[K9VULN-10951] feat(agentless-gcp): add destroy command, multi-region support and security hardening

[mohamed-challal]

Summary

This PR adds several improvements to the agentless GCP Cloud Shell setup wizard: CLI verbs, destroy command, multi-region support, security hardening, and performance optimizations.

All the details of the initiative are available in this RFC.

Changes

CLI Commands

• Added deploy / destroy / help verbs for better UX and future extensibility
• Implemented destroy command with interactive cleanup prompts (API key secret deletion)

Multi-Region Support

• SCANNER_REGIONS now accepts comma-separated list (max 4 regions)
• Deploys VPC and scanner in each specified region
• Shortened VPC names to dd-agentless-{region} to avoid GCP 63-char limit

Security Hardening

• GCS state bucket: Added public access prevention (--pap), regional storage and versioning
• Secret Manager: API key now stored in Secret Manager to remove it from the TF state

Performance

• Parallelized project access checks and API enablement (10 workers)
• Added TERRAFORM_PARALLELISM = 10 constant
• API key validation: Fail early if API key is invalid
• Incremental build in build.sh (skips rebuild if no source changes)
• Display progress bar for terraform apply

Commands & Environment Variables (updated)

Variable	Description
SCANNER_REGIONS	Comma-separated list of regions (was GCP_REGION)
TF_STATE_BUCKET	Renamed (was GCP_STATE_BUCKET)
SCANNER_PROJECT	Renamed (was GCP_SCANNER_PROJECT)
PROJECTS_TO_SCAN	Renamed (was GCP_PROJECTS_TO_SCAN)

Deploy

curl -sSL "https://raw.githubusercontent.com/DataDog/integrations-management/main/gcp/agentless/dist/gcp_agentless_setup.pyz" -o gcp_agentless_setup.pyz && DD_API_KEY="xxx" DD_APP_KEY="xxx" DD_SITE="datadoghq.com" SCANNER_PROJECT="my-project" SCANNER_REGIONS="us-central1" PROJECTS_TO_SCAN="my-project" python3 gcp_agentless_setup.pyz deploy

Destroy

python3 gcp_agentless_setup.pyz destroy

Next Steps

• Integrate with Status Workflow API to track deployment progress and enable UI polling for completion status

[tedkahwaji]

Changes under gcp/shared LGTM 👍

[mohamed-challal]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-01-23 13:57:46 UTC ℹ️ Start processing command /merge

---

2026-01-23 13:57:52 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 0s (p90).

---

2026-01-23 14:44:58 UTC ℹ️ MergeQueue: Retrying because an high priority merge request needed to be processed first. No action is needed from your side.

---

2026-01-23 14:45:05 UTC ⚠️ MergeQueue: This merge request build was cancelled

mohamed.challal@datadoghq.com cancelled this merge request build

[mohamed-challal]

/remove

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-01-23 14:44:41 UTC ℹ️ Start processing command /remove

---

2026-01-23 14:45:02 UTC ℹ️ Devflow: /remove