terraform-gcp

Terraform — GCP

Infrastructure as Code for Google Cloud using the official Terraform provider and Cloud Foundation Toolkit (CFT).

Safety Rule — Plan Before Apply

# Always plan first
terraform plan -out=tfplan

# Review the plan — look for unexpected destroys
# Only apply after confirming no unexpected changes
terraform apply tfplan

Provider Setup

terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 6.0"
    }
  }
  backend "gcs" {
    bucket = "PROJECT_ID-tfstate"
    prefix = "env/prod"
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

CFT Module Usage (recommended over writing from scratch)

# Example: GKE cluster via CFT module
module "gke" {
  source  = "terraform-google-modules/kubernetes-engine/google//modules/autopilot-cluster"
  version = "~> 33.0"

  project_id = var.project_id
  name       = "my-cluster"
  region     = var.region
  network    = module.vpc.network_name
  subnetwork = module.vpc.subnets_names[0]
}

State Management

• State in GCS bucket (not local, not git)
• One state file per environment (env/dev, env/staging, env/prod)
• Bucket versioning enabled for state rollback
• State lock via GCS object versioning (built in to google backend)

Module Structure (project convention)

infra/
├── modules/           # Reusable modules
│   └── service/
│       ├── main.tf
│       ├── variables.tf
│       └── outputs.tf
├── environments/
│   ├── dev/
│   │   ├── main.tf    # Calls modules
│   │   └── terraform.tfvars
│   └── prod/
│       ├── main.tf
│       └── terraform.tfvars
└── backend.tf

References

• Cloud Foundation Toolkit
• Terraform Google Provider
• CFT GitHub
• terraform-google-modules
• GCP Security Foundations Blueprint