google-cicd-terraform

Terraform GCP Skill

This skill provides expert-level guidance for architecting, deploying, and managing GCP infrastructure using Terraform.

🎯 When to Use This Skill

• Designing GCP Landing Zones (Projects, Folders, Shared VPCs).
• Provisioning Google Cloud resources (GKE, Cloud Run, Cloud SQL, Spanner).
• Setting up remote state management via GCS Backend.
• Implementing IAM least-privilege via Terraform.
• Troubleshooting terraform plan discrepancies in GCP.

🏗️ Core Architecture: GCS Backend & State

Always use a GCS backend for state. Local state is strictly for local prototyping and must never be committed. If local state direcotry is used, add it to .gitignore.

Standard Backend Configuration

terraform {
  backend "gcs" {
    bucket  = "tf-state-${var.project_id}"
    prefix  = "terraform/state/${var.environment}"
  }
}

Note: The GCS bucket must have Object Versioning enabled to allow recovery from accidental state corruption or overlapping writes.

Required Provider Version

Use the Google Cloud Terraform provider version 7.20.0 or higher. This skill utilizes features (e.g., Developer Connect) introduced in Google Provider v7.20.0.

terraform {
  required_version = ">= 1.6.0"

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = ">= 7.20.0" 
    }
  }
}

To retrieve the latest version of the Google provider, use the following command:

curl -s https://registry.terraform.io/v1/providers/hashicorp/google | jq -r .version

🛠️ Execution Protocol (Safety First)

The Agent must follow this lifecycle for every infrastructure change to ensure idempotency and prevent production outages:

1. Initialize (terraform init):

   • Verify backend connectivity.

   • Ensure provider plugins are downloaded and versions are locked in .terraform.lock.hcl.

2. Validate (terraform validate & tflint):

   • Check for internal HCL consistency.

   • Run tflint with the Google plugin to catch cloud-specific deprecated fields or non-optimal configurations.