Working with Google Cloud Provider

1. Configuring GCP Provider

Property	Values	Description
credentials	`string`	Path to the JSON credentials file. Can also be set via `GOOGLE_CREDENTIALS` environment variable.
project	`string`	GCP project ID to use. Can also be set via `GOOGLE_PROJECT` environment variable.
region	`string`	Default region for GCP resources. Can also be set via `GOOGLE_REGION` environment variable.
zone	`string`	Default zone for GCP resources. Can also be set via `GOOGLE_ZONE` environment variable.
access_token	`string`	Access token for GCP API. Used when `credentials` is not provided.
impersonate_service_account	`string`	Service account to impersonate for GCP operations.

Example: Basic GCP Provider Configuration

provider "google" {
  credentials = "/path/to/service-account.json"
  project     = "my-gcp-project"
  region      = "us-central1"
}

Example: Using Environment Variables

provider "google" {
  project = "my-gcp-project"
  region  = "us-central1"
}

Note: Ensure the credentials file has appropriate permissions and the service account has required roles for Terraform operations.

2. Using GCP Authentication

Method	Description	Configuration	Notes
Service Account Key File	Use a JSON key file for service account authentication.	`{<br> "credentials": "/path/to/service-account-key.json"<br>}`	Requires `GOOGLE_CREDENTIALS` environment variable or `credentials` in provider config.
Application Default Credentials (ADC)	Use ADC provided by Google Cloud SDK or gcloud CLI.	`{<br> "project": "my-gcp-project"<br>}`	Automatically picked up from `gcloud auth application-default login`.
Workload Identity (for GKE/GCE)	Use Kubernetes service account with IAM bindings to impersonate GCP service accounts.	`{<br> "project": "my-gcp-project"<br>}`	Requires GKE or Compute Engine with Workload Identity enabled.
OAuth2 Token	Use an OAuth2 access token from a refresh token or CLI.	`{<br> "access_token": "<oauth2-token>"<br>}`	Not recommended for production due to token expiration.

Example: Service Account Key File Authentication

provider "google" {<br>  credentials = file("/path/to/service-account-key.json")<br>  project     = "my-gcp-project"<br>}

Example: Using ADC with gcloud

gcloud auth application-default login

provider "google" {<br>  project = "my-gcp-project"<br>}

Note: Ensure that the service account has appropriate IAM roles assigned to it for Terraform operations (e.g., roles/compute.admin, roles/iam.serviceAccountTokenCreator).

3. Managing GCP Resources

Resource Type	Identifier	Description	Notes
google_compute_instance	`google_compute_instance.my_instance`	Creates a Compute Engine instance	Supports various machine types and zones
google_storage_bucket	`google_storage_bucket.my_bucket`	Creates a Cloud Storage bucket	Supports lifecycle rules and versioning
google_sql_database_instance	`google_sql_database_instance.my_db`	Creates a Cloud SQL instance	Supports MySQL, PostgreSQL, and SQL Server
google_container_cluster	`google_container_cluster.my_cluster`	Creates a GKE cluster	Supports node pools and autoscaling

Example: Creating a Compute Instance

resource "google_compute_instance" "my_instance" {
  name         = "my-instance"
  machine_type = "n1-standard-1"
  zone         = "us-central1-a"

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }

  network_interface {
    network = "default"

    access_config {
      // Ephemeral public IP
    }
  }
}

Example: Creating a Storage Bucket

resource "google_storage_bucket" "my_bucket" {
  name          = "my-unique-bucket-name"
  location      = "US"
  force_destroy = true

  lifecycle_rule {
    condition {
      age = 30
    }
    action {
      type = "Delete"
    }
  }

  versioning {
    enabled = true
  }
}

Note: Ensure that the service account used has appropriate IAM permissions to manage GCP resources.

Warning: Setting force_destroy = true on a bucket can lead to data loss if not handled carefully.

4. Using GCP Data Sources

DataSource	Arguments	Description
google_compute_image	`name`, `project`	Retrieve information about a GCP Compute Image
google_compute_network	`name`, `project`	Retrieve information about a GCP Compute Network
google_compute_subnetwork	`name`, `project`, `region`	Retrieve information about a GCP Compute Subnetwork
google_container_cluster	`name`, `project`, `region`	Retrieve information about a GCP Container Cluster
google_project	`project_id`	Retrieve information about a GCP Project
google_storage_bucket	`name`, `project`	Retrieve information about a GCP Storage Bucket

Example: Retrieve GCP Compute Image

data "google_compute_image" "my_image" {
  name = "debian-11"
  project = "my-project"
}

output "image_self_link" {
  value = data.google_compute_image.my_image.self_link
}

Example: Retrieve GCP Compute Network

data "google_compute_network" "my_network" {
  name = "default"
  project = "my-project"
}

output "network_self_link" {
  value = data.google_compute_network.my_network.self_link
}

Example: Retrieve GCP Container Cluster

data "google_container_cluster" "my_cluster" {
  name = "my-cluster"
  project = "my-project"
  region = "us-central1"
}

output "cluster_endpoint" {
  value = data.google_container_cluster.my_cluster.endpoint
}

5. Configuring Multiple Projects

Property	Description	Example
google_project_id	Project ID for the GCP project to use	`"my-project-123"`
google_organization_id	Organization ID for GCP organization	`"123456789"`
google_folder_id	Folder ID to organize projects under	`"folders/987654321"`

Example: Multiple Projects Configuration

provider "google" {
  project = "my-project-123"
  region  = "us-central1"
}

provider "google" {
  alias   = "project2"
  project = "my-project-456"
  region  = "us-west1"
}

Note: When using multiple providers, ensure each provider has a unique alias to avoid conflicts.

Key Points

Each project requires its own provider block with unique project ID.
Use alias to differentiate between providers in the same configuration.
Ensure proper IAM permissions for each project to allow Terraform operations.

6. Managing GCP Labels

Property	Description	Example
labels	Map of key-value pairs to apply as labels to resources	`labels = { environment = "production" team = "backend" }`

Example: Applying Labels to GCP Compute Instance

resource "google_compute_instance" "web_server" {
  name        = "web-server"
  machine_type = "e2-medium"
  labels = {
    environment = "production"
    team        = "backend"
    project     = "myapp"
  }
}

Note: GCP labels are key-value pairs that help organize and manage resources. They are not enforced by Terraform but are applied to GCP resources during creation or update.

Warning: Labels are not automatically inherited by child resources. Each resource must explicitly define its own labels.

7. Using GCP-Specific Features

Feature	Description	Usage	Notes
google_compute_instance	Creates a Compute Engine instance	`resource "google_compute_instance" "web" { name = "web-instance" machine_type = "e2-medium" zone = "us-central1-a" boot_disk { initialize_params { image = "debian-cloud/debian-11" } } network_interface { network = "default" access_config {} } }`	Supports GCP-specific machine types and zones
google_storage_bucket	Creates a Cloud Storage bucket	`resource "google_storage_bucket" "my-bucket" { name = "my-unique-bucket" location = "US" storage_class = "STANDARD" }`	Supports lifecycle rules and versioning
google_cloud_run_service	Deploys a Cloud Run service	`resource "google_cloud_run_service" "default" { name = "my-service" location = "us-central1" template { spec { containers { image = "gcr.io/my-project/my-service" } } } traffic { percent = 100 latest_revision = true } }`	Requires Cloud Run API enabled
google_sql_database_instance	Creates a Cloud SQL instance	`resource "google_sql_database_instance" "main" { name = "my-db-instance" database_version = "POSTGRES_14" region = "us-central1" settings { tier = "db-f1-micro" } }`	Supports various database engines (MySQL, PostgreSQL, SQL Server)

Example: Using GCP Service Account for Terraform

resource "google_service_account" "terraform" {
  project    = "my-project"
  account_id = "terraform"
}

resource "google_project_iam_member" "terraform" {
  project = "my-project"
  role    = "roles/editor"
  member  = google_service_account.terraform.member
}

Note: Ensure the GCP project has required APIs enabled (e.g., Compute Engine, Cloud Storage, Cloud Run) before applying configurations.

8. Configuring GCS Backend

Option	Values	Description
bucket	`string`	Name of the GCS bucket to use for state storage
prefix	`string`	Prefix for state files within the bucket
credentials	`string`	Path to service account key file (optional if using default credentials)
project	`string`	GCP project ID (optional, defaults to the project in credentials)
region	`string`	GCP region (optional, defaults to us-central1)
encryption_key	`string`	Customer-supplied encryption key (optional)

Example: GCS Backend Configuration

terraform {
  backend "gcs" {
    bucket = "my-terraform-state-bucket"
    prefix = "prod/"
    credentials = "/path/to/service-account.json"
    project = "my-gcp-project"
    region = "us-central1"
  }
}

Note: Ensure the service account has Storage Object Creator and Storage Object Viewer permissions for the bucket.

Warning: GCS backend is not suitable for highly concurrent operations without proper locking. Consider enabling lock support via a separate mechanism.

9. Using Google Secret Manager

Argument	Description	Example
name	The name of the secret	`my-secret`
project	The project ID where the secret is stored	`my-gcp-project`
description	Description of the secret (optional)	`Secret for database credentials`

Example: Create a Secret

resource "google_secret_manager_secret" "my_secret" {
  secret_id = "my-secret"
  project   = "my-gcp-project"
  labels = {
    env = "prod"
  }
}

Example: Add a Secret Version

resource "google_secret_manager_secret_version" "my_secret_version" {
  secret = google_secret_manager_secret.my_secret.name
  secret_data = "my-sensitive-data"
}

Example: Access Secret in a Cloud Function

data "google_secret_manager_secret_version" "my_secret_version" {
  secret = "my-secret"
  project = "my-gcp-project"
}

resource "google_cloudfunctions_function" "my_function" {
  name = "my-function"
  project = "my-gcp-project"
  runtime = "nodejs18"

  available_memory_mb = 128
  source_archive_bucket = "my-bucket"
  source_archive_object = "function.zip"

  environment_variables = {
    SECRET_VALUE = data.google_secret_manager_secret_version.my_secret_version.secret_data
  }
}

Note: Ensure that the service account running your Terraform has the secretmanager.secrets.get and secretmanager.secrets.create permissions.

10. Handling GCP API Quotas

Resource	Quota Type	Default Limit	Notes
google_compute_instance	Compute Engine API	200 instances	Can be increased via GCP Support
google_storage_bucket	Storage API	100 buckets	Quota can be requested for increase
google_sql_database_instance	Cloud SQL API	50 instances	Higher limits available with billing account

Example: Checking API Quota Usage

gcloud services list --project=<PROJECT_ID>

Note: Use gcloud or the GCP Console to monitor and request quota increases for services.

Warning: Exceeding quotas can cause Terraform apply to fail with 429 Too Many Requests errors.