### Running Interactive Integration Tests (Shell)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/CONTRIBUTING.md

Starts the Docker test container in interactive mode, allowing manual execution of Kitchen commands for creating, converging, verifying, and destroying example modules. Replace <EXAMPLE_NAME> with the specific example module directory name.

```shell
make docker_run
```

```shell
kitchen_do create <EXAMPLE_NAME>
```

```shell
kitchen_do converge <EXAMPLE_NAME>
```

```shell
kitchen_do verify <EXAMPLE_NAME>
```

```shell
kitchen_do destroy <EXAMPLE_NAME>
```

--------------------------------

### Basic Usage Example - Terraform Google Network Routes Module

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/routes/README.md

This snippet demonstrates the basic usage of the routes submodule. It shows how to configure the module with project ID, network name, and a list of routes, including examples for internet gateway and instance next hops.

```HCL
module "vpc" {
    source  = "terraform-google-modules/network/google//modules/routes"
    version = "~> 11.0"

    project_id   = "<PROJECT ID>"
    network_name = "example-vpc"

    routes = [
        {
            name                   = "egress-internet"
            description            = "route through IGW to access internet"
            destination_range      = "0.0.0.0/0"
            tags                   = "egress-inet"
            next_hop_internet      = "true"
        },
        {
            name                   = "app-proxy"
            description            = "route through proxy to reach app"
            destination_range      = "10.50.10.0/24"
            tags                   = "app-proxy"
            next_hop_instance      = "app-proxy-instance"
            next_hop_instance_zone = "us-west1-a"
        },
    ]
}
```

--------------------------------

### Create Test Resources and Extract Service Account Key (Bash)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/test/setup/README.md

Applies the Terraform configuration in the current directory to create test resources, then extracts the generated service account key and saves it to a local file.

```bash
terraform init
terraform apply
mkdir -p ~/.credentials
terraform output sa_key | base64 --decode > ~/.credentials/network-sa.json
```

--------------------------------

### Configure Environment Variables for Testing (Bash)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/test/setup/README.md

Sets the SERVICE_ACCOUNT_JSON environment variable with the content of the extracted service account key file and sets the PROJECT_ID variable.

```bash
export SERVICE_ACCOUNT_JSON=$(cat ${HOME}/.credentials/network-sa.json)
export PROJECT_ID="network-module"
```

--------------------------------

### Exporting Test Environment Variables (Shell)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/CONTRIBUTING.md

Sets environment variables required for the test environment setup, including service account credentials and project/folder/billing IDs. Replace placeholder values with your actual IDs.

```shell
export SERVICE_ACCOUNT_JSON=$(< credentials.json)
export TF_VAR_org_id="your_org_id"
export TF_VAR_folder_id="your_folder_id"
export TF_VAR_billing_account="your_billing_account_id"
```

--------------------------------

### Basic Usage of Routes Beta Module (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/routes-beta/README.md

This HCL code snippet demonstrates the basic usage of the `routes-beta` submodule to create multiple VPC routes within a specified network. It shows examples of routing traffic to the internet gateway, a specific instance, and an internal load balancer (ILB). Requires the project ID, network name, and a list of route configurations.

```HCL
module "vpc" {
    source  = "terraform-google-modules/network/google//modules/routes-beta"
    version = "~> 11.0"

    project_id   = "<PROJECT ID>"
    network_name = "example-vpc"

    routes = [
        {
            name                   = "egress-internet"
            description            = "route through IGW to access internet"
            destination_range      = "0.0.0.0/0"
            tags                   = "egress-inet"
            next_hop_internet      = "true"
        },
        {
            name                   = "app-proxy"
            description            = "route through proxy to reach app"
            destination_range      = "10.50.10.0/24"
            tags                   = "app-proxy"
            next_hop_instance      = "app-proxy-instance"
            next_hop_instance_zone = "us-west1-a"
        },
        {
            name                   = "test-proxy"
            description            = "route through idp to reach app"
            destination_range      = "10.50.10.0/24"
            tags                   = "app-proxy"
            next_hop_ilb           = var.ilb_link
        },
    ]
}
```

--------------------------------

### Example Firewall Policy Rule Configuration (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/network-firewall-policy/README.md

This snippet provides an example configuration block demonstrating the structure and typical values for defining a firewall policy rule within the Terraform module. It shows how to set basic properties like priority, direction, action, name, description, logging, target tags/service accounts, and match criteria including IP ranges and layer4 configurations.

```HCL
{
 priority = 1
 direction = "INGRESS"
 action = allow
 rule_name = "my-test-policy"
 disabled = false
 description = "My test firewall policy"
 enable_logging = true
 target_secure_tags = ["tagValues/${google_tags_tag_value.tag_value.name}",]
 target_service_accounts = ["fw-test-svc-acct@$my-project-id.iam.gserviceaccount.com"]
 match = {
 src_ip_ranges = ["10.100.0.2"]
 src_fqdns = []
 src_region_codes = []
 src_secure_tags = []
 src_address_groups = []
 dest_ip_ranges = ["10.100.100.2"]
 dest_fqdns = []
 dest_region_codes = []
 dest_threat_intelligences = []
 dest_address_groups = []
 layer4_configs = [
 {
 ip_protocol = "tcp"
 ports = ["80", "8080", "8081-8085"]
 },
 ]
 }
 is_mirroring = false
 tls_inspect = null
 security_profile_group_id = null
}
```

--------------------------------

### Running Non-interactive Integration Tests (Shell)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/CONTRIBUTING.md

Runs all integration tests for example modules non-interactively within the prepared Docker test environment. Assumes the test project has been prepared.

```shell
make docker_test_integration
```

--------------------------------

### Example with Detailed Rules - Terraform

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/network-firewall-policy/README.md

This example illustrates how to configure a network firewall policy module in Terraform, including defining multiple ingress and egress rules with various match criteria such as IP ranges, FQDNs, region codes, threat intelligence, secure tags, address groups, and layer4 configurations.

```hcl
module "network_firewall_policy" {
  source       = "terraform-google-modules/network/google//modules/network-firewall-policy"
  version      = "~> 11.0"
  project_id   = var.project_id
  policy_name  = "my-firewall-policy"
  description  = "Test firewall policy"
  target_vpcs  = [var.vpc1_id, var.vpc2_id]

  rules = [

    {
      priority       = "1"
      direction      = "INGRESS"
      action         = "allow"
      rule_name      = "ingress-1"
      description    = "test ingres rule 1"
      enable_logging = true
      match = {
        src_ip_ranges            = ["10.100.0.1/32"]
        src_fqdns                = ["google.com"]
        src_region_codes         = ["US"]
        src_threat_intelligences = ["iplist-public-clouds"]
        src_secure_tags          = ["tagValues/${google_tags_tag_value.tag_value.name}"]
        src_address_groups       = [google_network_security_address_group.networksecurity_address_group.id]
        layer4_configs = [
          {
            ip_protocol = "all"
          },
        ]
      }
    },

    {
      priority                = "3"
      direction               = "INGRESS"
      action                  = "allow"
      rule_name               = "ingress-3"
      disabled                = true
      description             = "test ingres rule 3"
      enable_logging          = true
      target_service_accounts = ["fw-test-svc-acct@${var.project_id}.iam.gserviceaccount.com"]
      match = {
        src_ip_ranges  = ["10.100.0.3/32"]
        dest_ip_ranges = ["10.100.0.103/32"]
        layer4_configs = [
          {
            ip_protocol = "tcp"
            ports       = ["80"]
          },
        ]
      }
    },

    {
      priority       = "101"
      direction      = "EGRESS"
      action         = "allow"
      rule_name      = "egress-101"
      description    = "test egress rule 101"
      enable_logging = true
      match = {
        src_ip_ranges             = ["10.100.0.2/32"]
        dest_fqdns                = ["google.org"]
        dest_region_codes         = ["US"]
        dest_threat_intelligences = ["iplist-public-clouds"]
        dest_address_groups       = [google_network_security_address_group.networksecurity_address_group.id]
        layer4_configs = [
          {
            ip_protocol = "all"
          },
        ]
      }
    },

    {
      priority                = "103"
      direction               = "EGRESS"
      action                  = "allow"
      rule_name               = "egress-103"
      disabled                = true
      description             = "test ingres rule 103"
      enable_logging          = true
      target_service_accounts = ["fw-test-svc-acct@${var.project_id}.iam.gserviceaccount.com"]
      match = {
        dest_ip_ranges = ["10.100.0.103/32"]
        layer4_configs = [
          {
            ip_protocol = "tcp"
            ports       = ["80", "8080", "8081-8085"]
          },
        ]
      }
    },

  ]

}
```

--------------------------------

### Basic Firewall Module Usage (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/fabric-net-firewall/README.md

Example demonstrating basic usage of the firewall module. It configures the module source, project, network, enables internal ranges, and defines a sample custom ingress rule allowing TCP traffic from a specific IP range based on source and target tags.

```HCL
module "net-firewall" {
  source                  = "terraform-google-modules/network/google//modules/fabric-net-firewall"
  project_id              = "my-project"
  network                 = "my-vpc"
  internal_ranges_enabled = true
  internal_ranges         = ["10.0.0.0/0"]
  internal_target_tags    = ["internal"]
  custom_rules = {
    ingress-sample = {
      description          = "Dummy sample ingress rule, tag-based."
      direction            = "INGRESS"
      action               = "allow"
      ranges               = ["192.168.0.0"]
      sources              = ["spam-tag"]
      targets              = ["foo-tag", "egg-tag"]
      use_service_accounts = false
      rules = [
        {
          protocol = "tcp"
          ports    = []
        }
      ]
      extra_attributes = {}
    }
  }
}
```

--------------------------------

### Creating Multiple VPC Network Peerings with Dependency (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/network-peering/README.md

This example demonstrates how to create multiple VPC network peerings from a single network (A) to different networks (B and C) using the module. It highlights the use of `module_depends_on` to ensure the second peering (A->C) is created only after the first one (A->B) is complete, addressing the limitation of creating multiple peerings simultaneously.

```HCL
module "peering-a-b" {
  source = "terraform-google-modules/network/google//modules/network-peering"

  prefix        = "name-prefix"
  local_network = "<A NETWORK SELF LINK>"
  peer_network  = "<B NETWORK SELF LINK>"
}

module "peering-a-c" {
  source = "terraform-google-modules/network/google//modules/network-peering"

  prefix        = "name-prefix"
  local_network = "<A NETWORK SELF LINK>"
  peer_network  = "<C NETWORK SELF LINK>"

  module_depends_on = [module.peering-a-b.complete]
}
```

--------------------------------

### Preparing Test Project with Docker (Shell)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/CONTRIBUTING.md

Executes the make target to set up the isolated test project environment using Docker, based on the configuration in the test/setup directory. Requires environment variables to be set.

```shell
make docker_test_prepare
```

--------------------------------

### Running Linting and Formatting Checks (Shell)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/CONTRIBUTING.md

Executes the make target to run various linters and formatters on the repository files within a Docker container to ensure code quality standards are met.

```shell
make docker_test_lint
```

--------------------------------

### Download and Prepare Migration Script (Shell)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/docs/upgrading_to_v2.0.md

Downloads the Python migration script from the GitHub repository and makes it executable using chmod.

```Shell
curl -O https://raw.githubusercontent.com/terraform-google-modules/terraform-google-network/master/helpers/migrate.py
chmod +x migrate.py
```

--------------------------------

### Create VPC Serverless Connector using Terraform

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/vpc-serverless-connector-beta/README.md

This HCL code snippet demonstrates the basic usage of the 'vpc-serverless-connector-beta' submodule to create a VPC serverless connector. It requires specifying the project ID and a list of connector configurations, including name, region, subnet, machine type, and instance counts.

```HCL
module "serverless-connector" {
  source     = "terraform-google-modules/network/google//modules/vpc-serverless-connector-beta"
  project_id = <PROJECT ID>
  vpc_connectors = [{
    name            = "central-serverless"
    region          = "us-central1"
    subnet_name     = "<SUBNET NAME>"
    host_project_id = "<HOST PROJECT ID>"
    machine_type    = "e2-standard-4"
    min_instances   = 2
    max_instances   = 3
  }]
}
```

--------------------------------

### Creating VPC Subnets using Terraform Google Module

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/subnets/README.md

This HCL code block demonstrates how to instantiate the `subnets` module to create multiple VPC subnets within a specified network and project. It shows configuration options for primary IP ranges, region, private access, flow logs settings, and secondary IP ranges.

```HCL
module "vpc" {
    source  = "terraform-google-modules/network/google//modules/subnets"
    version = "~> 11.0"

    project_id   = "<PROJECT ID>"
    network_name = "example-vpc"

    subnets = [
        {
            subnet_name           = "subnet-01"
            subnet_ip             = "10.10.10.0/24"
            subnet_region         = "us-west1"
        },
        {
            subnet_name           = "subnet-02"
            subnet_ip             = "10.10.20.0/24"
            subnet_region         = "us-west1"
            subnet_private_access = "true"
            subnet_flow_logs      = "true"
            description           = "This subnet has a description"
            purpose               = "INTERNAL_HTTPS_LOAD_BALANCER"
            role                  = "ACTIVE"
        },
        {
            subnet_name                  = "subnet-03"
            subnet_ip                    = "10.10.30.0/24"
            subnet_region                = "us-west1"
            subnet_flow_logs             = "true"
            subnet_flow_logs_interval    = "INTERVAL_10_MIN"
            subnet_flow_logs_sampling    = 0.7
            subnet_flow_logs_metadata    = "INCLUDE_ALL_METADATA"
            subnet_flow_logs_filter_expr = "true"
        }
    ]

    secondary_ranges = {
        subnet-01 = [
            {
                range_name    = "subnet-01-secondary-01"
                ip_cidr_range = "192.168.64.0/24"
            },
        ]

        subnet-02 = []
    }
}
```

--------------------------------

### Basic Usage of NCC Module (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/network-connectivity-center/README.md

This snippet shows the minimal configuration required to instantiate the Network Connectivity Center submodule using Terraform. It specifies the source of the module and the required project ID.

```HCL
module "ncc" {
    source  = "terraform-google-modules/network/google//modules/network-connectivity-center"
    version = "~> 11.0"

    project_id   = "<PROJECT ID>"
}
```

--------------------------------

### Basic Module Structure - Terraform

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/network-firewall-policy/README.md

This snippet demonstrates the basic structure for using the `network-firewall-policy` Terraform module, including specifying the source, version, project ID, policy name, description, target VPCs, and an empty rules list.

```hcl
module "network_firewall_policy" {
  source       = "terraform-google-modules/network/google//modules/network-firewall-policy"
  version      = "~> 11.0"
  project_id   = var.project_id
  policy_name  = "my-firewall-policy"
  description  = "Test firewall policy"
  target_vpcs  = [var.vpc1_id, var.vpc2_id]

  rules = [
    {},
    {},
  ]
}
```

--------------------------------

### Verifying Terraform State Migration with Plan

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/docs/upgrading_to_v2.0.md

Executes a 'terraform plan' after state migration to verify that the configuration now correctly matches the state, resulting in no proposed changes. This confirms the migration was successful.

```Shell
$ terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

module.example.module.test-vpc-module.google_compute_network.network: Refreshing state... [id=simple-project-timh]
module.example.module.test-vpc-module.google_compute_subnetwork.subnetwork["us-west1/simple-project-timh-subnet-02"]: Refreshing state... [id=us-west1/simple-project-timh-subnet-02]
module.example.module.test-vpc-module.google_compute_subnetwork.subnetwork["us-west1/simple-project-timh-subnet-01"]: Refreshing state... [id=us-west1/simple-project-timh-subnet-01]

------------------------------------------------------------------------

No changes. Infrastructure is up-to-date.

This means that Terraform did not detect any differences between your
configuration and real physical resources that exist. As a result, no
actions need to be performed.
```

--------------------------------

### Creating VPC Network with Subnets and Routes using Terraform Google Module

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/README.md

This Terraform HCL snippet demonstrates how to use the `terraform-google-modules/network/google` module to provision a Google Cloud VPC network. It defines the network name and routing mode, configures multiple subnets with primary and secondary IP ranges, and sets up custom routes for internet egress and application proxy.

```hcl
module "vpc" {
    source  = "terraform-google-modules/network/google"
    version = "~> 11.0"

    project_id   = "<PROJECT ID>"
    network_name = "example-vpc"
    routing_mode = "GLOBAL"

    subnets = [
        {
            subnet_name           = "subnet-01"
            subnet_ip             = "10.10.10.0/24"
            subnet_region         = "us-west1"
        },
        {
            subnet_name           = "subnet-02"
            subnet_ip             = "10.10.20.0/24"
            subnet_region         = "us-west1"
            subnet_private_access = "true"
            subnet_flow_logs      = "true"
            description           = "This subnet has a description"
        },
        {
            subnet_name               = "subnet-03"
            subnet_ip                 = "10.10.30.0/24"
            subnet_region             = "us-west1"
            subnet_flow_logs          = "true"
            subnet_flow_logs_interval = "INTERVAL_10_MIN"
            subnet_flow_logs_sampling = 0.7
            subnet_flow_logs_metadata = "INCLUDE_ALL_METADATA"
        }
    ]

    secondary_ranges = {
        subnet-01 = [
            {
                range_name    = "subnet-01-secondary-01"
                ip_cidr_range = "192.168.64.0/24"
            },
        ]

        subnet-02 = []
    }

    routes = [
        {
            name                   = "egress-internet"
            description            = "route through IGW to access internet"
            destination_range      = "0.0.0.0/0"
            tags                   = "egress-inet"
            next_hop_internet      = "true"
        },
        {
            name                   = "app-proxy"
            description            = "route through proxy to reach app"
            destination_range      = "10.50.10.0/24"
            tags                   = "app-proxy"
            next_hop_instance      = "app-proxy-instance"
            next_hop_instance_zone = "us-west1-a"
        },
    ]
}
```

--------------------------------

### Configuring Google Cloud Subnets using Terraform Module

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/subnets-beta/README.md

This HCL code block demonstrates how to use the 'subnets-beta' submodule to create multiple Google Cloud VPC subnets. It shows how to define subnet properties like name, IP range, region, private access, flow logs, description, purpose, and role, as well as configuring secondary IP ranges for specific subnets.

```HCL
module "vpc" {
    source  = "terraform-google-modules/network/google//modules/subnets-beta"
    version = "~> 11.0"

    project_id   = "<PROJECT ID>"
    network_name = "example-vpc"

    subnets = [
        {
            subnet_name           = "subnet-01"
            subnet_ip             = "10.10.10.0/24"
            subnet_region         = "us-west1"
        },
        {
            subnet_name           = "subnet-02"
            subnet_ip             = "10.10.20.0/24"
            subnet_region         = "us-west1"
            subnet_private_access = "true"
            subnet_flow_logs      = "true"
            description           = "This subnet has a description"
            purpose               = "INTERNAL_HTTPS_LOAD_BALANCER"
            role                  = "ACTIVE"
        },
        {
            subnet_name               = "subnet-03"
            subnet_ip                 = "10.10.30.0/24"
            subnet_region             = "us-west1"
            subnet_flow_logs          = "true"
            subnet_flow_logs_interval = "INTERVAL_10_MIN"
            subnet_flow_logs_sampling = 0.7
            subnet_flow_logs_metadata = "INCLUDE_ALL_METADATA"
            subnet_flow_logs_filter_expr = "true"
        }
    ]

    secondary_ranges = {
        subnet-01 = [
            {
                range_name    = "subnet-01-secondary-01"
                ip_cidr_range = "192.168.64.0/24"
            },
        ]

        subnet-02 = []
    }
}
```

--------------------------------

### Basic Usage of Private Service Connect Module - HCL

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/private-service-connect/README.md

This snippet demonstrates the basic configuration required to use the Private Service Connect Terraform module. It shows how to define the module source, version, and essential variables like project ID, network self-link, desired IP address, and the target service (e.g., 'all-apis').

```HCL
module "private_service_connect" {
  source  = "terraform-google-modules/network/google//modules/private-service-connect"
  version = "~> 11.0"

  project_id                 = "<PROJECT_ID>"
  network_self_link          = "<NETWORK_SELF_LINK>"
  private_service_connect_ip = "10.3.0.5"
  forwarding_rule_target     = "all-apis"
}
```

--------------------------------

### Basic Usage of VPC Module (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/vpc/README.md

This snippet demonstrates the basic instantiation of the VPC submodule. It sets the required project ID and network name, and explicitly disables the Shared VPC host feature.

```HCL
module "vpc" {
    source  = "terraform-google-modules/network/google//modules/vpc"
    version = "~> 11.0"

    project_id   = "<PROJECT ID>"
    network_name = "example-vpc"

    shared_vpc_host = false
}
```

--------------------------------

### Migrating Terraform VPC Network State (Step 1)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/docs/upgrading_to_v2.0.md

This command moves the state of the main VPC network resource from its original address to a new address within a refactored module structure. Note: The target resource type in the source text appears incorrect; the corrected target 'google_compute_network.network' is used here based on context.

```Shell
terraform state mv module.example.module.test-vpc-module.google_compute_network.network module.example.module.test-vpc-module.module.vpc.google_compute_network.network
```

--------------------------------

### Preview State Migration Commands (Shell)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/docs/upgrading_to_v2.0.md

Runs the migration script with the '--dryrun' flag. This command does not modify the state but outputs the 'terraform state mv' commands that would be executed, allowing review before applying.

```Shell
./migrate.py --dryrun
```

--------------------------------

### Execute State Migration (Shell)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/docs/upgrading_to_v2.0.md

Runs the migration script without the '--dryrun' flag. This command executes the 'terraform state mv' operations to update the Terraform state according to the script's logic.

```Shell
./migrate.py
```

--------------------------------

### Create Hierarchical Firewall Policy - HCL

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/hierarchical-firewall-policy/README.md

This HCL code snippet demonstrates how to instantiate the `hierarchical-firewall-policy` submodule from the Terraform Google Network module. It configures a firewall policy attached to a folder, specifies target folders and an organization, and defines a list of ingress and egress rules with detailed match criteria (IP ranges, FQDNs, regions, threat intelligence, protocols, ports) and actions (allow, deny), including options for logging and disabling rules.

```HCL
module "firewal_policy" {
  source  = "terraform-google-modules/network/google//modules/hierarchical-firewall-policy"
  version = "~> 11.0"

  parent_node    = "folders/123456789012"
  policy_name    = "test-policy"
  description    = "test firewall policy"
  target_folders = ["123456789012", "987654321098"]
  target_org     = "123456123456"

  rules = [
    {
      priority       = "1"
      direction      = "INGRESS"
      action         = "allow"
      rule_name      = "ingress-1"
      description    = "test ingres rule 1"
      enable_logging = true
      match = {
        src_ip_ranges            = ["10.100.0.1/32"]
        src_fqdns                = ["example.com"]
        src_region_codes         = ["US"]
        src_threat_intelligences = ["iplist-public-clouds"]
        layer4_configs = [
          {
            ip_protocol = "all"
          },
        ]
      }
    },
    {
      priority    = "2"
      direction   = "INGRESS"
      action      = "deny"
      rule_name   = "ingress-2"
      disabled    = true
      description = "test ingres rule 2"
      match = {
        src_ip_ranges    = ["10.100.0.2/32"]
        src_fqdns        = ["example.org"]
        src_region_codes = ["BE"]
        layer4_configs = [
          {
            ip_protocol = "all"
          },
        ]
      }
    },
    {
      priority                = "3"
      direction               = "INGRESS"
      action                  = "allow"
      rule_name               = "ingress-3"
      disabled                = true
      description             = "test ingres rule 3"
      enable_logging          = true
      target_service_accounts = ["fw-test-svc-acct@${var.project_id}.iam.gserviceaccount.com"]
      match = {
        src_ip_ranges  = ["10.100.0.3/32"]
        dest_ip_ranges = ["10.100.0.103/32"]
        layer4_configs = [
          {
            ip_protocol = "tcp"
            ports       = ["80"]
          },
        ]
      }
    },
    {
      priority       = "101"
      direction      = "EGRESS"
      action         = "allow"
      rule_name      = "egress-101"
      description    = "test egress rule 101"
      enable_logging = true
      match = {
        src_ip_ranges             = ["10.100.0.2/32"]
        dest_fqdns                = ["example.com"]
        dest_region_codes         = ["US"]
        dest_threat_intelligences = ["iplist-public-clouds"]
        layer4_configs = [
          {
            ip_protocol = "all"
          },
        ]
      }
    },
    {
      priority    = "102"
      direction   = "EGRESS"
      action      = "deny"
      rule_name   = "egress-102"
      disabled    = true
      description = "test egress rule 102"
      match = {
        src_ip_ranges     = ["10.100.0.102/32"]
        dest_ip_ranges    = ["10.100.0.2/32"]
        dest_region_codes = ["AR"]
        layer4_configs = [
          {
            ip_protocol = "all"
          },
        ]
      }
    },
    {
      priority                = "103"
      direction               = "EGRESS"
      action                  = "allow"
      rule_name               = "egress-103"
      disabled                = true
      description             = "test ingres rule 103"
      enable_logging          = true
      target_service_accounts = ["fw-test-svc-acct@${var.project_id}.iam.gserviceaccount.com"]
      match = {
        dest_ip_ranges = ["10.100.0.103/32"]
        layer4_configs = [
          {
            ip_protocol = "tcp"
            ports       = ["80", "8080", "8081-8085"]
          },
        ]
      }
    }
  ]
}
```

--------------------------------

### Backup Terraform State (Shell)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/docs/upgrading_to_v2.0.md

Pulls the current Terraform state and saves it to a backup file named 'state.bak'. This is a crucial step before performing state modifications.

```Shell
terraform state pull >> state.bak
```

--------------------------------

### Upgrade Terraform Module Version (diff)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/docs/upgrading_to_v2.0.md

Shows the required change in the module source block to upgrade the `terraform-google-modules/terraform-google-network` module from version 1.x to 2.x.

```diff
 module "kubernetes_engine_private_cluster" {
   source  = "terraform-google-modules/network/google"
-  version = "~> 1.5"
+  version = "~> 2.0"

   # ...
 }
```

--------------------------------

### Renaming Second Subnet State with for_each Key (Step 4)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/docs/upgrading_to_v2.0.md

This command renames the state of the second subnet (index 1) within the moved collection to its new address using the 'for_each' key format. This continues the process of mapping list indices to 'for_each' keys.

```Shell
terraform state mv module.example.module.test-vpc-module.module.subnets.google_compute_subnetwork.subnetwork[1] module.example.module.test-vpc-module.module.subnets.google_compute_subnetwork.subnetwork["us-west1/simple-project-timh-subnet-02"]
```

--------------------------------

### Migrating Terraform Subnet State (Step 2)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/docs/upgrading_to_v2.0.md

This command moves the state of the subnetwork resource collection from its original address to a new address within a refactored module structure. This is a prerequisite for renaming individual subnets when using 'for_each'.

```Shell
terraform state mv module.example.module.test-vpc-module.google_compute_subnetwork.subnetwork module.example.module.test-vpc-module.module.subnets.google_compute_subnetwork.subnetwork
```

--------------------------------

### Renaming First Subnet State with for_each Key (Step 3)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/docs/upgrading_to_v2.0.md

This command renames the state of the first subnet (index 0) within the moved collection to its new address using the 'for_each' key format. Note the necessity to escape the quotes around the 'for_each' key.

```Shell
terraform state mv module.example.module.test-vpc-module.module.subnets.google_compute_subnetwork.subnetwork[0] module.example.module.test-vpc-module.module.subnets.google_compute_subnetwork.subnetwork["us-west1/simple-project-timh-subnet-01"]
```

--------------------------------

### Creating VPC Firewall Rule with Terraform

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/firewall-rules/README.md

This snippet demonstrates the basic usage of the Terraform module to create a custom VPC firewall rule. It defines an ingress rule named 'allow-ssh-ingress' that permits TCP traffic on port 22 from any source IP range (0.0.0.0/0) to destinations within the 10.0.0.0/8 range, with logging enabled.

```HCL
module "firewall_rules" {
  source       = "terraform-google-modules/network/google//modules/firewall-rules"
  project_id   = var.project_id
  network_name = module.vpc.network_name

  rules = [{
    name                    = "allow-ssh-ingress"
    description             = null
    direction               = "INGRESS"
    priority                = null
    destination_ranges      = ["10.0.0.0/8"]
    source_ranges           = ["0.0.0.0/0"]
    source_tags             = null
    source_service_accounts = null
    target_tags             = null
    target_service_accounts = null
    allow = [{
      protocol = "tcp"
      ports    = ["22"]
    }]
    deny = []
    log_config = {
      metadata = "INCLUDE_ALL_METADATA"
    }
  }]
}
```

--------------------------------

### Creating Hierarchical Firewall Policy Module in Terraform

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/hierarchical-firewall-policy/README.md

This Terraform code block instantiates the `hierarchical-firewall-policy` module. It configures the policy name, parent node, target folders, target organization, and includes a placeholder for defining firewall rules.

```Terraform
module "hierarchical_firewall_policy" {
  source         = "terraform-google-modules/network/google//modules/hierarchical-firewall-policy"
  version        = "~> 11.0"

  parent_node    = "folders/123456789012"
  policy_name    = "test-policy"
  description    = "test firewall policy"
  target_folders = ["123456789012", "987654321098"]
  target_org     = "123456123456"

  rules = [
    {},
    {},
  ]
}
```

--------------------------------

### Defining Ingress Rule Type in Terraform HCL

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/README.md

Defines the expected structure for objects within the `ingress_rules` list variable. Each object configures a Google Cloud firewall ingress rule, specifying properties like name, description, priority, source/destination ranges, tags, service accounts, allowed/denied protocols/ports, and logging.

```HCL
list(object({
    name                    = string
    description             = optional(string, null)
    disabled                = optional(bool, null)
    priority                = optional(number, null)
    destination_ranges      = optional(list(string), [])
    source_ranges           = optional(list(string), [])
    source_tags             = optional(list(string))
    source_service_accounts = optional(list(string))
    target_tags             = optional(list(string))
    target_service_accounts = optional(list(string))

    allow = optional(list(object({
      protocol = string
      ports    = optional(list(string))
    })), [])
    deny = optional(list(object({
      protocol = string
      ports    = optional(list(string))
    })), [])
    log_config = optional(object({
      metadata = string
    }))
  }))
```

--------------------------------

### Defining Network Firewall Policy Rules Structure - Terraform HCL

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/network-firewall-policy/README.md

This code snippet defines the complex object structure expected for the 'rules' input variable in the Terraform module. It specifies the various attributes available for configuring individual firewall policy rules, including priority, direction, action, match criteria (IP ranges, FQDNs, tags, etc.), and optional settings like logging and mirroring.

```HCL
list(object({
    priority                = number
    direction               = string
    action                  = string
    rule_name               = optional(string)
    disabled                = optional(bool)
    description             = optional(string)
    enable_logging          = optional(bool)
    target_secure_tags      = optional(list(string))
    target_service_accounts = optional(list(string))
    match = object({
      src_ip_ranges             = optional(list(string), [])
      src_fqdns                 = optional(list(string), [])
      src_region_codes          = optional(list(string), [])
      src_secure_tags           = optional(list(string), [])
      src_threat_intelligences  = optional(list(string), [])
      src_address_groups        = optional(list(string), [])
      dest_ip_ranges            = optional(list(string), [])
      dest_fqdns                = optional(list(string), [])
      dest_region_codes         = optional(list(string), [])
      dest_threat_intelligences = optional(list(string), [])
      dest_address_groups       = optional(list(string), [])
      layer4_configs = optional(list(object({
        ip_protocol = optional(string, "all")
        ports       = optional(list(string), [])
      })), [{}])
    })
    is_mirroring              = optional(bool, false)
    tls_inspect               = optional(bool, false)
    security_profile_group_id = optional(string)
    src_networks              = optional(list(string), [])
    src_network_scope         = optional(string)
    dest_network_scope        = optional(string)
  }))
```

--------------------------------

### Outputting Google Compute Route Name (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/examples/routes/outputs.md

Defines an output variable named 'route_name' that exports the name of the Google Compute Route created by the module. This allows other modules or users to reference the created route.

```HCL
output "route_name" {
  value       = module.google_compute_route.google_compute_route.route
  description = "The name of the route being created"
}
```

--------------------------------

### Terraform Subnet Object Type Definition

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/README.md

Defines the structure of the object used within the `subnets` list variable. Each object represents a single subnet configuration, specifying its name, IP range, region, and various optional settings like private access, flow logs, and description.

```HCL
list(object({
    subnet_name                      = string
    subnet_ip                        = string
    subnet_region                    = string
    subnet_private_access            = optional(string)
    subnet_private_ipv6_access       = optional(string)
    subnet_flow_logs                 = optional(string)
    subnet_flow_logs_interval        = optional(string)
    subnet_flow_logs_sampling        = optional(string)
    subnet_flow_logs_metadata        = optional(string)
    subnet_flow_logs_filter          = optional(string)
    subnet_flow_logs_metadata_fields = optional(list(string))
    description                      = optional(string)
    purpose                          = optional(string)
    role                             = optional(string)
    stack_type                       = optional(string)
    ipv6_access_type                 = optional(string)
  }))
```

--------------------------------

### Defining Egress Rule Type in Terraform HCL

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/README.md

Defines the expected structure for objects within the `egress_rules` list variable. Each object configures a Google Cloud firewall egress rule, specifying properties like name, description, priority, source/destination ranges, tags, service accounts, allowed/denied protocols/ports, and logging.

```HCL
list(object({
    name                    = string
    description             = optional(string, null)
    disabled                = optional(bool, null)
    priority                = optional(number, null)
    destination_ranges      = optional(list(string), [])
    source_ranges           = optional(list(string), [])
    source_tags             = optional(list(string))
    source_service_accounts = optional(list(string))
    target_tags             = optional(list(string))
    target_service_accounts = optional(list(string))

    allow = optional(list(object({
      protocol = string
      ports    = optional(list(string))
    })), [])
    deny = optional(list(object({
      protocol = string
      ports    = optional(list(string))
    })), [])
    log_config = optional(object({
      metadata = string
    }))
  }))
```

--------------------------------

### Basic VPC Network Peering in GCP (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/network-peering/README.md

This snippet shows the basic usage of the Terraform module to create a VPC network peering between two Google Cloud networks. It requires specifying the module source, version, a name prefix, and the self links of the local and peer networks.

```HCL
module "peering" {
  source  = "terraform-google-modules/network/google//modules/network-peering"
  version = "~> 11.0"

  prefix        = "name-prefix"
  local_network = "<FIRST NETWORK SELF LINK>"
  peer_network  = "<SECOND NETWORK SELF LINK>"
}
```

--------------------------------

### Defining Firewall Rule Type (Deprecated) in Terraform HCL

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/README.md

Defines the expected structure for objects within the deprecated `firewall_rules` list variable. Each object configures a Google Cloud firewall rule, including direction, name, description, priority, ranges, source/target tags, service accounts, allowed/denied protocols/ports, and logging.

```HCL
list(object({
    name                    = string
    description             = optional(string, null)
    direction               = optional(string, "INGRESS")
    disabled                = optional(bool, null)
    priority                = optional(number, null)
    ranges                  = optional(list(string), [])
    source_tags             = optional(list(string))
    source_service_accounts = optional(list(string))
    target_tags             = optional(list(string))
    target_service_accounts = optional(list(string))

    allow = optional(list(object({
      protocol = string
      ports    = optional(list(string))
    })), [])
    deny = optional(list(object({
      protocol = string
      ports    = optional(list(string))
    })), [])
    log_config = optional(object({
      metadata = string
    }))
  }))
```

--------------------------------

### Default http_target_tags Value (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/fabric-net-firewall/README.md

Sets the default value for the 'http_target_tags' variable, a list containing the tag 'http-server', used to identify target instances for HTTP firewall rules.

```HCL
[
  "http-server"
]
```

--------------------------------

### Terraform State Move Error (Single Resource Issue)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/docs/upgrading_to_v2.0.md

This error message indicates a failure during 'terraform mv' when attempting to move a single resource that was previously part of a collection (like a list) to a 'for_each' block, due to a known issue in Terraform.

```Shell
Error: Invalid target address

Cannot move to
module.example.module.test-vpc-module-01.module.routes.google_compute_route.route["multi-vpc-a1-01-egress-inet"]:
module.example.module.test-vpc-module-01.module.routes.google_compute_route.route
does not exist in the current state.
```

--------------------------------

### Default http_source_ranges Value (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/fabric-net-firewall/README.md

Specifies the default value for the 'http_source_ranges' variable, which is a list containing the CIDR block '0.0.0.0/0', allowing HTTP traffic from any IP address.

```HCL
[
  "0.0.0.0/0"
]
```

--------------------------------

### Default https_target_tags Value (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/fabric-net-firewall/README.md

Sets the default value for the 'https_target_tags' variable, a list containing the tag 'https-server', used to identify target instances for HTTPS firewall rules.

```HCL
[
  "https-server"
]
```

--------------------------------

### Configure Shared VPC Access using Terraform Module

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/fabric-net-svpc-access/README.md

This snippet demonstrates the basic usage of the `fabric-net-svpc-access` Terraform module. It configures a service project (`my-service-project-id`) to access a Shared VPC hosted in `my-host-project-id`, specifying subnet access and assigning roles to users and service accounts.

```HCL
module "net-shared-vpc-access" {
  source              = "terraform-google-modules/network/google//modules/fabric-net-svpc-access"
  version             = "~> 11.0"

  host_project_id     = "my-host-project-id"
  service_project_num = 1
  service_project_ids = ["my-service-project-id"]
  host_subnets        = ["my-subnet"]
  host_subnet_regions = ["europe-west1"]
  host_subnet_users   = {
    my-subnet = "group:my-service-owners@example.org,serviceAccount:1234567890@cloudservices.gserviceaccount.com"
  }
  host_service_agent_role = true
  host_service_agent_users = [
    "serviceAccount:service-123456789@container-engine-robot.iam.gserviceaccount.com"
  ]
}
```

--------------------------------

### Define internal_allow Variable Type (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/fabric-net-firewall/README.md

Defines the list of objects structure for the 'internal_allow' variable, used to specify protocols and optional ports allowed for internal network ranges.

```HCL
list(object({
    protocol = string
    ports    = optional(list(string))
  }))
```

--------------------------------

### Default https_source_ranges Value (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/fabric-net-firewall/README.md

Specifies the default value for the 'https_source_ranges' variable, which is a list containing the CIDR block '0.0.0.0/0', allowing HTTPS traffic from any IP address.

```HCL
[
  "0.0.0.0/0"
]
```

--------------------------------

### Default internal_allow Value (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/fabric-net-firewall/README.md

Sets the default value for the 'internal_allow' variable, which is a list containing an object allowing the 'icmp' protocol for internal ranges.

```HCL
[
  {
    "protocol": "icmp"
  }
]
```

--------------------------------

### Define custom_rules Variable Type (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/fabric-net-firewall/README.md

Defines the complex object structure for the 'custom_rules' variable, used to specify custom firewall rules with detailed attributes like direction, action, ranges, targets, and protocols/ports.

```HCL
map(object({
    description          = string
    direction            = string
    action               = string # (allow|deny)
    ranges               = list(string)
    sources              = list(string)
    targets              = list(string)
    use_service_accounts = bool
    rules = list(object({
      protocol = string
      ports    = list(string)
    }))
    extra_attributes = map(string)
  }))
```

--------------------------------

### Custom Firewall Rule Type Definition (HCL)

Source: https://github.com/terraform-google-modules/terraform-google-network/blob/main/modules/fabric-net-firewall/README.md

Defines the structure for custom firewall rules within the module. Each rule is an object specifying direction, action, IP ranges, sources, targets, service account usage, protocols/ports, and optional extra attributes like priority or disabled status.

```HCL
map(object({
  description          = string
  direction            = string       # (INGRESS|EGRESS)
  action               = string       # (allow|deny)
  ranges               = list(string) # list of IP CIDR ranges
  sources              = list(string) # tags or SAs (ignored for EGRESS)
  targets              = list(string) # tags or SAs
  use_service_accounts = bool         # use tags or SAs in sources/targets
  rules = list(object({
    protocol = string
    ports    = list(string)
  }))
  extra_attributes = map(string)      # map, optional keys disabled or priority
}))
```