[Feature]: Support Domain Restricted Sharing in terraform/litellm/gcp by disabling Cloud Run invoker IAM checks

[lorengordon]

Check for existing issues

• I have searched the existing issues and checked that my issue is not a duplicate.

The Feature

In terraform/litellm/gcp, support organizations that enforce Domain Restricted Sharing (DRS), where allUsers IAM bindings are rejected.

Today the module creates roles/run.invoker IAM members with member = "allUsers" for each Cloud Run service. In DRS-constrained orgs this fails policy checks and blocks deployment.

Requested change:

• Set invoker_iam_disabled = true on each google_cloud_run_v2_service resource in this module (gateway, backend, ui)
• Stop relying on allUsers run.invoker bindings for these services in DRS environments
• Document this behavior in module docs and any migration notes

User Flow

Before this feature (today): deployment fails in DRS-enforced orgs because the module applies allUsers invoker grants

1. Operator runs terraform apply for terraform/litellm/gcp
2. Cloud Run services are created
3. Module attempts to apply google_cloud_run_v2_service_iam_member resources with member = "allUsers"
4. Organization policy rejects the binding and apply fails

After this feature (ideal user flow): the same deployment succeeds without requiring allUsers invoker bindings

1. Operator runs terraform apply for terraform/litellm/gcp
2. Cloud Run services are created with invoker_iam_disabled = true
3. Module does not require allUsers run.invoker IAM members for service reachability
4. Apply succeeds in DRS-constrained orgs

How far you got

Config / setup the proxy ran with:

• Module path: terraform/litellm/gcp
• Cloud Run services in module: gateway, backend, ui

Version or commit:

• Current repository state at time of issue filing

Commands and their full output, up to the step that dead-ends:

# terraform apply in terraform/litellm/gcp (or example root)
# apply reaches Cloud Run IAM member creation for allUsers
# org policy rejects allUsers member in DRS-constrained orgs

│ Error: Error applying IAM policy for cloudrunv2 service "projects/<project>/locations/us-east5/services/litellm-prod-gateway": Error setting IAM policy for cloudrunv2 service "projects/<project>/locations/us-east5/services/litellm-prod-gateway": googleapi: Error 400: One or more users named in the policy do not belong to a permitted customer,  perhaps due to an organization policy.
│
│   with module.litellm.google_cloud_run_v2_service_iam_member.gateway_allusers,
│   on cloudrun.tf line 493, in resource "google_cloud_run_v2_service_iam_member" "gateway_allusers":
│  493: resource "google_cloud_run_v2_service_iam_member" "gateway_allusers" {
│

What stopped me there:

• DomainRestrictedSharing policy rejects allUsers IAM member bindings, causing module apply failure.

What part of LiteLLM is this about?

Proxy

LiteLLM is hiring a founding backend engineer, are you interested in joining us and shipping to all our users?

No

Twitter / LinkedIn details

N/A