### Verify Example Module (Kitchen)

Source: https://github.com/terraform-google-modules/terraform-google-cloud-router/blob/main/CONTRIBUTING.md

Runs verification tests against the applied example module to ensure it behaves as expected. Replace <EXAMPLE_NAME> with the actual name of the example module.

```bash
kitchen_do verify <EXAMPLE_NAME>
```

--------------------------------

### Initialize Example Module Working Directory (Kitchen)

Source: https://github.com/terraform-google-modules/terraform-google-cloud-router/blob/main/CONTRIBUTING.md

Initializes the working directory for a specific example module within the testing environment. Replace <EXAMPLE_NAME> with the actual name of the example module.

```bash
kitchen_do create <EXAMPLE_NAME>
```

--------------------------------

### Apply Example Module (Kitchen)

Source: https://github.com/terraform-google-modules/terraform-google-cloud-router/blob/main/CONTRIBUTING.md

Applies the Terraform configuration for a specified example module. This command provisions the resources defined in the module. Replace <EXAMPLE_NAME> with the actual name of the example module.

```bash
kitchen_do converge <EXAMPLE_NAME>
```

--------------------------------

### Destroy Example Module Resources (Kitchen)

Source: https://github.com/terraform-google-modules/terraform-google-cloud-router/blob/main/CONTRIBUTING.md

Destroys all resources created for a specific example module, cleaning up the test environment. Replace <EXAMPLE_NAME> with the actual name of the example module.

```bash
kitchen_do destroy <EXAMPLE_NAME>
```

--------------------------------

### Start Testing Docker Container Interactively (Make)

Source: https://github.com/terraform-google-modules/terraform-google-cloud-router/blob/main/CONTRIBUTING.md

Starts the Docker container used for testing in interactive mode, allowing for manual execution of Kitchen commands. This is done by running the 'docker_run' target with make.

```make
make docker_run
```

--------------------------------

### Run Noninteractive Integration Tests (Make)

Source: https://github.com/terraform-google-modules/terraform-google-cloud-router/blob/main/CONTRIBUTING.md

Runs all example modules' integration tests noninteractively using the prepared test project. This is achieved by executing the 'docker_test_integration' target via make.

```make
make docker_test_integration
```

--------------------------------

### Create Encrypted Interconnect Router and Attachment (Terraform)

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-router/llms.txt

This example shows how to set up a Cloud Router for encrypted Interconnect attachments using IPsec. It involves creating the router itself and then an interconnect attachment module, specifying the interconnect, encryption type, and IPsec internal addresses.

```hcl
module "encrypted_router" {
  source  = "terraform-google-modules/cloud-router/google"
  version = "~> 8.3"

  name                          = "encrypted-interconnect-router"
  project_id                    = "my-project-id"
  network                       = "my-vpc-network"
  region                        = "us-central1"
  encrypted_interconnect_router = true

  bgp = {
    asn = "65000"
  }
}

module "encrypted_attachment" {
  source  = "terraform-google-modules/cloud-router/google//modules/interconnect_attachment"
  version = "~> 8.3"

  name    = "encrypted-attachment"
  project = "my-project-id"
  region  = "us-central1"
  router  = module.encrypted_router.router.name

  interconnect = "https://googleapis.com/interconnects/my-interconnect"
  encryption   = "IPSEC"

  # Reserved internal addresses for IPsec
  ipsec_internal_addresses = [
    "projects/my-project-id/regions/us-central1/addresses/ipsec-address-1"
  ]

  interface = {
    name = "encrypted-interface"
  }

  peer = {
    name     = "encrypted-peer"
    peer_asn = "65001"
  }
}
```

--------------------------------

### Create Dedicated Interconnect Attachment (Terraform)

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-router/llms.txt

Provisions a Dedicated Interconnect attachment for a Google Cloud Router, including interface and BGP peer configuration. This setup is for high-bandwidth, low-latency connections directly to Google's network. It requires pre-existing Interconnect resources and BGP ASN information.

```hcl
module "cloud_router" {
  source  = "terraform-google-modules/cloud-router/google"
  version = "~> 8.3"

  name       = "interconnect-router"
  project_id = "my-project-id"
  network    = "my-vpc-network"
  region     = "us-central1"

  bgp = {
    asn               = 65000
    advertised_groups = ["ALL_SUBNETS"]
  }
}

module "interconnect_attachment" {
  source = "terraform-google-modules/cloud-router/google//modules/interconnect_attachment"
  version = "~> 8.3"

  name    = "my-attachment"
  project = "my-project-id"
  region  = "us-central1"
  router  = module.cloud_router.router.name

  interconnect             = "https://googleapis.com/interconnects/my-interconnect"
  type                     = "DEDICATED"
  bandwidth                = "BPS_10G"
  admin_enabled            = true
  mtu                      = "1500"
  edge_availability_domain = "AVAILABILITY_DOMAIN_1"

  interface = {
    name = "interconnect-interface"
  }

  peer = {
    name     = "on-prem-peer"
    peer_asn = "65001"
    bfd = {
      session_initialization_mode = "ACTIVE"
      min_transmit_interval       = 1000
      min_receive_interval        = 1000
      multiplier                  = 5
    }
  }
}

# Outputs
output "attachment" {
  value = module.interconnect_attachment.attachment
}

output "customer_router_ip" {
  value = module.interconnect_attachment.customer_router_ip_address
}
```

--------------------------------

### Prepare Test Project with Docker (Make)

Source: https://github.com/terraform-google-modules/terraform-google-cloud-router/blob/main/CONTRIBUTING.md

Executes the 'docker_test_prepare' target using make to set up the necessary environment and resources for integration testing within a Docker container.

```make
make docker_test_prepare
```

--------------------------------

### Generate Documentation Tables (Make)

Source: https://github.com/terraform-google-modules/terraform-google-cloud-router/blob/main/CONTRIBUTING.md

Automatically generates the Inputs and Outputs tables for the module's README files. This command should be run whenever module interfaces are modified.

```make
make generate_docs
```

--------------------------------

### Lint and Format Files (Make)

Source: https://github.com/terraform-google-modules/terraform-google-cloud-router/blob/main/CONTRIBUTING.md

Executes linting and formatting checks on the repository files using the 'docker_test_lint' target provided by make. This ensures code quality and consistency.

```make
make docker_test_lint
```

--------------------------------

### Basic Cloud Router Deployment with Terraform

Source: https://github.com/terraform-google-modules/terraform-google-cloud-router/blob/main/README.md

Demonstrates the basic usage of the Cloud Router Terraform module. It configures a router with a name, region, BGP settings, project ID, and network. Ensure you replace '<PROJECT ID>' with your actual project ID.

```hcl
module "cloud_router" {
  source  = "terraform-google-modules/cloud-router/google"
  version = "~> 8.3"

  name    = "example-router"
  region  = "us-central1"

  bgp = {
    # The ASN (16550, 64512 - 65534, 4200000000 - 4294967294) can be any private ASN
    # not already used as a peer ASN in the same region and network or 16550 for Partner Interconnect.
    asn = "65001"
  }

  project_id = "<PROJECT ID>"
  network = "default"
}
```

--------------------------------

### Basic Cloud Router Deployment with BGP

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-router/llms.txt

Deploys a basic Cloud Router with BGP configuration for dynamic routing. This router is essential for Cloud NAT, VPN tunnels, and Interconnect attachments. It requires the project ID, network name, and region.

```hcl
module "cloud_router" {
  source  = "terraform-google-modules/cloud-router/google"
  version = "~> 8.3"

  name       = "my-router"
  project_id = "my-project-id"
  network    = "my-vpc-network"
  region     = "us-central1"

  bgp = {
    # The ASN (16550, 64512 - 65534, 4200000000 - 4294967294) can be any private ASN
    # not already used as a peer ASN in the same region and network or 16550 for Partner Interconnect.
    asn = "65001"
  }
}

# Outputs
output "router_name" {
  value = module.cloud_router.router.name
}

output "router_self_link" {
  value = module.cloud_router.router.self_link
}
```

--------------------------------

### Export Service Account Credentials (Shell)

Source: https://github.com/terraform-google-modules/terraform-google-cloud-router/blob/main/CONTRIBUTING.md

Exports the service account JSON credentials to the SERVICE_ACCOUNT_JSON environment variable. This is a prerequisite for preparing the test project.

```shell
export SERVICE_ACCOUNT_JSON=$(< credentials.json)
```

--------------------------------

### Configure Multiple Cloud NAT Gateways (Terraform)

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-router/llms.txt

This configuration demonstrates how to create a Cloud Router with multiple Cloud NAT gateways, each serving different subnetworks. It allows for granular control over NAT settings, including source IP ranges to NAT and logging configurations for each gateway.

```hcl
module "cloud_router" {
  source  = "terraform-google-modules/cloud-router/google"
  version = "~> 8.3"

  name       = "multi-nat-router"
  project_id = "my-project-id"
  network    = "my-vpc-network"
  region     = "us-central1"

  nats = [
    {
      name                               = "production-nat"
      source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
      subnetworks = [{
        name                    = "projects/my-project-id/regions/us-central1/subnetworks/prod-subnet"
        source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
      }]
      log_config = {
        enable = true
        filter = "ALL"
      }
    },
    {
      name                               = "development-nat"
      source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
      subnetworks = [{
        name                    = "projects/my-project-id/regions/us-central1/subnetworks/dev-subnet"
        source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
      }]
      log_config = {
        enable = false
      }
    }
  ]
}
```

--------------------------------

### Set Test Project Environment Variables (Shell)

Source: https://github.com/terraform-google-modules/terraform-google-cloud-router/blob/main/CONTRIBUTING.md

Sets essential environment variables for Terraform testing, including organization ID, folder ID, and billing account ID. These are required for preparing the test project.

```shell
export TF_VAR_org_id="your_org_id"
export TF_VAR_folder_id="your_folder_id"
export TF_VAR_billing_account="your_billing_account_id"
```

--------------------------------

### Cloud Router with Cloud NAT Gateway

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-router/llms.txt

Creates a Cloud Router with an attached Cloud NAT gateway for outbound internet connectivity. NAT logging is enabled by default. This configuration simplifies outbound connectivity for resources within your VPC network. Requires router and NAT gateway configuration.

```hcl
module "cloud_router" {
  source  = "terraform-google-modules/cloud-router/google"
  version = "~> 8.3"

  name       = "router-with-nat"
  project_id = "my-project-id"
  network    = "my-vpc-network"
  region     = "us-central1"

  nats = [{
    name = "my-nat-gateway"
    # AUTO_ONLY: GCP automatically allocates external IPs
    # MANUAL_ONLY: Use nat_ips to specify external IPs
  }]
}

# NAT is accessible via output
output "nat_gateway" {
  value = module.cloud_router.nat
}
```

--------------------------------

### Configure Cloud NAT with Advanced Options (Terraform)

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-router/llms.txt

Sets up Cloud NAT with dynamic port allocation, custom timeouts for UDP, ICMP, and TCP connections, and enables logging with an error filter. This configuration is suitable for general outbound internet access where fine-grained control over NAT behavior is needed.

```hcl
module "cloud_router" {
  source  = "terraform-google-modules/cloud-router/google"
  version = "~> 8.3"

  name       = "router-advanced-nat"
  project_id = "my-project-id"
  network    = "my-vpc-network"
  region     = "us-central1"

  nats = [{
    name                                = "advanced-nat-gateway"
    source_subnetwork_ip_ranges_to_nat  = "ALL_SUBNETWORKS_ALL_IP_RANGES"
    enable_dynamic_port_allocation      = true
    enable_endpoint_independent_mapping = false
    min_ports_per_vm                    = 64
    max_ports_per_vm                    = 65536

    # Timeout configurations (in seconds)
    udp_idle_timeout_sec             = 30
    icmp_idle_timeout_sec            = 30
    tcp_established_idle_timeout_sec = 1200
    tcp_transitory_idle_timeout_sec  = 30
    tcp_time_wait_timeout_sec        = 120

    log_config = {
      enable = true
      filter = "ERRORS_ONLY"  # Options: ALL, ERRORS_ONLY, TRANSLATIONS_ONLY
    }
  }]
}
```

--------------------------------

### Create Cloud Router Interface with BGP Peers (Terraform)

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-router/llms.txt

This snippet demonstrates how to create a Cloud Router interface with BGP peers, typically used for VPN tunnels or interconnect attachments. It requires specifying the router name, project, region, IP range, and details for each peer, including BFD configuration for fast failover.

```hcl
module "interface" {
  source  = "terraform-google-modules/cloud-router/google//modules/interface"
  version = "~> 8.3"

  name       = "vpn-interface"
  project_id = "my-project-id"
  router     = "my-router"
  region     = "us-central1"

  ip_range   = "169.254.0.1/30"
  vpn_tunnel = "projects/my-project-id/regions/us-central1/vpnTunnels/my-tunnel"

  peers = [
    {
      name            = "vpn-peer"
      peer_ip_address = "169.254.0.2"
      peer_asn        = "65002"
      advertised_route_priority = 100
      bfd = {
        session_initialization_mode = "ACTIVE"
        min_transmit_interval       = 1000
        min_receive_interval        = 1000
        multiplier                  = 5
      }
    }
  ]
}
```

--------------------------------

### Create Partner Interconnect Attachment (Terraform)

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-router/llms.txt

Sets up a Partner Interconnect attachment (VLAN attachment) without automatically creating the router interface. The interface is typically created after the partner activation process is complete. This is suitable for connecting to Google Cloud via a service provider.

```hcl
module "cloud_router" {
  source  = "terraform-google-modules/cloud-router/google"
  version = "~> 8.3"

  name       = "partner-interconnect-router"
  project_id = "my-project-id"
  network    = "my-vpc-network"
  region     = "us-central1"

  bgp = {
    asn = 16550  # Use 16550 for Partner Interconnect
  }
}

module "partner_attachment" {
  source  = "terraform-google-modules/cloud-router/google//modules/interconnect_attachment"
  version = "~> 8.3"

  name    = "partner-attachment"
  project = "my-project-id"
  region  = "us-central1"
  router  = module.cloud_router.router.name

  type                     = "PARTNER"
  edge_availability_domain = "AVAILABILITY_DOMAIN_1"

  # Set to false for PARTNER type - interface is created after partner activation
  create_interface = false
}
```

--------------------------------

### Cloud Router with Custom BGP Route Advertisements

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-router/llms.txt

Configures a Cloud Router with custom BGP route advertisements, including all subnets and specific IP ranges. This allows for fine-grained control over advertised routes. Requires BGP ASN, advertised groups, advertised IP ranges, and optionally keepalive interval.

```hcl
module "cloud_router" {
  source  = "terraform-google-modules/cloud-router/google"
  version = "~> 8.3"

  name        = "router-with-advertisements"
  project_id  = "my-project-id"
  network     = "my-vpc-network"
  region      = "us-central1"
  description = "Router with custom BGP advertisements"

  bgp = {
    asn               = "65000"
    advertised_groups = ["ALL_SUBNETS"]
    advertised_ip_ranges = [
      {
        range       = "10.0.0.0/8"
        description = "On-premises network range"
      },
      {
        range       = "192.168.0.0/16"
        description = "Secondary network range"
      }
    ]
    keepalive_interval = 20
  }
}
```

--------------------------------

### Terraform Configuration for Interconnect Attachment

Source: https://github.com/terraform-google-modules/terraform-google-cloud-router/blob/main/modules/interconnect_attachment/README.md

This snippet demonstrates how to configure an Interconnect Attachment resource in Terraform. It includes essential parameters like name, project, region, router, interconnect, and type. Optional parameters for bandwidth, MTU, and VLAN tagging can also be specified.

```terraform
resource "google_compute_interconnect_attachment" "default" {
  name        = "your-attachment-name"
  project     = "your-project-id"
  region      = "your-region"
  router      = "your-router-name"
  interconnect = "your-interconnect-name"
  type        = "DEDICATED" # Or "PARTNER"

  # Optional parameters
  admin_enabled = true
  bandwidth     = "BPS_10G"
  mtu           = "1440"
  vlan_tag8021q = "100"
}
```

--------------------------------

### Terraform Configuration with BGP Peer

Source: https://github.com/terraform-google-modules/terraform-google-cloud-router/blob/main/modules/interconnect_attachment/README.md

This Terraform configuration illustrates setting up an Interconnect Attachment with a BGP peer. It defines the peer's name, ASN, and optional configurations like advertised route priority and MD5 authentication. This is crucial for establishing BGP sessions over the interconnect.

```terraform
resource "google_compute_interconnect_attachment" "default" {
  name        = "your-attachment-name"
  project     = "your-project-id"
  region      = "your-region"
  router      = "your-router-name"
  interconnect = "your-interconnect-name"
  type        = "DEDICATED"

  peer {
    name                      = "your-peer-name"
    peer_asn                  = "65001"
    advertised_route_priority = 100
    bfd {
      session_initialization_mode = "AUTO"
    }
    md5_authentication_key {
      name = "your-key-name"
      key  = "your-secret-key"
    }
  }
}
```

--------------------------------

### Configure Cloud NAT with Manual IP Allocation (Terraform)

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-router/llms.txt

Configures Cloud NAT to use specific, pre-reserved static external IP addresses. It also includes the `drain_nat_ips` argument, which allows for graceful rotation of IP addresses without interrupting existing connections. This is useful for maintaining stable external IP addresses for services.

```hcl
# First, reserve static external IPs
resource "google_compute_address" "nat_ip_1" {
  name    = "nat-external-ip-1"
  project = "my-project-id"
  region  = "us-central1"
}

resource "google_compute_address" "nat_ip_2" {
  name    = "nat-external-ip-2"
  project = "my-project-id"
  region  = "us-central1"
}

module "cloud_router" {
  source  = "terraform-google-modules/cloud-router/google"
  version = "~> 8.3"

  name       = "router-manual-nat-ips"
  project_id = "my-project-id"
  network    = "my-vpc-network"
  region     = "us-central1"

  nats = [{
    name                   = "manual-ip-nat"
    nat_ip_allocate_option = "MANUAL_ONLY"
    nat_ips = [
      google_compute_address.nat_ip_1.self_link,
      google_compute_address.nat_ip_2.self_link,
    ]
    # Use drain_nat_ips to gracefully remove IPs without dropping connections
    drain_nat_ips = []
  }]
}
```

--------------------------------

### Cloud NAT for Specific Subnetworks

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-router/llms.txt

Configures Cloud NAT for specific subnetworks, including primary and secondary IP ranges. This is particularly useful for GKE clusters with alias IP ranges. It allows granular control over which subnetworks and IP ranges are NATed.

```hcl
module "cloud_router" {
  source  = "terraform-google-modules/cloud-router/google"
  version = "~> 8.3"

  name       = "router-with-subnet-nat"
  project_id = "my-project-id"
  network    = "my-vpc-network"
  region     = "us-central1"

  nats = [{
    name                               = "subnet-specific-nat"
    source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"

    subnetworks = [
      {
        name                     = "projects/my-project-id/regions/us-central1/subnetworks/my-subnet"
        source_ip_ranges_to_nat  = ["PRIMARY_IP_RANGE", "LIST_OF_SECONDARY_IP_RANGES"]
        secondary_ip_range_names = ["pods", "services"]
      },
      {
        name                    = "projects/my-project-id/regions/us-central1/subnetworks/another-subnet"
        source_ip_ranges_to_nat = ["PRIMARY_IP_RANGE"]
      }
    ]
  }]
}
```

--------------------------------

### Terraform Configuration with Candidate Subnets

Source: https://github.com/terraform-google-modules/terraform-google-cloud-router/blob/main/modules/interconnect_attachment/README.md

This Terraform snippet shows how to configure candidate subnets for an Interconnect Attachment. This feature allows you to restrict the allocation of IP addresses for the attachment, ensuring they fall within specified link-local address ranges. It's useful for precise network control.

```terraform
resource "google_compute_interconnect_attachment" "default" {
  name        = "your-attachment-name"
  project     = "your-project-id"
  region      = "your-region"
  router      = "your-router-name"
  interconnect = "your-interconnect-name"
  type        = "DEDICATED"

  candidate_subnets = [
    "169.254.0.0/29",
    "169.254.1.0/29"
  ]
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.