819894d2ba
* IAM modules refactor proposal * policy * subheading * Update 20230816-iam-refactor.md * log Julio's +1 * data-catalog-policy-tag * dataproc * dataproc * folder * folder * folder * folder * project * better filtering in test examples * project * folder * folder * organization * fix variable descriptions * kms * net-vpc * dataplex-datascan * modules/iam-service-account * modules/source-repository/ * blueprints/cloud-operations/vm-migration/ * blueprints/third-party-solutions/wordpress * dataplex-datascan * blueprints/cloud-operations/workload-identity-federation * blueprints/data-solutions/cloudsql-multiregion/ * blueprints/data-solutions/composer-2 * Update 20230816-iam-refactor.md * Update 20230816-iam-refactor.md * capture discussion in architectural doc * update variable names and refactor proposal * project * blueprints first round * folder * organization * data-catalog-policy-tag * re-enable folder inventory * project module style fix * dataproc * source-repository * source-repository tests * dataplex-datascan * dataplex-datascan tests * net-vpc * net-vpc test examples * iam-service-account * iam-service-account test examples * kms * boilerplate * tfdoc * fix module tests * more blueprint fixes * fix typo in data blueprints * incomplete refactor of data platform foundations * tfdoc * data platform foundation * refactor data platform foundation iam locals * remove redundant example test * shielded folder fix * fix typo * project factory * project factory outputs * tfdoc * test workflow: less verbose tests, fix tf version * re-enable -vv, shorter traceback, fix action version * ignore github extension warning, re-enable action version * fast bootstrap IAM, untested * bootstrap stage IAM fixes * stage 0 tests * fast stage 1 * tenant stage 1 * minor changes to fast stage 0 and 1 * fast security stage * fast mt stage 0 * fast mt stage 0 * fast pf |
||
---|---|---|
.github | ||
assets | ||
blueprints | ||
fast | ||
modules | ||
tests | ||
tools | ||
.gitignore | ||
CHANGELOG.md | ||
CONTRIBUTING.md | ||
FABRIC-AND-CFT.md | ||
LICENSE | ||
README.md | ||
REFERENCES.md | ||
default-versions.tf | ||
diagram.svg |
README.md
Terraform Examples and Modules for Google Cloud
This repository provides end-to-end blueprints and a suite of Terraform modules for Google Cloud, which support different use cases:
- organization-wide landing zone blueprint used to bootstrap real-world cloud foundations
- reference blueprints used to deep dive on network patterns or product features
- a comprehensive source of lean modules that lend themselves well to changes
The whole repository is meant to be cloned as a single unit, and then forked into separate owned repositories to seed production usage, or used as-is and periodically updated as a complete toolkit for prototyping. You can read more on this approach in our contributing guide, and a comparison against similar toolkits here.
Organization blueprint (Fabric FAST)
Setting up a production-ready GCP organization is often a time-consuming process. Fabric FAST aims to speed up this process via two complementary goals. On the one hand, FAST provides a design of a GCP organization that includes the typical elements required by enterprise customers. Secondly, we provide a reference implementation of the FAST design using Terraform.
Modules
The suite of modules in this repository are designed for rapid composition and reuse, and to be reasonably simple and readable so that they can be forked and changed where use of third party code and sources is not allowed.
All modules share a similar interface where each module tries to stay close to the underlying provider resources, support IAM together with resource creation and modification, offer the option of creating multiple resources where it makes sense (eg not for projects), and be completely free of side-effects (eg no external commands).
The current list of modules supports most of the core foundational and networking components used to design end-to-end infrastructure, with more modules in active development for specialized compute, security, and data scenarios.
Currently available modules:
- foundational - billing budget, Cloud Identity group, folder, service accounts, logging bucket, organization, project, projects-data-source
- networking - DNS, DNS Response Policy, Cloud Endpoints, address reservation, NAT, VLAN Attachment, External Application LB, External Passthrough Network LB, Firewall policy, Internal Application LB, Internal Passthrough Network LB, Internal Proxy Network LB, IPSec over Interconnect, VPC, VPC firewall, VPC peering, VPN dynamic, HA VPN, VPN static, Service Directory, Secure Web Proxy
- compute - VM/VM group, MIG, COS container (coredns, mysql, onprem, squid), GKE cluster, GKE hub, GKE nodepool
- data - AlloyDB instance, BigQuery dataset, Bigtable instance, Dataplex, Dataplex DataScan, Cloud SQL instance, Data Catalog Policy Tag, Datafusion, Dataproc, GCS, Pub/Sub
- development - API Gateway, Apigee, Artifact Registry, Container Registry, Cloud Source Repository
- security - Binauthz, KMS, SecretManager, VPC Service Control
- serverless - Cloud Function v1, Cloud Function v2, Cloud Run
For more information and usage examples see each module's README file.
End-to-end blueprints
The blueprints in this repository are split in several main sections: networking blueprints that implement core patterns or features, data solutions blueprints that demonstrate how to integrate data services in complete scenarios, cloud operations blueprints that leverage specific products to meet specific operational needs and factories that implement resource factories for the repetitive creation of specific resources, and finally GKE, serverless, and third-party solutions design blueprints.