---
title: "MCP Services Environment"
slug: gcp-env-mcp
section: GCP Infrastructure
status: stable
description: "`alliance-mcp-services` is the dedicated GCP project for Alliance tool-calling infrastructure: the MCP Gateway and its admin UI, the backend MCP servers, Platform Hub, and the shared global HTTPS load balancer in front of them."
last-updated: 2026-10-07
---

# MCP Services Environment

## Purpose

`alliance-mcp-services` is the dedicated GCP project for Alliance tool-calling infrastructure: the MCP Gateway and its admin UI, the backend MCP servers, Platform Hub, and the shared global HTTPS load balancer in front of them. It is a separate root module (`environments/mcp`, state in bucket `mcp-tfstate-alliance-mcp-services`), not a slice of the development, QA or production environments. See `/docs/mcp-gateway` for the gateway product view.

### One shared instance, not per environment

MCP servers are intentionally a single shared instance. The repo convention is "MCP is one shared instance, never per-env" (referenced in `environments/mcp/backend.tf`), which is why this project has its own state bucket and its own apply workflow instead of dev/qa/prod copies. The naming conventions generalise this into a rule that genuinely shared services carry no environment suffix (see `/docs/gcp-naming-conventions`). A possible leftover of earlier per-environment naming is visible in Secret Manager, which holds `mcp-production-*` secrets next to `mcp-development-*` ones; the code lists eight `mcp-production-*` secrets as unreferenced by any live service.

## How the pieces fit

- **Gateway and admin UI.** Two Cloud Run services in `northamerica-northeast1` (`gateway_region`). The gateway has a Cloud SQL Postgres 15 instance (`alliance-mcp-gateway-db`) and the runtime SA `alliance-mcp-gateway-sa`.
- **Backend MCP servers.** Cloud Run services in `us-central1`. Per the live snapshot, only the gateway, admin and `itrequest-mcp` are in `northamerica-northeast1`; the rest are in `us-central1`.
- **Platform Hub.** A Cloud Run service in `us-central1`, added in Phase 2 (2026-07-20) with its own Artifact Registry repo `platform-hub` and secrets module. It is configured with the `MCP_GATEWAY_URL` environment variable set to `https://mcp.allianceabroad.com` and the `GATEWAY_PAT` environment variable, which is sourced from the `platform-hub-gateway-pat` secret.
- **Environment index.** The `alliance-mcp-services` predecessor and the dev/QA pools were removed on 2026-10-05.
- **Backend wiring.** The gateway receives one `BACKEND_<SLUG>_URL` environment variable per backend (for example `BACKEND_GCP_URL`, `BACKEND_GITHUB_URL`, `BACKEND_PLATFORMHUB_URL`) plus matching `BACKEND_<SLUG>_API_KEY` secret mounts. The gateway has 26 secret mounts in `main.tf`, declared under legacy `secret-alias-N` names rather than real secret ids. That env and secret set is not byte-exact with the live service, so the container `env` attribute is under `ignore_changes`: Terraform never adds, removes or modifies gateway env vars or secret mounts, and a change such as a new `BACKEND_<SLUG>_URL` value must also be applied to the live service out of band (`gcloud run services update alliance-mcp-gateway --update-env-vars`). `BACKEND_PLATFORMHUB_URL` points to `https://platform.allianceabroad.com/mcp`, the LB path, not a direct `run.app` URL.
- **Openstatus.** The live snapshot shows OpenStatus running on the GKE Autopilot cluster `openstatus-cluster` (`us-central1`) in this project, fronted by its own GKE-ingress load balancers and external IPs, separate from the shared MCP load balancer. The cluster is not declared in Terraform. The `openstatus-mcp` MCP server is a separate Cloud Run service that is declared.

### Load balancer, hosts and IAP

One global external HTTPS load balancer for the MCP hosts (`module.mcp_gateway_lb`, `modules/load-balancer-https-multihost`, scheme `EXTERNAL_MANAGED`, static IP `mcp-gateway-lb-ip`, URL map `mcp-lb`) serves the hosts below. See `/docs/gcp-networking-and-load-balancing` for the generic pattern.

| Host | Default backend | IAP | Notes |
|---|---|---|---|
| `mcp.allianceabroad.com` | `mcp-gw-backend` | off | PAT and robot traffic; path `/` is rewritten to `/mcp` for connectors that POST to the root |
| `mcp-admin.allianceabroad.com` | `mcp-admin-backend` | on | paths `/api` and `/auth` go to `mcp-admin-api-backend` (same gateway NEG, IAP on) |
| `platform.allianceabroad.com` | `platform-hub-backend` | on | path `/mcp` goes to `platform-hub-mcp-backend` (IAP off, X-API-Key auth in app code) |

The managed certificates are `mcp-cert` (the two `mcp` hosts) and `platform-hub-cert`. The IAP accessor grant (`domain:allianceabroad.com`) is declared only for `platform-hub-backend`; the code states that the two admin backends follow the same convention live, but this could not be verified and they are not modeled. Cloud Run services are mostly `ingress = all`; one service uses `internal-and-cloud-load-balancing`.

## Deployment

- **Infrastructure:** `terraform-apply-mcp` (`.github/workflows/terraform-apply-mcp.yml`) is `workflow_dispatch` only. It needs the typed phrase `apply-to-mcp`, authenticates through the WIF pool `github-actions-apply-mcp` locked to the `main` branch of `alliance-gcp-infra`, and stops if the plan destroys more than 1 resource. Read-only plans use the `github-actions-iac` pool. Details: `/docs/gcp-terraform-workflows`.
- **Reconciling Terraform with live:** `environments/mcp/imports.tf` holds `import` blocks that adopt resources created by hand before their Terraform existed (service accounts, secret containers, Artifact Registry repositories and WIF pools and providers); earlier apply runs failed with "already exists" until those were imported. `main.tf` was then aligned to live values (for example the `HOSTPORTAL_*` env vars on `auth0-mcp-server`, `WORKSPACE_ADMIN_SUBJECT` on `gcp-mcp-server`, and the live `asana-mcp` digest) so an apply does not revert running services. Grants that change the dev project's IAM are not declared in this root, because the apply identity `terraform-tf@alliance-mcp-services` has no access to that project: they live in `environments/development` (the `wordpress-mcp-deploy` Artifact Registry writer, a repo-scoped reader on the dev `globus` registry for `terraform-tf`, and the leftover dev-project `openstatus-mcp-sa`). The workflow's report issue says "Applied successfully" whenever the plan had changes and passed the circuit breaker, regardless of the Apply step, so check the Apply step conclusion in the run.
- **Application images:** built by each service's own repo CI. For example `globus-mcp-development` is deployed by Alliance-Strategies/ReplitMCP CI via the `globus-mcp-dev-deployer` identity (WIF pool `github-replitmcp`), and `gateway-deployer`, `platform-hub-deploy`, `replitmcp-deploy`, `wordpress-mcp-deploy` and `gcp-connector-deployer` are further CI-deploy identities. `gcp-connector-deployer` authenticates through the WIF pool `github-gcp-connector`, locked to `Alliance-Strategies/gcp-connector`; it holds `roles/run.developer` on the `gcp-mcp-server` service only and `roles/iam.serviceAccountUser` on `gcp-mcp-sa` only, with no project-level roles. Because Cloud Run checks that the deploying identity can read the image it deploys, it also has a repository-scoped `roles/artifactregistry.reader` on the dev project's `alliance-abroad` registry, declared in `environments/development`, not in this root. The gateway and the backend Cloud Run services declared as inline `google_cloud_run_service` resources generally carry `ignore_changes` on the container image, so a deploy outside Terraform does not normally show as an image diff. Two services are exceptions: `asana-mcp` is pinned to an image digest in `main.tf` that is deploy-owned (the code comment says to update the digest in the same change as a redeploy, otherwise an apply rolls the live service back), and `globus-mcp-development` uses the `:latest` tag with a code TODO note.
- **asana-mcp cross-project deploy:** `asana-mcp` is built in the dev project and deployed into this one. The dev project's default compute service account holds `roles/run.developer` on the `asana-mcp` service only, through the `developer_members` input of the shared `cloud-run-service` module (no project-wide role).
- **Before the first apply:** the code comments state that the apply identity could not bootstrap itself, so the first apply had to be done manually with human credentials.

## Terraform versus reality

Drift comparison (generated tables below): the three live-only Cloud Run services are `itrequest-mcp`, `replitmcp` and `wordpress-mcp`. Their `.tf` files declare the service accounts, secrets, IAM and workload identity scaffolding (plus an `itrequest-mcp` invoker grant and the `replitmcp` Artifact Registry repo) but deliberately do NOT declare the Cloud Run services themselves; the code comments say the services are created by their repos' CI deploys first and added to Terraform later. Live, `replitmcp` runs as `globus-mcp-dev-sa`, not the declared `replitmcp-sa`. Live-only secrets include `auth0-mcp-hostportal-*`, `google-workspace-mcp-*`, `mcp-gateway-oauth-asana-*` and a few others. Live-only items also include the GKE cluster `openstatus-cluster` and the domain mapping `teams-mcp.mcp.allianceabroad.com`. The code says that mapping is broken and superseded by the LB; the snapshot shows its Ready condition as False. Firewall rules and the default VPC are platform-created. Live-only APIs are also listed in the generated tables.

Structural gaps stated in `main.tf`: the project is not self-contained. Only 6 of 19 services (at the time of writing the code comment) had images in this project's own Artifact Registry; the rest pull from the development project registry. `globus-mcp-development` and `nexus-hub` depend on Cloud SQL instances in `skilled-script-469819-f2`, and several secrets are cross-project references. Four service accounts (`development-mcp-aag-sa`, `globus-mcp-sa`, `godaddy-mcp-server-sa`, `manus-mcp-sa`) have no Cloud Run service using them.

## Security observations

These are facts from the Terraform code comments and the live snapshot. They should be reviewed.

- `outlook-mcp` is invocable by `allUsers` with no container-level secret; it relies on the gateway forwarding a per-user bearer token that the container must validate. The code also grants `allUsers` as invoker on the gateway, admin UI, `nexus-hub`, `teams-mcp-bot` and `platform-hub`.
- `outlook-mcp` and the admin UI run as the default compute service account, which the repo conventions rule out.
- `gcp-mcp-sa` holds project-level `roles/resourcemanager.projectIamAdmin`, `roles/run.admin` and `roles/secretmanager.admin`. The code flags this for human sign-off.
- The gateway database has a public IPv4 address, no private network, backups disabled and SSL mode `ALLOW_UNENCRYPTED_AND_ENCRYPTED`.
- The retired `nexus-hub-sa` still has two user-managed keys that could not be deleted (per code comments); its grants were reduced to `roles/artifactregistry.reader` and `roles/cloudsql.client`.
- The live `hubspot-mcp` service references a secret absent from Secret Manager (see Known gaps).
- Secrets holding host portal Auth0 (dev and qa) credentials and Google Workspace service account keys (`domain-admin-sa-key`, `google-workspace-mcp-sa-key`) exist live in this project and are not declared in Terraform.

## Operating notes

- Plan-on-PR for this project uses the viewer-only `terraform-ci-viewer-mcp` identity. The code notes it lacked state-lock rights and adds a bucket grant for it (`roles/storage.objectUser` on the state bucket); whether that grant is applied was not checked, so read the plan comment rather than relying on a green check.
- `main.tf` documents a provider quirk where imported Cloud Run services show a one-line `run.googleapis.com/ingress` annotation diff until the first real apply writes it.
- Platform Hub's Cloud Run image is declared with a concrete tag and ignored for changes after creation; the CI deploy owns the running image.
- The gateway is configured with `minScale` 1 and `maxScale` 1 to match the live service. A code comment flags the maximum of 1 for separate review because it could cause request queuing under load.
- `security-agent-sa` has read-only viewer roles on this project for Cloud Run, service accounts, Secret Manager, network, Cloud SQL and KMS. Its Cloud Storage check has no read access: a project-level `roles/storage.legacyBucketReader` grant was removed because GCP rejects that role at project level, and the code comment says a follow-up needs bucket-level grants or a narrow custom role.
- `/docs/disaster-recovery-plan` lists MCP servers in its best-effort tier 4; this page does not verify that tier.

_Terraform inventory generated from `alliance-gcp-infra` at commit `fc9bd1d`. Live snapshots: `alliance-mcp-services` read 2026-10-01. Snapshots hold names and a few stable attributes only, never secret values._

## Terraform-managed resources

Every module call and resource block under `environments/mcp` (126 in total), grouped by category.

### Identity and access (service accounts, IAM bindings, Workload Identity)

83 items.

| Terraform address | Module or resource type | Identifier | Defined in |
| --- | --- | --- | --- |
| `google_artifact_registry_repository_iam_member.replitmcp_deploy_ar_writer` | `google_artifact_registry_repository_iam_member` | `roles/artifactregistry.writer -> serviceAccount:${module.replitmcp_deploy_sa.email}` | `replitmcp.tf:59` |
| `google_cloud_run_service_iam_member.alliance_mcp_gateway_admin_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:1525` |
| `google_cloud_run_service_iam_member.alliance_mcp_gateway_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:1437` |
| `google_cloud_run_service_iam_member.auth0_mcp_server_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:1703` |
| `google_cloud_run_service_iam_member.azure_mcp_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:1827` |
| `google_cloud_run_service_iam_member.gcp_connector_deployer_run_developer` | `google_cloud_run_service_iam_member` | `roles/run.developer -> serviceAccount:${module.gcp_connector_deployer_sa.email}` | `gcp_connector_deploy.tf:57` |
| `google_cloud_run_service_iam_member.gcp_mcp_server_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:1948` |
| `google_cloud_run_service_iam_member.github_mcp_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:2058` |
| `google_cloud_run_service_iam_member.globus_backoffice_mcp_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:2165` |
| `google_cloud_run_service_iam_member.godaddy_mcp_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:2336` |
| `google_cloud_run_service_iam_member.google_workspace_mcp_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:2459` |
| `google_cloud_run_service_iam_member.hubspot_mcp_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:2557` |
| `google_cloud_run_service_iam_member.itrequest_mcp_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `itrequest-mcp.tf:80` |
| `google_cloud_run_service_iam_member.nexus_hub_mcp_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:2777` |
| `google_cloud_run_service_iam_member.onepassword_mcp_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:2881` |
| `google_cloud_run_service_iam_member.openstatus_mcp_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:2987` |
| `google_cloud_run_service_iam_member.outlook_mcp_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:3072` |
| `google_cloud_run_service_iam_member.platform_hub_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:3656` |
| `google_cloud_run_service_iam_member.posthog_mcp_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:3178` |
| `google_cloud_run_service_iam_member.teams_mcp_bot_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:3539` |
| `google_cloud_run_service_iam_member.teams_mcp_invokers` | `google_cloud_run_service_iam_member` | `roles/run.invoker -> each.value` (one per `for_each` key) | `main.tf:3365` |
| `google_iap_web_backend_service_iam_member.platform_hub_backend_accessor` | `google_iap_web_backend_service_iam_member` | `roles/iap.httpsResourceAccessor -> domain:allianceabroad.com` | `main.tf:3798` |
| `google_project_iam_member.n8n_runtime_dev_compute_viewer` | `google_project_iam_member` | `roles/compute.viewer -> serviceAccount:n8n-runtime-dev@skilled-script-469819-f2.iam.gserviceaccount.com` | `cert-monitor-n8n-runtime-sa-compute-viewer.tf:10` |
| `google_project_iam_member.security_agent_sa_cloudkms_viewer` | `google_project_iam_member` | `roles/cloudkms.viewer -> serviceAccount:security-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` | `security-agent-sa-cloudkms-viewer.tf:12` |
| `google_project_iam_member.security_agent_sa_cloudsql_viewer` | `google_project_iam_member` | `roles/cloudsql.viewer -> serviceAccount:security-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` | `security-agent-sa-cloudsql-viewer.tf:13` |
| `google_project_iam_member.security_agent_sa_network_viewer` | `google_project_iam_member` | `roles/compute.networkViewer -> serviceAccount:security-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` | `security-agent-sa-viewer-roles.tf:50` |
| `google_project_iam_member.security_agent_sa_run_viewer` | `google_project_iam_member` | `roles/run.viewer -> serviceAccount:security-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` | `security-agent-sa-viewer-roles.tf:26` |
| `google_project_iam_member.security_agent_sa_secretmanager_viewer` | `google_project_iam_member` | `roles/secretmanager.viewer -> serviceAccount:security-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` | `security-agent-sa-viewer-roles.tf:38` |
| `google_project_iam_member.security_agent_sa_service_account_viewer` | `google_project_iam_member` | `roles/iam.serviceAccountViewer -> serviceAccount:security-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` | `security-agent-sa-viewer-roles.tf:32` |
| `google_project_iam_member.security_agent_sa_storage_legacy_bucket_reader` | `google_project_iam_member` | `roles/storage.legacyBucketReader -> serviceAccount:security-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` | `security-agent-sa-viewer-roles.tf:44` |
| `google_project_iam_member.user_addition_agent_sa_iam_viewer` | `google_project_iam_member` | `roles/iam.securityReviewer -> serviceAccount:user-addition-agent-sa@skilled-script-469819-f2.iam.gserviceaccount.com` | `user-addition-agent-sa-iam-viewer.tf:22` |
| `google_project_iam_member.wordpress_mcp_deploy_ar_writer` | `google_project_iam_member` | `roles/artifactregistry.writer -> serviceAccount:${module.wordpress_mcp_deploy_sa.email}` | `wordpress-mcp.tf:63` |
| `google_service_account_iam_member.gcp_connector_deployer_can_actas_gcp_mcp_sa` | `google_service_account_iam_member` | `roles/iam.serviceAccountUser -> serviceAccount:${module.gcp_connector_deployer_sa.email}` | `gcp_connector_deploy.tf:65` |
| `google_service_account_iam_member.gcp_connector_deployer_wif` | `google_service_account_iam_member` | `roles/iam.workloadIdentityUser -> principalSet://iam.googleapis.com/${module.github_gcp_connector_wif.name}/attribute.repository/Alliance-Strategies/gcp-connector` | `gcp_connector_deploy.tf:48` |
| `google_service_account_iam_member.platform_hub_deploy_can_actas_platform_hub_sa` | `google_service_account_iam_member` | `roles/iam.serviceAccountUser -> serviceAccount:${module.platform_hub_deploy_sa.email}` | `main.tf:464` |
| `google_service_account_iam_member.platform_hub_deploy_wif` | `google_service_account_iam_member` | `roles/iam.workloadIdentityUser -> principalSet://iam.googleapis.com/${module.wif_pool_github_actions_platform_hub.name}/attribute.repository/Alliance-Strategies/platform-hub` | `main.tf:906` |
| `google_service_account_iam_member.replitmcp_deploy_can_actas_replitmcp_sa` | `google_service_account_iam_member` | `roles/iam.serviceAccountUser -> serviceAccount:${module.replitmcp_deploy_sa.email}` | `replitmcp.tf:71` |
| `google_service_account_iam_member.replitmcp_deploy_wif` | `google_service_account_iam_member` | `roles/iam.workloadIdentityUser -> principalSet://iam.googleapis.com/${module.wif_pool_github_actions_replitmcp.name}/attribute.repository/Alliance-Strategies/ReplitMCP` | `replitmcp.tf:101` |
| `google_service_account_iam_member.terraform_ci_viewer_mcp_wif` | `google_service_account_iam_member` | `roles/iam.workloadIdentityUser -> principalSet://iam.googleapis.com/${module.wif_pool_github_actions_iac_mcp.name}/attribute.repository/Alliance-Strategies/alliance-gcp-infra` | `ci-terraform-readonly.tf:52` |
| `google_service_account_iam_member.terraform_tf_apply_mcp_wif` | `google_service_account_iam_member` | `roles/iam.workloadIdentityUser -> principalSet://iam.googleapis.com/${module.wif_pool_github_actions_apply_mcp.name}/attribute.repository/Alliance-Strategies/alliance-gcp-infra` | `ci-terraform-apply.tf:126` |
| `google_service_account_iam_member.wordpress_mcp_deploy_can_actas_wordpress_mcp_sa` | `google_service_account_iam_member` | `roles/iam.serviceAccountUser -> serviceAccount:${module.wordpress_mcp_deploy_sa.email}` | `wordpress-mcp.tf:72` |
| `google_service_account_iam_member.wordpress_mcp_deploy_wif` | `google_service_account_iam_member` | `roles/iam.workloadIdentityUser -> principalSet://iam.googleapis.com/${module.wif_pool_github_actions_wordpress_mcp.name}/attribute.repository/Alliance-Strategies/wordpress-mcp` | `wordpress-mcp.tf:103` |
| `google_storage_bucket_iam_member.terraform_ci_viewer_mcp_tfstate_lock` | `google_storage_bucket_iam_member` | `roles/storage.objectUser -> serviceAccount:${module.terraform_ci_viewer_mcp.email}` | `ci-terraform-readonly.tf:65` |
| `module.alliance_mcp_gateway_sa` | `service-account` | `alliance-mcp-gateway-sa` | `main.tf:171` |
| `module.asana_mcp_sa` | `service-account` | `asana-mcp-sa` | `main.tf:219` |
| `module.auth0_mcp_sa` | `service-account` | `auth0-mcp-sa` | `main.tf:229` |
| `module.azure_mcp_sa` | `service-account` | `azure-mcp-sa` | `main.tf:239` |
| `module.development_mcp_aag_sa` | `service-account` | `development-mcp-aag-sa` | `main.tf:480` |
| `module.gateway_deployer_sa` | `service-account` | `gateway-deployer` | `main.tf:184` |
| `module.gcp_connector_deployer_sa` | `service-account` | `gcp-connector-deployer` | `gcp_connector_deploy.tf:38` |
| `module.gcp_mcp_sa` | `service-account` | `gcp-mcp-sa` | `main.tf:253` |
| `module.github_gcp_connector_wif` | `workload-identity-pool` | `github-gcp-connector` | `gcp_connector_deploy.tf:18` |
| `module.github_mcp_sa` | `service-account` | `github-mcp-sa` | `main.tf:269` |
| `module.github_replitmcp_wif` | `workload-identity-pool` | `github-replitmcp` | `main.tf:541` |
| `module.globus_backoffice_mcp_sa` | `service-account` | `globus-backoffice-mcp-sa` | `main.tf:278` |
| `module.globus_mcp_dev_deployer_sa` | `service-account` | `globus-mcp-dev-deployer` | `main.tf:209` |
| `module.globus_mcp_dev_sa` | `service-account` | `globus-mcp-dev-sa` | `main.tf:287` |
| `module.globus_mcp_sa_orphaned` | `service-account` | `globus-mcp-sa` | `main.tf:492` |
| `module.godaddy_mcp_sa` | `service-account` | `godaddy-mcp-sa` | `main.tf:297` |
| `module.godaddy_mcp_server_sa_orphaned` | `service-account` | `godaddy-mcp-server-sa` | `main.tf:503` |
| `module.gws_mcp_sa` | `service-account` | `gws-mcp-sa` | `main.tf:307` |
| `module.hubspot_mcp_sa` | `service-account` | `hubspot-mcp-sa` | `main.tf:316` |
| `module.itrequest_mcp_sa` | `service-account` | `itrequest-mcp-sa` | `itrequest-mcp.tf:38` |
| `module.manus_mcp_sa_orphaned` | `service-account` | `manus-mcp-sa` | `main.tf:516` |
| `module.nexus_hub_sa` | `service-account` | `nexus-hub-sa` | `main.tf:325` |
| `module.onepassword_mcp_sa` | `service-account` | `onepassword-mcp-sa` | `main.tf:353` |
| `module.openstatus_mcp_sa` | `service-account` | `openstatus-mcp-sa` | `main.tf:366` |
| `module.openstatus_mcp_sa_development` | `service-account` | `openstatus-mcp-sa` | `main.tf:392` |
| `module.platform_hub_deploy_sa` | `service-account` | `platform-hub-deploy` | `main.tf:445` |
| `module.platform_hub_sa` | `service-account` | `platform-hub-sa` | `main.tf:431` |
| `module.posthog_mcp_sa` | `service-account` | `posthog-mcp-sa` | `main.tf:404` |
| `module.replitmcp_deploy_sa` | `service-account` | `replitmcp-deploy` | `replitmcp.tf:46` |
| `module.replitmcp_sa` | `service-account` | `replitmcp-sa` | `replitmcp.tf:33` |
| `module.teams_mcp_sa` | `service-account` | `teams-mcp-sa` | `main.tf:413` |
| `module.terraform_ci_viewer_mcp` | `service-account` | `terraform-ci-viewer-mcp` | `ci-terraform-readonly.tf:39` |
| `module.terraform_tf_mcp` | `service-account` | `terraform-tf` | `ci-terraform-apply.tf:73` |
| `module.wif_pool_github_actions_apply_mcp` | `workload-identity-pool` | `github-actions-apply-mcp` | `ci-terraform-apply.tf:103` |
| `module.wif_pool_github_actions_iac_mcp` | `workload-identity-pool` | `github-actions-iac` | `ci-terraform-readonly.tf:17` |
| `module.wif_pool_github_actions_platform_hub` | `workload-identity-pool` | `github-actions-platform-hub` | `main.tf:877` |
| `module.wif_pool_github_actions_replitmcp` | `workload-identity-pool` | `github-actions-replitmcp` | `replitmcp.tf:79` |
| `module.wif_pool_github_actions_wordpress_mcp` | `workload-identity-pool` | `github-actions-wordpress-mcp` | `wordpress-mcp.tf:81` |
| `module.wordpress_mcp_deploy_sa` | `service-account` | `wordpress-mcp-deploy` | `wordpress-mcp.tf:52` |
| `module.wordpress_mcp_sa` | `service-account` | `wordpress-mcp-sa` | `wordpress-mcp.tf:12` |

### Secrets (Secret Manager containers)

17 items.

| Terraform address | Module or resource type | Identifier | Defined in |
| --- | --- | --- | --- |
| `module.alliance_mcp_gateway_secrets` | `secret-manager-secret-bulk` | `12 items: alliance-mcp-gateway-db-url, mcp-gateway-cred-enc-key, mcp-gateway-oauth-outlook-client-id, ...` | `main.tf:632` |
| `module.auth0_mcp_secrets` | `secret-manager-secret-bulk` | `5 items: auth0-mcp-domain, auth0-mcp-mgmt-client-id, auth0-mcp-mgmt-client-secret, ...` | `main.tf:571` |
| `module.azure_mcp_secrets` | `secret-manager-secret-bulk` | `4 items: azure-mcp-api-key, azure-mcp-admin-tenant-id, azure-mcp-admin-client-id, ...` | `main.tf:583` |
| `module.gateway_extra_secrets` | `secret-manager-secret-bulk` | `2 items: globus-development-asana-alliance-api-key, mcp-development-api-key` | `main.tf:608` |
| `module.gcp_mcp_secrets` | `secret-manager-secret-bulk` | `mcp-api-key` | `main.tf:594` |
| `module.github_mcp_secrets` | `secret-manager-secret-bulk` | `2 items: github-mcp-app-key, mcp-gateway-github-token` | `main.tf:617` |
| `module.globus_backoffice_mcp_secrets` | `secret-manager-secret-bulk` | `2 items: globus-mcp-service-api-key, globus-backoffice-mcp-app-key` | `main.tf:651` |
| `module.globus_mcp_development_secrets` | `secret-manager-secret-bulk` | `38 items: mcp-development-database-url, mcp-development-api-key, mcp-development-warp-api-key, ...` | `main.tf:660` |
| `module.godaddy_mcp_secrets` | `secret-manager-secret-bulk` | `2 items: godaddy-api-key, godaddy-api-secret` | `main.tf:709` |
| `module.itrequest_mcp_secrets` | `secret-manager-secret-bulk` | `itrequest-gateway-api-key` | `itrequest-mcp.tf:48` |
| `module.nexus_hub_mcp_secrets` | `secret-manager-secret-bulk` | `12 items: nexus-session-secret, nexus-entra-tenant-id, nexus-entra-client-id, ...` | `main.tf:721` |
| `module.onepassword_mcp_secrets` | `secret-manager-secret-bulk` | `2 items: 1password-mcp-api-key, 1password-mcp-service-account-token` | `main.tf:746` |
| `module.openstatus_mcp_secrets` | `secret-manager-secret-bulk` | `openstatus-mcp-api-key` | `main.tf:755` |
| `module.orphaned_legacy_secrets` | `secret-manager-secret-bulk` | `25 items: manus-mcp-api-key, manus-mcp-server-api-key, godaddy-mcp-server-api-key, ...` | `main.tf:828` |
| `module.platform_hub_secrets` | `secret-manager-secret-bulk` | `2 items: platform-hub-mcp-github-token, platformhub-mcp-api-key` | `main.tf:786` |
| `module.teams_mcp_secrets` | `secret-manager-secret-bulk` | `9 items: teams-client-id, teams-client-secret, teams-tenant-id, ...` | `main.tf:763` |
| `module.wordpress_mcp_secrets` | `secret-manager-secret-bulk` | `2 items: wordpress-mcp-api-key, wordpress-mcp-app-password` | `wordpress-mcp.tf:22` |

### Compute (Cloud Run, GKE, jobs, schedulers)

20 items.

| Terraform address | Module or resource type | Identifier | Defined in |
| --- | --- | --- | --- |
| `google_cloud_run_service.alliance_mcp_gateway` | `google_cloud_run_service` | `alliance-mcp-gateway` | `main.tf:921` |
| `google_cloud_run_service.alliance_mcp_gateway_admin` | `google_cloud_run_service` | `alliance-mcp-gateway-admin` | `main.tf:1456` |
| `google_cloud_run_service.auth0_mcp_server` | `google_cloud_run_service` | `auth0-mcp-server` | `main.tf:1582` |
| `google_cloud_run_service.azure_mcp` | `google_cloud_run_service` | `azure-mcp` | `main.tf:1720` |
| `google_cloud_run_service.gcp_mcp_server` | `google_cloud_run_service` | `gcp-mcp-server` | `main.tf:1841` |
| `google_cloud_run_service.github_mcp` | `google_cloud_run_service` | `github-mcp` | `main.tf:1965` |
| `google_cloud_run_service.globus_backoffice_mcp` | `google_cloud_run_service` | `globus-backoffice-mcp` | `main.tf:2072` |
| `google_cloud_run_service.godaddy_mcp` | `google_cloud_run_service` | `godaddy-mcp` | `main.tf:2245` |
| `google_cloud_run_service.google_workspace_mcp` | `google_cloud_run_service` | `google-workspace-mcp` | `main.tf:2350` |
| `google_cloud_run_service.hubspot_mcp` | `google_cloud_run_service` | `hubspot-mcp` | `main.tf:2473` |
| `google_cloud_run_service.nexus_hub_mcp` | `google_cloud_run_service` | `nexus-hub` | `main.tf:2571` |
| `google_cloud_run_service.onepassword_mcp` | `google_cloud_run_service` | `onepassword-mcp` | `main.tf:2791` |
| `google_cloud_run_service.openstatus_mcp` | `google_cloud_run_service` | `openstatus-mcp` | `main.tf:2895` |
| `google_cloud_run_service.outlook_mcp` | `google_cloud_run_service` | `outlook-mcp` | `main.tf:3001` |
| `google_cloud_run_service.platform_hub` | `google_cloud_run_service` | `platform-hub` | `main.tf:3553` |
| `google_cloud_run_service.posthog_mcp` | `google_cloud_run_service` | `posthog-mcp` | `main.tf:3086` |
| `google_cloud_run_service.teams_mcp` | `google_cloud_run_service` | `teams-mcp` | `main.tf:3192` |
| `google_cloud_run_service.teams_mcp_bot` | `google_cloud_run_service` | `teams-mcp-bot` | `main.tf:3382` |
| `module.asana_mcp` | `cloud-run-service` | `asana-mcp` | `main.tf:1539` |
| `module.globus_mcp_development` | `cloud-run-service` | `globus-mcp-development` | `main.tf:2179` |

### Data stores (Cloud SQL, Redis, Firestore, Cloud Storage)

1 item.

| Terraform address | Module or resource type | Identifier | Defined in |
| --- | --- | --- | --- |
| `module.alliance_mcp_gateway_db` | `cloud-sql-postgres` | `alliance-mcp-gateway-db` | `main.tf:142` |

### Networking and load balancing

1 item.

| Terraform address | Module or resource type | Identifier | Defined in |
| --- | --- | --- | --- |
| `module.mcp_gateway_lb` | `load-balancer-https-multihost` |  | `main.tf:3691` |

### Build, registry and delivery

4 items.

| Terraform address | Module or resource type | Identifier | Defined in |
| --- | --- | --- | --- |
| `module.ar_alliance_mcp_gateway` | `artifact-registry` | `alliance-mcp-gateway` | `main.tf:110` |
| `module.ar_globus_mcp` | `artifact-registry` | `globus-mcp` | `main.tf:132` |
| `module.ar_platform_hub` | `artifact-registry` | `platform-hub` | `main.tf:121` |
| `module.replitmcp_ar` | `artifact-registry` | `replitmcp` | `replitmcp.tf:25` |

## Live state

### Terraform compared with live state

| Resource type | Live | In Terraform | Matched | Live only (unmanaged) | Platform-created | Terraform only | Name not resolvable |
| --- | --- | --- | --- | --- | --- | --- | --- |
| `api` | 49 | 0 | 0 | 49 | 0 | 0 | 0 |
| `cloud_run_service` | 23 | 20 | 20 | 3 | 0 | 0 | 0 |
| `cloud_run_job` | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| `secret` | 119 | 122 | 103 | 16 | 0 | 0 | 0 |
| `service_account` | 34 | 33 | 32 | 1 | 1 | 0 | 0 |
| `cloudbuild_trigger` | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| `gke_cluster` | 1 | 0 | 0 | 1 | 0 | 0 | 0 |
| `domain_mapping` | 1 | 0 | 0 | 1 | 0 | 0 | 0 |
| `firewall_rule` | 6 | 0 | 0 | 0 | 6 | 0 | 0 |
| `vpc_network` | 1 | 0 | 0 | 0 | 1 | 0 | 0 |

### Live but not in Terraform

71 resources of the compared types exist in the project without a matching Terraform declaration.

| Resource type | Name |
| --- | --- |
| `api` | `analyticsadmin` |
| `api` | `analyticsdata` |
| `api` | `analyticshub` |
| `api` | `artifactregistry` |
| `api` | `autoscaling` |
| `api` | `bigquery` |
| `api` | `bigqueryconnection` |
| `api` | `bigquerydatapolicy` |
| `api` | `bigquerydatatransfer` |
| `api` | `bigquerymigration` |
| `api` | `bigqueryreservation` |
| `api` | `bigquerystorage` |
| `api` | `binaryauthorization` |
| `api` | `cloudapis` |
| `api` | `cloudbilling` |
| `api` | `cloudbuild` |
| `api` | `cloudresourcemanager` |
| `api` | `cloudshell` |
| `api` | `cloudtrace` |
| `api` | `compute` |
| `api` | `container` |
| `api` | `containeranalysis` |
| `api` | `containerfilesystem` |
| `api` | `containerregistry` |
| `api` | `dataform` |
| `api` | `dataplex` |
| `api` | `datastore` |
| `api` | `dns` |
| `api` | `file` |
| `api` | `gkebackup` |
| `api` | `iam` |
| `api` | `iamcredentials` |
| `api` | `iap` |
| `api` | `logging` |
| `api` | `monitoring` |
| `api` | `networkconnectivity` |
| `api` | `orgpolicy` |
| `api` | `oslogin` |
| `api` | `pubsub` |
| `api` | `run` |
| `api` | `secretmanager` |
| `api` | `servicemanagement` |
| `api` | `serviceusage` |
| `api` | `sql-component` |
| `api` | `sqladmin` |
| `api` | `storage` |
| `api` | `storage-api` |
| `api` | `storage-component` |
| `api` | `telemetry` |
| `cloud_run_service` | `itrequest-mcp` |
| `cloud_run_service` | `replitmcp` |
| `cloud_run_service` | `wordpress-mcp` |
| `secret` | `auth0-mcp-hostportal-dev-audience` |
| `secret` | `auth0-mcp-hostportal-dev-client-id` |
| `secret` | `auth0-mcp-hostportal-dev-client-secret` |
| `secret` | `auth0-mcp-hostportal-dev-domain` |
| `secret` | `auth0-mcp-hostportal-qa-audience` |
| `secret` | `auth0-mcp-hostportal-qa-client-id` |
| `secret` | `auth0-mcp-hostportal-qa-client-secret` |
| `secret` | `auth0-mcp-hostportal-qa-domain` |
| `secret` | `domain-admin-sa-key` |
| `secret` | `google-workspace-mcp-admin` |
| `secret` | `google-workspace-mcp-domain` |
| `secret` | `google-workspace-mcp-sa-key` |
| `secret` | `mcp-gateway-oauth-asana-client-id` |
| `secret` | `mcp-gateway-oauth-asana-client-secret` |
| `secret` | `mcp-gateway-skill-directive-signing-key` |
| `secret` | `posthog-mcp-personal-api-key` |
| `service_account` | `openstatus-mcp-deploy` |
| `gke_cluster` | `openstatus-cluster` |
| `domain_mapping` | `teams-mcp.mcp.allianceabroad.com` |

### In Terraform but not found live

_None._

### Created by GCP or GKE

These are created by the platform itself (default network rules, GKE firewall rules, default compute service accounts, Cloud Build buckets, container analysis topics) and are not drift.

| Resource type | Name |
| --- | --- |
| `service_account` | `627350954379-compute` |
| `firewall_rule` | `default-allow-internal` |
| `firewall_rule` | `gke-openstatus-cluster-e2bda491-all` |
| `firewall_rule` | `gke-openstatus-cluster-e2bda491-exkubelet` |
| `firewall_rule` | `gke-openstatus-cluster-e2bda491-inkubelet` |
| `firewall_rule` | `gke-openstatus-cluster-e2bda491-vms` |
| `firewall_rule` | `k8s-fw-l7--e0f2d94e66fa6a36` |
| `vpc_network` | `default` |

### Resource types not compared

| Resource type | Reason | Declared in Terraform |
| --- | --- | --- |
| `cloud_sql` | snapshot section unreadable (denied, API disabled or not collected) | 1 |
| `redis` | snapshot section unreadable (denied, API disabled or not collected) | 0 |
| `firestore` | snapshot section unreadable (denied, API disabled or not collected) | 0 |
| `bucket` | snapshot section unreadable (denied, API disabled or not collected) | 0 |
| `wif_pool` | snapshot section unreadable (denied, API disabled or not collected) | 7 |
| `artifact_registry` | snapshot section unreadable (denied, API disabled or not collected) | 4 |
| `pubsub_topic` | snapshot section unreadable (denied, API disabled or not collected) | 0 |
| `scheduler_job` | snapshot section unreadable (denied, API disabled or not collected) | 0 |

### Live reads that were denied or unavailable

| Read attempted | Result |
| --- | --- |
| gcloud projects get-iam-policy (project IAM bindings) | does not have permission to access projects instance [alliance-mcp-services:getIamPolicy] |
| gcloud iam workload-identity-pools list | PERMISSION_DENIED iam.workloadIdentityPools.list |
| gcloud sql instances list / databases list | The client is not authorized to make this request (sqladmin enabled; dev env token lacks access) |
| gcloud storage buckets list | 403 manus-agent-sa@skilled-script-469819-f2 lacks storage.buckets.list on project |
| gcloud artifacts repositories list | artifactregistry.locations.list denied |
| gcloud builds triggers list | PERMISSION_DENIED |
| gcloud builds connections list (northamerica-northeast1, us-central1) | cloudbuild.connections.list denied |
| gcloud pubsub topics list / subscriptions list | pubsub.topics.list / pubsub.subscriptions.list denied (pubsub API enabled) |
| gcloud dns managed-zones list | Forbidden (dns API enabled) |
| gcloud services api-keys list | apikeys.keys.list denied |
| gcloud iap settings get | iap.projects.getSettings denied |
| gcloud redis instances list | redis.googleapis.com not enabled (no Redis) |
| gcloud firestore databases list | firestore.googleapis.com not enabled (datastore.googleapis.com is enabled; not checked) |
| gcloud scheduler jobs list | cloudscheduler.googleapis.com not enabled |
| VPC access connectors | vpcaccess.googleapis.com not enabled (none exist) |
| Cloud Deploy / Certificate Manager | clouddeploy.googleapis.com / certificatemanager.googleapis.com not enabled |
| gcloud projects describe / most calls via environment=prod and agents | prod env token: no permission on alliance-mcp-services; agents env: backend request failed. All successful reads used environment=development. |
| gcloud run jobs list | returned [] (no error) |

### Collection notes

Caveats recorded when the live snapshot was read.

- alliance-mcp-services is not a selectable gateway environment; all reads were made with environment=development, whose token (manus-agent-sa@skilled-script-469819-f2) has partial read access to this project.
- Only read-only list/describe commands were run. No secret values accessed.
- Cloud Run: 24 services; 3 in northamerica-northeast1 (gateway, admin, itrequest-mcp), rest us-central1. Several images pull from the skilled-script-469819-f2 (dev) Artifact Registry.
- Secret-backed env 'HUBSPOT_TOKEN' in hubspot-mcp references secret wildp-1efe771b-76e7-11f1-95a0-9c65eb2e83c5 which is absent from the project's Secret Manager list.
- Secret names mcp-production-* exist in this project alongside mcp-development-*; MCP servers should be non-environment-specific.
- platform-hub-neg exists in both NE1 and us-central1 but the platform-hub service is us-central1 only.
- domain mapping teams-mcp.mcp.allianceabroad.com has Ready condition False.
- openstatus runs on GKE Autopilot cluster openstatus-cluster in this project (kubectl not used).
- Subnet list was truncated at 20 rows of the auto-mode default network.
- Firewall list: exkubelet rule shows source 0.0.0.0/0 with no allowed protocols returned (GKE-managed).
- cloud_sql, redis, firestore, buckets, iam_bindings, wif_pools, artifact_registry, pubsub, dns, api_keys, scheduler set to null because unreadable or API disabled (see denied).

## Live inventory

Selected stable attributes read from the running project.

### Cloud Run services (live)

| Service | Region | Ingress | Scaling | Runs as |
| --- | --- | --- | --- | --- |
| `alliance-mcp-gateway` | `northamerica-northeast1` | `all` | `1-1` | `alliance-mcp-gateway-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `alliance-mcp-gateway-admin` | `northamerica-northeast1` | `all` | `0-3` | `627350954379-compute@developer.gserviceaccount.com` |
| `asana-mcp` | `us-central1` | `all` | `0-3` | `asana-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `auth0-mcp-server` | `us-central1` | `all` | `0-20` | `auth0-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `azure-mcp` | `us-central1` | `all` | `0-3` | `azure-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `gcp-mcp-server` | `us-central1` | `all` | `1-10` | `gcp-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `github-mcp` | `us-central1` | `all` | `0-3` | `github-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `globus-backoffice-mcp` | `us-central1` | `all` | `0-3` | `globus-backoffice-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `globus-mcp-development` | `us-central1` | `all` | `1-5` | `globus-mcp-dev-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `godaddy-mcp` | `us-central1` | `all` | `0-10` | `godaddy-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `google-workspace-mcp` | `us-central1` | `all` | `0-3` | `gws-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `hubspot-mcp` | `us-central1` | `all` | `0-3` | `hubspot-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `itrequest-mcp` | `northamerica-northeast1` | `all` | `0-?` | `itrequest-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `nexus-hub` | `us-central1` | `all` | `1-5` | `nexus-hub-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `onepassword-mcp` | `us-central1` | `all` | `0-10` | `onepassword-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `openstatus-mcp` | `us-central1` | `all` | `0-10` | `openstatus-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `outlook-mcp` | `us-central1` | `all` | `0-3` | `627350954379-compute@developer.gserviceaccount.com` |
| `platform-hub` | `us-central1` | `internal-and-cloud-load-balancing` | `1-3` | `platform-hub-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `posthog-mcp` | `us-central1` | `all` | `0-3` | `posthog-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `replitmcp` | `us-central1` | `all` | `0-2` | `globus-mcp-dev-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `teams-mcp` | `us-central1` | `all` | `1-20` | `teams-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `teams-mcp-bot` | `us-central1` | `all` | `0-2` | `teams-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `wordpress-mcp` | `us-central1` | `all` | `0-10` | `wordpress-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |

## Known gaps

- Gateway access was limited to the development, qa, prod and agents environments. `alliance-mcp-services` was read through a development-environment token (`manus-agent-sa`) with many sections denied.
- Not compared: Cloud SQL, WIF pools, Artifact Registry, buckets, Pub/Sub, Scheduler, project IAM bindings, IAP settings, DNS zones and API keys. Anything declared in those areas (for example 7 WIF pools, 4 Artifact Registry repos, 1 Cloud SQL instance) is unconfirmed live.
- Redis, Firestore, Scheduler, VPC connectors, Cloud Deploy and Certificate Manager are not enabled in the project.
- Live `hubspot-mcp` references secret `wildp-1efe771b-76e7-11f1-95a0-9c65eb2e83c5` that is not in the Secret Manager list (possibly a cross-project path or a stale reference).
- `platform-hub-neg` exists in both regions while the service exists only in `us-central1`.
- The live URL map `mcp-lb` already contains the `platform.allianceabroad.com` host and the HTTPS proxy references `platform-hub-cert`; the certificate's provisioning status and DNS were not checked.