diff --git a/terraform/data.tf b/terraform/data.tf
index 1b16222..0733a3f 100644
--- a/terraform/data.tf
+++ b/terraform/data.tf
@@ -30,3 +30,13 @@ data "aws_ssm_parameter" "app_web_acl_arn" {
 data "aws_ssm_parameter" "google_client_id" {
   name = local.google_client_id_param
 }
+
+# Fail closed if the OOB Google client ID parameter is missing or empty. The
+# functions receive the parameter NAME via env; this check forces the data
+# source to be evaluated so apply cannot succeed without the parameter.
+check "google_client_id_present" {
+  assert {
+    condition     = length(data.aws_ssm_parameter.google_client_id.value) > 0
+    error_message = "SSM parameter ${local.google_client_id_param} is missing or empty; create it out of band before apply."
+  }
+}