters: Document AI processors commonly ingest loan applications, tax forms, and other member financial documents. This module guards against an accidental destroy by default and keeps CMEK an explicit, never-defaulted opt-in.

❤️ Support this project

If these Terraform modules have been helpful to you or your organization, I'd appreciate your support in any of the following ways:

⭐ Star this repository to help others discover this Terraform module.
🤝 Connect with me on LinkedIn: linkedin.com/in/microsoftexpert
☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

Whether it's a star, a professional connection, or a coffee, every gesture helps keep these modules actively maintained and continually improving. Thank you for being part of the community!

🗺️ Where this fits

flowchart LR
 KMS["terraform-google-kms-keyring\n(google_kms_crypto_key)"]:::neutral
 PROC["terraform-google-document-ai-processor\n(google_document_ai_processor)"]:::this
 VER["terraform-google-document-ai-processor-default-version\n(google_document_ai_processor_default_version)"]:::keystone

 KMS -->|"crypto key name to kms_key_name (optional CMEK)"| PROC
 PROC -->|"id to processor (required)"| VER

 classDef this fill:#4285F4,color:#ffffff,stroke:#333333
 classDef keystone fill:#174EA6,color:#ffffff,stroke:#333333
 classDef neutral fill:#E8EAED,color:#202124,stroke:#999999

Validated via the Mermaid Chart MCP before embedding.

🧬 What this builds

flowchart LR
 subgraph Inputs["Inputs"]
 I1["display_name,\nlocation, type"]
 I2["kms_key_name,\ndeletion_policy, timeouts"]
 end

 THIS["google_document_ai_processor.this"]:::this

 subgraph Outputs["Outputs"]
 O1["id"]
 O2["name"]
 end

 I1 --> THIS
 I2 --> THIS
 THIS --> O1
 THIS --> O2

 classDef this fill:#4285F4,color:#ffffff,stroke:#333333

Resource inventory: one keystone resource, google_document_ai_processor.this. No for_each-managed children — this is a standalone module (see SCOPE.md).

✅ Provider / Versions


Terraform	`>= 1.12.0`
`hashicorp/google`	`~> 7.0`
Provider block	None — the caller configures `google` (ADC, WIF, or a service account key per our authentication model)

Schema notes that bite:

No labels attribute — confirmed absent from the schema.
No self_link — id and the computed name are this resource's only identity forms.
type is not validated against a hardcoded enum — the schema defers to the API's own FetchProcessorTypes call for the current list.
Only create/delete timeouts exist — no update timeout.
location/display_name are effectively force-new — there is no rename/re-region API for an existing processor.

🔑 Required IAM Roles

roles/documentai.editor (or roles/documentai.admin) on the target project.

☁️ GCP Prerequisites

documentai.googleapis.com enabled.
If kms_key_name is set: the KMS key must already exist, and the Document AI service agent needs roles/cloudkms.cryptoKeyEncrypterDecrypter on it.

📁 Module Structure

terraform-google-document-ai-processor/
├── providers.tf # required_providers + required_version — no provider {} block
├── variables.tf # google_document_ai_processor.this schema
├── main.tf # google_document_ai_processor.this — the sole keystone resource
├── outputs.tf # id, name — no self_link (none exists)
├── README.md # this file
├── SCOPE.md # lightweight standalone scope
└── examples/
 └── basic/ # smallest real call

⚙️ Quick Start

module "processor" {
  source = "git::https://github.com/microsoftexpert/terraform-google-document-ai-processor.git?ref=v1.0.0"

  display_name = "loan-application-ocr"
  location     = "us"
  type         = "OCR_PROCESSOR"
}

🔌 Cross-Module Contract

Consumes

Input	Type	Source module
`kms_key_name`	`string`, optional	`terraform-google-kms-keyring`

Emits

Output	Description
`id`	Terraform-internal id
`name`	Computed resource name

📚 Example Library

1 · Minimal OCR processor

module "ocr" {
  source = "git::https://github.com/microsoftexpert/terraform-google-document-ai-processor.git?ref=v1.0.0"

  display_name = "generic-ocr"
  location     = "us"
  type         = "OCR_PROCESSOR"
}

2 · Form parser processor

module "form_parser" {
  source = "git::https://github.com/microsoftexpert/terraform-google-document-ai-processor.git?ref=v1.0.0"

  display_name = "loan-form-parser"
  location     = "us"
  type         = "FORM_PARSER_PROCESSOR"
}

3 · Invoice processor in the EU location

module "invoice_eu" {
  source = "git::https://github.com/microsoftexpert/terraform-google-document-ai-processor.git?ref=v1.0.0"

  display_name = "eu-invoice-processor"
  location     = "eu"
  type         = "INVOICE_PROCESSOR"
}

ℹ️ location is deliberately not validated against a hardcoded allow-list — Document AI processing regions evolve independently of this module.

4 · CMEK via kms_key_name

module "cmek_processor" {
  source = "git::https://github.com/microsoftexpert/terraform-google-document-ai-processor.git?ref=v1.0.0"

  display_name = "cmek-ocr"
  location     = "us"
  type         = "OCR_PROCESSOR"
  kms_key_name = module.kms.crypto_key_ids["docai-cmek-key"]
}

🔒 Never default kms_key_name to a specific key — the caller always supplies it explicitly.

5 · Relaxed deletion_policy for a scratch/dev processor

module "dev_processor" {
  source = "git::https://github.com/microsoftexpert/terraform-google-document-ai-processor.git?ref=v1.0.0"

  display_name    = "dev-scratch-ocr"
  location        = "us"
  type            = "OCR_PROCESSOR"
  deletion_policy = "DELETE"
}

⚠️ deletion_policy = "DELETE" removes this module's "PREVENT" guard — use only for genuinely disposable dev/test processors.

6 · Custom timeouts

module "slow_processor" {
  source = "git::https://github.com/microsoftexpert/terraform-google-document-ai-processor.git?ref=v1.0.0"

  display_name = "large-batch-ocr"
  location     = "us"
  type         = "OCR_PROCESSOR"

  timeouts = {
    create = "20m"
    delete = "20m"
  }
}

7 · Bank-statement parser

module "bank_statement" {
  source = "git::https://github.com/microsoftexpert/terraform-google-document-ai-processor.git?ref=v1.0.0"

  display_name = "bank-statement-parser"
  location     = "us"
  type         = "BANK_STATEMENT_PROCESSOR"
}

8 · ID document (identity verification) processor

module "id_proofing" {
  source = "git::https://github.com/microsoftexpert/terraform-google-document-ai-processor.git?ref=v1.0.0"

  display_name = "member-id-verification"
  location     = "us"
  type         = "ID_PROOFING_PROCESSOR"
}

9 · Contract/agreement parser

module "contract_parser" {
  source = "git::https://github.com/microsoftexpert/terraform-google-document-ai-processor.git?ref=v1.0.0"

  display_name = "loan-agreement-parser"
  location     = "us"
  type         = "CONTRACT_PARSER_PROCESSOR"
}

10 · Custom document extractor

module "custom_extractor" {
  source = "git::https://github.com/microsoftexpert/terraform-google-document-ai-processor.git?ref=v1.0.0"

  display_name = "custom-casey-extractor"
  location     = "us"
  type         = "CUSTOM_EXTRACTION_PROCESSOR"
}

11 · Multiple processors via for_each in the caller's own root module

locals {
  processors = {
    ocr            = "OCR_PROCESSOR"
    form_parser    = "FORM_PARSER_PROCESSOR"
    bank_statement = "BANK_STATEMENT_PROCESSOR"
  }
}

module "processors" {
  source   = "git::https://github.com/microsoftexpert/terraform-google-document-ai-processor.git?ref=v1.0.0"
  for_each = local.processors

  display_name = "casey-${each.key}"
  location     = "us"
  type         = each.value
}

ℹ️ This module has no natural child collection, so multi-processor fan-out is a caller-side for_each over the module block itself, not a composite module.

12 · 🏗️ End-to-end composition

module "kms" {
  source = "git::https://github.com/microsoftexpert/terraform-google-kms-keyring.git?ref=v1.0.0"

  key_ring_name = "docai-keyring"
  location      = "us"

  crypto_keys = {
    "docai-cmek-key" = {}
  }
}

module "processor" {
  source = "git::https://github.com/microsoftexpert/terraform-google-document-ai-processor.git?ref=v1.0.0"

  display_name = "loan-application-ocr"
  location     = "us"
  type         = "OCR_PROCESSOR"
  kms_key_name = module.kms.crypto_key_ids["docai-cmek-key"]
}

module "processor_default_version" {
  source = "git::https://github.com/microsoftexpert/terraform-google-document-ai-processor-default-version.git?ref=v1.0.0"

  processor = module.processor.id
  version   = "${module.processor.id}/processorVersions/stable"
}

output "processor_id" {
  value = module.processor.id
}

💡 Wires terraform-google-kms-keyring's crypto_key_ids map into kms_key_name, and this module's own id into the sibling terraform-google-document-ai-processor-default-version module's processor input.

📥 Inputs

Required: display_name, location, type.

Grouped summary: identity (display_name, location, type), security (kms_key_name), operations (deletion_policy, timeouts — no labels on this resource).

Full object schemas

variable "display_name" {
  type = string
}

variable "location" {
  type = string
}

variable "type" {
  type = string
}

variable "kms_key_name" {
  type    = string
  default = null
}

variable "deletion_policy" {
  type    = string
  default = "PREVENT" # "DELETE" | "ABANDON" | "PREVENT"
}

variable "timeouts" {
  type = object({
    create = optional(string)
    delete = optional(string)
  })
  default = null
}

🧾 Outputs

Output	Description	Notes
`id`	Terraform-internal id	No `self_link` exists
`name`	Computed resource name	e.g. `projects/{project}/locations/{location}/processors/{processor}`

🧠 Architecture Notes

No labels, no self_link. Both confirmed absent from this resource's schema.
location/display_name/type are effectively force-new. No rename/re-region/re-type API exists for an existing processor.
deletion_policy default is a house extension. "PREVENT" is not the provider's own default; this resource has no separate deletion_protection boolean, so this is the sole guard.
type has no hardcoded enum. An invalid value is rejected by the API at apply, not caught at plan.

🧱 Design Principles

Concern	Secure default	Opt-out (explicit)
CMEK	`kms_key_name` accepted, never defaulted to a specific key	Caller supplies a key from `terraform-google-kms-keyring`
Deletion guard	`deletion_policy = "PREVENT"` (house extension)	Caller sets `"DELETE"` or `"ABANDON"` explicitly

🚀 Runbook

cd terraform-google-document-ai-processor
terraform init -backend=false
terraform validate
terraform fmt -check

Pin ?ref=v1.0.0 — never a branch. This library is plan-only; a human applies from CI with valid ADC/WIF credentials.

🧪 Testing

terraform validate/fmt -check confirm internal type/reference consistency and formatting only — they cannot catch GCP API-level rejections (an invalid type value, quota, or org policy). A real terraform plan/apply against a live project is the only way to confirm this module's behavior end-to-end.

💬 Example Output

$ terraform output

id = "projects/casey-prod/locations/us/processors/abcdef0123456789"
name = "projects/casey-prod/locations/us/processors/abcdef0123456789"

🔍 Troubleshooting

Symptom	Cause	Fix
`destroy` fails with a deletion-policy error	`deletion_policy = "PREVENT"` (this module's default)	Apply once with `deletion_policy = "DELETE"` or `"ABANDON"`, then run the destroy
`apply` fails with an invalid processor type	`type` is not validated against a hardcoded enum in this module	Confirm the exact type string against the current `FetchProcessorTypes` API list before applying
CMEK apply fails with a permission error	Document AI service agent lacks `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the key	Grant the role and allow ~60 seconds for IAM propagation before retrying

🔗 Related Docs

google_document_ai_processor — Terraform Registry
Document AI — Google Cloud documentation
terraform-google-document-ai-processor-default-version (pins a serving version on this processor)
terraform-google-kms-keyring (crypto key source for CMEK)
This module's SCOPE.md

Navigation Menu

Repository files navigation

☁️ Google Cloud Document AI Processor Terraform Module

🧩 Overview

❤️ Support this project

🗺️ Where this fits

🧬 What this builds

✅ Provider / Versions

🔑 Required IAM Roles

☁️ GCP Prerequisites

📁 Module Structure

⚙️ Quick Start

🔌 Cross-Module Contract

📚 Example Library

📥 Inputs

🧾 Outputs

🧠 Architecture Notes

🧱 Design Principles

🚀 Runbook

🧪 Testing

💬 Example Output

🔍 Troubleshooting

🔗 Related Docs

About

Releases

Packages

Contributors

Languages

Name		Name	Last commit message	Last commit date
examples/basic		examples/basic
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md
SCOPE.md		SCOPE.md
main.tf		main.tf
outputs.tf		outputs.tf
providers.tf		providers.tf
variables.tf		variables.tf

Latest commit

History

Folders and files

Repository files navigation

☁️ Google Cloud Document AI Processor Terraform Module

🧩 Overview

❤️ Support this project

🗺️ Where this fits

🧬 What this builds

✅ Provider / Versions

🔑 Required IAM Roles

☁️ GCP Prerequisites

📁 Module Structure

⚙️ Quick Start

🔌 Cross-Module Contract

📚 Example Library

📥 Inputs

🧾 Outputs

🧠 Architecture Notes

🧱 Design Principles

🚀 Runbook

🧪 Testing

💬 Example Output

🔍 Troubleshooting

🔗 Related Docs

About

Topics

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages