agent-starter-pack 0.3.3__py3-none-any.whl → 0.21.0__py3-none-any.whl

{src → agent_starter_pack}/base_template/deployment/terraform/storage.tf

@@ -17,24 +17,15 @@ provider "google" {
   user_project_override = true
 }
 
-resource "google_storage_bucket" "bucket_load_test_results" {
-  name                        = "${var.cicd_runner_project_id}-${var.project_name}-load-test"
-  location                    = var.region
-  project                     = var.cicd_runner_project_id
-  uniform_bucket_level_access = true
-  force_destroy               = true
-  depends_on                  = [resource.google_project_service.cicd_services, resource.google_project_service.shared_services]
-}
-
 resource "google_storage_bucket" "logs_data_bucket" {
   for_each                    = toset(local.all_project_ids)
-  name                        = "${each.value}-${var.project_name}-logs-data"
+  name                        = "${each.value}-${var.project_name}-logs"
   location                    = var.region
   project                     = each.value
   uniform_bucket_level_access = true
   force_destroy               = true
 
-  depends_on = [resource.google_project_service.cicd_services, resource.google_project_service.shared_services]
+  depends_on = [resource.google_project_service.cicd_services, resource.google_project_service.deploy_project_services]
 }
 {% if cookiecutter.deployment_target == 'cloud_run' %}
 resource "google_artifact_registry_repository" "repo-artifacts-genai" {
@@ -43,7 +34,7 @@ resource "google_artifact_registry_repository" "repo-artifacts-genai" {
   description   = "Repo for Generative AI applications"
   format        = "DOCKER"
   project       = var.cicd_runner_project_id
-  depends_on    = [resource.google_project_service.cicd_services, resource.google_project_service.shared_services]
+  depends_on    = [resource.google_project_service.cicd_services, resource.google_project_service.deploy_project_services]
 }
 {% endif %}
 
@@ -56,7 +47,7 @@ resource "google_storage_bucket" "data_ingestion_pipeline_gcs_root" {
   uniform_bucket_level_access = true
   force_destroy               = true
 
-  depends_on = [resource.google_project_service.cicd_services, resource.google_project_service.shared_services]
+  depends_on = [resource.google_project_service.cicd_services, resource.google_project_service.deploy_project_services]
 }
 
 {% if cookiecutter.datastore_type == "vertex_ai_search" %}
@@ -71,7 +62,7 @@ resource "google_discovery_engine_data_store" "data_store_staging" {
   solution_types              = ["SOLUTION_TYPE_SEARCH"]
   create_advanced_site_search = false
   provider                    = google.staging_billing_override
-  depends_on         = [resource.google_project_service.cicd_services, resource.google_project_service.shared_services]
+  depends_on         = [resource.google_project_service.cicd_services, resource.google_project_service.deploy_project_services]
 }
 
 resource "google_discovery_engine_search_engine" "search_engine_staging" {
@@ -97,7 +88,7 @@ resource "google_discovery_engine_data_store" "data_store_prod" {
   solution_types              = ["SOLUTION_TYPE_SEARCH"]
   create_advanced_site_search = false
   provider                    = google.prod_billing_override
-  depends_on         = [resource.google_project_service.cicd_services, resource.google_project_service.shared_services]
+  depends_on         = [resource.google_project_service.cicd_services, resource.google_project_service.deploy_project_services]
 }
 
 resource "google_discovery_engine_search_engine" "search_engine_prod" {
@@ -122,7 +113,7 @@ resource "google_storage_bucket" "vector_search_data_bucket" {
   uniform_bucket_level_access = true
   force_destroy               = true
 
-  depends_on = [resource.google_project_service.cicd_services, resource.google_project_service.shared_services]
+  depends_on = [resource.google_project_service.cicd_services, resource.google_project_service.deploy_project_services]
 }
 
 resource "google_vertex_ai_index" "vector_search_index_staging" {

{src → agent_starter_pack}/base_template/deployment/terraform/variables.tf

@@ -40,8 +40,9 @@ variable "region" {
 }
 
 variable "host_connection_name" {
-  description = "Name of the host connection you created in Cloud Build"
+  description = "Name of the host connection to create in Cloud Build"
   type        = string
+  default     = "{{ cookiecutter.project_name }}-github-connection"
 }
 
 variable "repository_name" {
@@ -49,41 +50,25 @@ variable "repository_name" {
   type        = string
 }
 
-variable "telemetry_logs_filter" {
-  type        = string
-  description = "Log Sink filter for capturing telemetry data. Captures logs with the `traceloop.association.properties.log_type` attribute set to `tracing`."
-{%- if "adk" in cookiecutter.tags %}
-  default     = "labels.service_name=\"{{cookiecutter.project_name}}\" labels.type=\"agent_telemetry\""
-{%- else %}
-  default     = "jsonPayload.attributes.\"traceloop.association.properties.log_type\"=\"tracing\" jsonPayload.resource.attributes.\"service.name\"=\"{{cookiecutter.project_name}}\""
-{%- endif %}
-}
-
-variable "feedback_logs_filter" {
-  type        = string
-  description = "Log Sink filter for capturing feedback data. Captures logs where the `log_type` field is `feedback`."
-  default     = "jsonPayload.log_type=\"feedback\""
-}
-
-{% if cookiecutter.deployment_target == 'cloud_run' %}
-variable "cloud_run_app_roles" {
-  description = "List of roles to assign to the Cloud Run app service account"
-{% elif cookiecutter.deployment_target == 'agent_engine' %}
-variable "agentengine_sa_roles" {
-  description = "List of roles to assign to the Agent Engine service account"
-{% endif %}
+variable "app_sa_roles" {
+  description = "List of roles to assign to the application service account"
   type        = list(string)
   default = [
-{%- if cookiecutter.deployment_target == 'cloud_run' %}
-    "roles/run.invoker",
-{%- endif %}
+
     "roles/aiplatform.user",
     "roles/discoveryengine.editor",
     "roles/logging.logWriter",
     "roles/cloudtrace.agent",
-    "roles/storage.admin"
+    "roles/storage.admin",
+    "roles/serviceusage.serviceUsageConsumer",
+{%- if cookiecutter.session_type == "cloud_sql" %}
+    "roles/cloudsql.client",
+    "roles/secretmanager.secretAccessor",
+{%- endif %}
   ]
 }
+{%- if cookiecutter.deployment_target == 'cloud_run' %}
+{%- endif %}
 
 variable "cicd_roles" {
   description = "List of roles to assign to the CICD runner service account in the CICD project"
@@ -183,3 +168,51 @@ variable "vector_search_machine_type" {
 }
 {% endif %}
 {% endif %}
+variable "repository_owner" {
+  description = "Owner of the Git repository - username or organization"
+  type        = string
+}
+
+{% if cookiecutter.cicd_runner == "github_actions" %}
+
+
+variable "create_repository" {
+  description = "Flag indicating whether to create a new Git repository"
+  type        = bool
+  default     = false
+}
+{% else %}
+variable "github_app_installation_id" {
+  description = "GitHub App Installation ID for Cloud Build"
+  type        = string
+  default     = null
+}
+
+
+variable "github_pat_secret_id" {
+  description = "GitHub PAT Secret ID created by gcloud CLI"
+  type        = string
+  default     = null
+}
+
+variable "create_cb_connection" {
+  description = "Flag indicating if a Cloud Build connection already exists"
+  type        = bool
+  default     = false
+}
+
+variable "create_repository" {
+  description = "Flag indicating whether to create a new Git repository"
+  type        = bool
+  default     = false
+}
+{% endif %}
+{% if cookiecutter.is_adk %}
+
+variable "feedback_logs_filter" {
+  type        = string
+  description = "Log Sink filter for capturing feedback data. Captures logs where the `log_type` field is `feedback`."
+  default     = "jsonPayload.log_type=\"feedback\" jsonPayload.service_name=\"{{cookiecutter.project_name}}\""
+}
+{% endif %}
+

{src → agent_starter_pack}/base_template/deployment/terraform/vars/env.tfvars

@@ -10,11 +10,16 @@ staging_project_id = "your-staging-project-id"
 # Your Google Cloud project ID that will be used to host the Cloud Build pipelines.
 cicd_runner_project_id = "your-cicd-project-id"
 
+{%- if cookiecutter.cicd_runner == "google_cloud_build" %}
 # Name of the host connection you created in Cloud Build
 host_connection_name = "git-{{cookiecutter.project_name}}"
+github_pat_secret_id = "your-github_pat_secret_id"
+{%- endif %}
+
+repository_owner = "Your GitHub organization or username."
 
 # Name of the repository you added to Cloud Build
-repository_name = "repo-{{cookiecutter.project_name}}"
+repository_name = "{{cookiecutter.project_name}}"
 
 # The Google Cloud region you will use to deploy the infrastructure
 region = "us-central1"

agent_starter_pack/base_template/deployment/terraform/{% if cookiecutter.cicd_runner == 'github_actions' %}wif.tf{% else %}unused_wif.tf{% endif %}

@@ -0,0 +1,43 @@
+
+data "google_project" "cicd_project" {
+  project_id = var.cicd_runner_project_id
+}
+
+resource "google_service_account_iam_member" "github_oidc_access" {
+  service_account_id = resource.google_service_account.cicd_runner_sa.name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "principalSet://iam.googleapis.com/projects/${data.google_project.cicd_project.number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.github_pool.workload_identity_pool_id}/attribute.repository/${var.repository_owner}/${var.repository_name}"
+  depends_on         = [resource.google_project_service.cicd_services, resource.google_project_service.deploy_project_services]
+}
+
+# Allow the GitHub Actions principal to impersonate the CICD runner service account
+resource "google_service_account_iam_member" "github_sa_impersonation" {
+  service_account_id = resource.google_service_account.cicd_runner_sa.name
+  role               = "roles/iam.serviceAccountTokenCreator"
+  member             = "principalSet://iam.googleapis.com/projects/${data.google_project.cicd_project.number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.github_pool.workload_identity_pool_id}/attribute.repository/${var.repository_owner}/${var.repository_name}"
+  depends_on         = [resource.google_project_service.cicd_services, resource.google_project_service.deploy_project_services]
+}
+
+resource "google_iam_workload_identity_pool" "github_pool" {
+  workload_identity_pool_id = "${var.project_name}-pool"
+  project                   = var.cicd_runner_project_id
+  display_name              = "GitHub Actions Pool"
+  depends_on         = [resource.google_project_service.cicd_services, resource.google_project_service.deploy_project_services]
+}
+
+resource "google_iam_workload_identity_pool_provider" "github_provider" {
+  workload_identity_pool_provider_id = "${var.project_name}-oidc"
+  project                            = var.cicd_runner_project_id
+  workload_identity_pool_id          = google_iam_workload_identity_pool.github_pool.workload_identity_pool_id
+  display_name                       = "GitHub OIDC Provider"
+  oidc {
+    issuer_uri = "https://token.actions.githubusercontent.com"
+  }
+  attribute_mapping = {
+    "google.subject"         = "assertion.sub"
+    "attribute.repository"       = "assertion.repository"
+    "attribute.repository_owner" = "assertion.repository_owner"
+  }
+  attribute_condition = "attribute.repository == '${var.repository_owner}/${var.repository_name}'"
+  depends_on          = [resource.google_project_service.cicd_services, resource.google_project_service.deploy_project_services]
+}

src/base_template/deployment/terraform/build_triggers.tf → agent_starter_pack/base_template/deployment/terraform/{% if cookiecutter.cicd_runner == 'google_cloud_build' %}build_triggers.tf{% else %}unused_build_triggers.tf{% endif %}

@@ -27,9 +27,9 @@ resource "google_cloudbuild_trigger" "pr_checks" {
     }
   }
 
-  filename = "deployment/ci/pr_checks.yaml"
+  filename = ".cloudbuild/pr_checks.yaml"
   included_files = [
-    "app/**",
+    "{{cookiecutter.agent_directory}}/**",
     "data_ingestion/**",
     "tests/**",
     "deployment/**",
@@ -39,7 +39,12 @@ resource "google_cloudbuild_trigger" "pr_checks" {
   {% endif %}
   ]
   include_build_logs = "INCLUDE_BUILD_LOGS_WITH_STATUS"
-  depends_on = [resource.google_project_service.cicd_services, resource.google_project_service.shared_services]
+  depends_on = [
+    resource.google_project_service.cicd_services, 
+    resource.google_project_service.deploy_project_services, 
+    google_cloudbuildv2_connection.github_connection, 
+    google_cloudbuildv2_repository.repo
+  ]
 }
 
 # b. Create CD pipeline trigger
@@ -57,9 +62,9 @@ resource "google_cloudbuild_trigger" "cd_pipeline" {
     }
   }
 
-  filename = "deployment/cd/staging.yaml"
+  filename = ".cloudbuild/staging.yaml"
   included_files = [
-    "app/**",
+    "{{cookiecutter.agent_directory}}/**",
     "data_ingestion/**",
     "tests/**",
     "deployment/**",
@@ -68,30 +73,35 @@ resource "google_cloudbuild_trigger" "cd_pipeline" {
   include_build_logs = "INCLUDE_BUILD_LOGS_WITH_STATUS"
   substitutions = {
     _STAGING_PROJECT_ID            = var.staging_project_id
-    _BUCKET_NAME_LOAD_TEST_RESULTS = resource.google_storage_bucket.bucket_load_test_results.name
+    _LOGS_BUCKET_NAME_STAGING      = resource.google_storage_bucket.logs_data_bucket[var.staging_project_id].name
+    _APP_SERVICE_ACCOUNT_STAGING   = google_service_account.app_sa["staging"].email
     _REGION                        = var.region
-{% if cookiecutter.deployment_target == 'cloud_run' %}
+{%- if cookiecutter.deployment_target == 'cloud_run' %}
     _CONTAINER_NAME                = var.project_name
     _ARTIFACT_REGISTRY_REPO_NAME   = resource.google_artifact_registry_repository.repo-artifacts-genai.repository_id
-    _CLOUD_RUN_APP_SA_EMAIL         = resource.google_service_account.cloud_run_app_sa["staging"].email
-{% endif %}
-{% if cookiecutter.data_ingestion %}
-    _PIPELINE_GCS_ROOT             = "gs://${resource.google_storage_bucket.data_ingestion_pipeline_gcs_root["staging"].name}"
-    _PIPELINE_SA_EMAIL             = resource.google_service_account.vertexai_pipeline_app_sa["staging"].email
+{%- elif cookiecutter.deployment_target == 'agent_engine' %}
+{%- endif %}
+{%- if cookiecutter.data_ingestion %}
+    _PIPELINE_GCS_ROOT_STAGING     = "gs://${resource.google_storage_bucket.data_ingestion_pipeline_gcs_root["staging"].name}"
+    _PIPELINE_SA_EMAIL_STAGING             = resource.google_service_account.vertexai_pipeline_app_sa["staging"].email
     _PIPELINE_CRON_SCHEDULE        = var.pipeline_cron_schedule
-{% if cookiecutter.datastore_type == "vertex_ai_search" %}
-    _DATA_STORE_ID                 = resource.google_discovery_engine_data_store.data_store_staging.data_store_id
+{%- if cookiecutter.datastore_type == "vertex_ai_search" %}
+    _DATA_STORE_ID_STAGING         = resource.google_discovery_engine_data_store.data_store_staging.data_store_id
     _DATA_STORE_REGION             = var.data_store_region
-{% elif cookiecutter.datastore_type == "vertex_ai_vector_search" %}
-    _VECTOR_SEARCH_INDEX           = resource.google_vertex_ai_index.vector_search_index_staging.id
-    _VECTOR_SEARCH_INDEX_ENDPOINT  = resource.google_vertex_ai_index_endpoint.vector_search_index_endpoint_staging.id
-    _VECTOR_SEARCH_BUCKET          = "gs://${resource.google_storage_bucket.vector_search_data_bucket["staging"].name}"
-
-{% endif %}
-{% endif %}
+{%- elif cookiecutter.datastore_type == "vertex_ai_vector_search" %}
+    _VECTOR_SEARCH_INDEX_STAGING   = resource.google_vertex_ai_index.vector_search_index_staging.id
+    _VECTOR_SEARCH_INDEX_ENDPOINT_STAGING = resource.google_vertex_ai_index_endpoint.vector_search_index_endpoint_staging.id
+    _VECTOR_SEARCH_BUCKET_STAGING  = resource.google_storage_bucket.vector_search_data_bucket["staging"].url
+{%- endif %}
+{%- endif %}
     # Your other CD Pipeline substitutions
   }
-  depends_on = [resource.google_project_service.cicd_services, resource.google_project_service.shared_services]
+  depends_on = [
+    resource.google_project_service.cicd_services, 
+    resource.google_project_service.deploy_project_services, 
+    google_cloudbuildv2_connection.github_connection, 
+    google_cloudbuildv2_repository.repo
+  ]
 
 }
 
@@ -105,34 +115,41 @@ resource "google_cloudbuild_trigger" "deploy_to_prod_pipeline" {
   repository_event_config {
     repository = "projects/${var.cicd_runner_project_id}/locations/${var.region}/connections/${var.host_connection_name}/repositories/${var.repository_name}"
   }
-  filename = "deployment/cd/deploy-to-prod.yaml"
+  filename = ".cloudbuild/deploy-to-prod.yaml"
   include_build_logs = "INCLUDE_BUILD_LOGS_WITH_STATUS"
   approval_config {
     approval_required = true
   }
   substitutions = {
     _PROD_PROJECT_ID             = var.prod_project_id
+    _LOGS_BUCKET_NAME_PROD       = resource.google_storage_bucket.logs_data_bucket[var.prod_project_id].name
+    _APP_SERVICE_ACCOUNT_PROD    = google_service_account.app_sa["prod"].email
     _REGION                      = var.region
-{% if cookiecutter.deployment_target == 'cloud_run' %}
+{%- if cookiecutter.deployment_target == 'cloud_run' %}
     _CONTAINER_NAME              = var.project_name
     _ARTIFACT_REGISTRY_REPO_NAME = resource.google_artifact_registry_repository.repo-artifacts-genai.repository_id
-    _CLOUD_RUN_APP_SA_EMAIL       = resource.google_service_account.cloud_run_app_sa["prod"].email
-{% endif %}
-{% if cookiecutter.data_ingestion %}
-    _PIPELINE_GCS_ROOT             = "gs://${resource.google_storage_bucket.data_ingestion_pipeline_gcs_root["prod"].name}"
-    _PIPELINE_SA_EMAIL             = resource.google_service_account.vertexai_pipeline_app_sa["prod"].email
+{%- elif cookiecutter.deployment_target == 'agent_engine' %}
+{%- endif %}
+{%- if cookiecutter.data_ingestion %}
+    _PIPELINE_GCS_ROOT_PROD        = "gs://${resource.google_storage_bucket.data_ingestion_pipeline_gcs_root["prod"].name}"
+    _PIPELINE_SA_EMAIL_PROD             = resource.google_service_account.vertexai_pipeline_app_sa["prod"].email
     _PIPELINE_CRON_SCHEDULE        = var.pipeline_cron_schedule
-{% if cookiecutter.datastore_type == "vertex_ai_search" %}
-    _DATA_STORE_ID                 = resource.google_discovery_engine_data_store.data_store_prod.data_store_id
+{%- if cookiecutter.datastore_type == "vertex_ai_search" %}
+    _DATA_STORE_ID_PROD            = resource.google_discovery_engine_data_store.data_store_prod.data_store_id
     _DATA_STORE_REGION             = var.data_store_region
-{% elif cookiecutter.datastore_type == "vertex_ai_vector_search" %}
-    _VECTOR_SEARCH_INDEX           = resource.google_vertex_ai_index.vector_search_index_prod.id
-    _VECTOR_SEARCH_INDEX_ENDPOINT  = resource.google_vertex_ai_index_endpoint.vector_search_index_endpoint_prod.id
-    _VECTOR_SEARCH_BUCKET          = "gs://${resource.google_storage_bucket.vector_search_data_bucket["prod"].name}"
-{% endif %}
-{% endif %}
+{%- elif cookiecutter.datastore_type == "vertex_ai_vector_search" %}
+    _VECTOR_SEARCH_INDEX_PROD      = resource.google_vertex_ai_index.vector_search_index_prod.id
+    _VECTOR_SEARCH_INDEX_ENDPOINT_PROD = resource.google_vertex_ai_index_endpoint.vector_search_index_endpoint_prod.id
+    _VECTOR_SEARCH_BUCKET_PROD     = resource.google_storage_bucket.vector_search_data_bucket["prod"].url
+{%- endif %}
+{%- endif %}
     # Your other Deploy to Prod Pipeline substitutions
   }
-  depends_on = [resource.google_project_service.cicd_services, resource.google_project_service.shared_services]
+  depends_on = [
+    resource.google_project_service.cicd_services, 
+    resource.google_project_service.deploy_project_services, 
+    google_cloudbuildv2_connection.github_connection, 
+    google_cloudbuildv2_repository.repo
+  ]
 
 }

agent_starter_pack/base_template/deployment/terraform/{% if cookiecutter.is_adk %}telemetry.tf{% else %}unused_telemetry.tf{% endif %}

@@ -0,0 +1,206 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# BigQuery dataset for telemetry external tables
+resource "google_bigquery_dataset" "telemetry_dataset" {
+  for_each      = local.deploy_project_ids
+  project       = each.value
+  dataset_id    = replace("${var.project_name}_telemetry", "-", "_")
+  friendly_name = "${var.project_name} Telemetry"
+  location      = var.region
+  description   = "Dataset for GenAI telemetry data stored in GCS"
+  depends_on    = [resource.google_project_service.cicd_services, resource.google_project_service.deploy_project_services]
+}
+
+# BigQuery connection for accessing GCS telemetry data
+resource "google_bigquery_connection" "genai_telemetry_connection" {
+  for_each      = local.deploy_project_ids
+  project       = each.value
+  location      = var.region
+  connection_id = "${var.project_name}-genai-telemetry"
+  friendly_name = "${var.project_name} GenAI Telemetry Connection"
+
+  cloud_resource {}
+
+  depends_on = [resource.google_project_service.cicd_services, resource.google_project_service.deploy_project_services]
+}
+
+# Wait for the BigQuery connection service account to propagate in IAM
+resource "time_sleep" "wait_for_bq_connection_sa" {
+  for_each = local.deploy_project_ids
+
+  create_duration = "10s"
+
+  depends_on = [google_bigquery_connection.genai_telemetry_connection]
+}
+
+# Grant the BigQuery connection service account access to read from the logs bucket
+resource "google_storage_bucket_iam_member" "telemetry_connection_access" {
+  for_each = local.deploy_project_ids
+  bucket   = google_storage_bucket.logs_data_bucket[each.value].name
+  role     = "roles/storage.objectViewer"
+  member   = "serviceAccount:${google_bigquery_connection.genai_telemetry_connection[each.key].cloud_resource[0].service_account_id}"
+
+  depends_on = [time_sleep.wait_for_bq_connection_sa]
+}
+
+# ====================================================================
+# Dedicated Cloud Logging Bucket for GenAI Telemetry
+# ====================================================================
+
+# Create a custom Cloud Logging bucket for GenAI telemetry logs with long-term retention
+resource "google_logging_project_bucket_config" "genai_telemetry_bucket" {
+  for_each         = local.deploy_project_ids
+  project          = each.value
+  location         = var.region
+  bucket_id        = "${var.project_name}-genai-telemetry"
+  retention_days   = 3650  # 10 years retention (maximum allowed)
+  enable_analytics = true  # Required for linked datasets
+  description      = "Dedicated Cloud Logging bucket for ${var.project_name} GenAI telemetry with 10 year retention"
+
+  depends_on = [resource.google_project_service.cicd_services, resource.google_project_service.deploy_project_services]
+}
+
+# Log sink to route only GenAI telemetry logs to the dedicated bucket
+# Filter by bucket name in the GCS path (which includes project_name) to isolate this agent's logs
+resource "google_logging_project_sink" "genai_logs_to_bucket" {
+  for_each    = local.deploy_project_ids
+  name        = "${var.project_name}-genai-logs"
+  project     = each.value
+  destination = "logging.googleapis.com/projects/${each.value}/locations/${var.region}/buckets/${google_logging_project_bucket_config.genai_telemetry_bucket[each.key].bucket_id}"
+  filter      = "log_name=\"projects/${each.value}/logs/gen_ai.client.inference.operation.details\" AND (labels.\"gen_ai.input.messages_ref\" =~ \".*${var.project_name}.*\" OR labels.\"gen_ai.output.messages_ref\" =~ \".*${var.project_name}.*\")"
+
+  unique_writer_identity = true
+  depends_on             = [google_logging_project_bucket_config.genai_telemetry_bucket]
+}
+
+# Create a linked dataset to the GenAI telemetry logs bucket for querying via BigQuery
+resource "google_logging_linked_dataset" "genai_logs_linked_dataset" {
+  for_each    = local.deploy_project_ids
+  link_id     = replace("${var.project_name}_genai_telemetry_logs", "-", "_")
+  bucket      = google_logging_project_bucket_config.genai_telemetry_bucket[each.key].bucket_id
+  description = "Linked dataset for ${var.project_name} GenAI telemetry Cloud Logging bucket"
+  location    = var.region
+  parent      = "projects/${each.value}"
+
+  depends_on = [
+    google_logging_project_bucket_config.genai_telemetry_bucket,
+    google_logging_project_sink.genai_logs_to_bucket
+  ]
+}
+
+# Wait for linked dataset to fully propagate
+resource "time_sleep" "wait_for_linked_dataset" {
+  for_each = local.deploy_project_ids
+
+  create_duration = "10s"
+
+  depends_on = [google_logging_linked_dataset.genai_logs_linked_dataset]
+}
+
+# ====================================================================
+# Feedback Logs to Cloud Logging Bucket
+# ====================================================================
+
+# Log sink for user feedback logs - routes to the same Cloud Logging bucket
+resource "google_logging_project_sink" "feedback_logs_to_bucket" {
+  for_each    = local.deploy_project_ids
+  name        = "${var.project_name}-feedback"
+  project     = each.value
+  destination = "logging.googleapis.com/projects/${each.value}/locations/${var.region}/buckets/${google_logging_project_bucket_config.genai_telemetry_bucket[each.key].bucket_id}"
+  filter      = var.feedback_logs_filter
+
+  unique_writer_identity = true
+  depends_on             = [google_logging_project_bucket_config.genai_telemetry_bucket]
+}
+
+# ====================================================================
+# Completions External Table (GCS-based)
+# ====================================================================
+
+# External table for completions data (messages/parts) stored in GCS
+resource "google_bigquery_table" "completions_external_table" {
+  for_each            = local.deploy_project_ids
+  project             = each.value
+  dataset_id          = google_bigquery_dataset.telemetry_dataset[each.key].dataset_id
+  table_id            = "completions"
+  deletion_protection = false
+
+  external_data_configuration {
+    autodetect            = false
+    source_format         = "NEWLINE_DELIMITED_JSON"
+    source_uris           = ["gs://${google_storage_bucket.logs_data_bucket[each.value].name}/completions/*"]
+    connection_id         = google_bigquery_connection.genai_telemetry_connection[each.key].name
+    ignore_unknown_values = true
+    max_bad_records       = 1000
+  }
+
+  # Schema matching the ADK completions format
+  schema = jsonencode([
+    {
+      name = "parts"
+      type = "RECORD"
+      mode = "REPEATED"
+      fields = [
+        { name = "type", type = "STRING", mode = "NULLABLE" },
+        { name = "content", type = "STRING", mode = "NULLABLE" },
+        { name = "mime_type", type = "STRING", mode = "NULLABLE" },
+        { name = "uri", type = "STRING", mode = "NULLABLE" },
+        { name = "data", type = "BYTES", mode = "NULLABLE" },
+        { name = "id", type = "STRING", mode = "NULLABLE" },
+        { name = "name", type = "STRING", mode = "NULLABLE" },
+        { name = "arguments", type = "JSON", mode = "NULLABLE" },
+        { name = "response", type = "JSON", mode = "NULLABLE" }
+      ]
+    },
+    { name = "role", type = "STRING", mode = "NULLABLE" },
+    { name = "index", type = "INTEGER", mode = "NULLABLE" }
+  ])
+
+  depends_on = [
+    google_storage_bucket.logs_data_bucket,
+    google_bigquery_connection.genai_telemetry_connection,
+    google_storage_bucket_iam_member.telemetry_connection_access
+  ]
+}
+
+# ====================================================================
+# Completions View (Joins Logs with GCS Data)
+# ====================================================================
+
+# View that joins Cloud Logging data with GCS-stored completions data
+resource "google_bigquery_table" "completions_view" {
+  for_each            = local.deploy_project_ids
+  project             = each.value
+  dataset_id          = google_bigquery_dataset.telemetry_dataset[each.key].dataset_id
+  table_id            = "completions_view"
+  description         = "View of GenAI completion logs joined with the GCS prompt/response external table"
+  deletion_protection = false
+
+  view {
+    query = templatefile("${path.module}/sql/completions.sql", {
+      project_id                 = each.value
+      dataset_id                 = google_bigquery_dataset.telemetry_dataset[each.key].dataset_id
+      completions_external_table = google_bigquery_table.completions_external_table[each.key].table_id
+      logs_link_id               = google_logging_linked_dataset.genai_logs_linked_dataset[each.key].link_id
+    })
+    use_legacy_sql = false
+  }
+
+  depends_on = [
+    google_logging_linked_dataset.genai_logs_linked_dataset,
+    google_bigquery_table.completions_external_table,
+    time_sleep.wait_for_linked_dataset
+  ]
+}