Terraform Provider for Google Cloud

https://registry.terraform.io/providers/hashicorp/google/latest/docs
Admin
The Terraform Provider for Google Cloud is used to configure and manage your Google Cloud...
Tokens:1,414,727
Snippets:8,015
Trust Score:10
Update:1 day ago
Show doc for...
Tokens:
Raw
### Internal Load Balancing Setup with Instance Template, Health Check, MIG, Firewalls, and Test Instance

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_forwarding_rule

This snippet shows a complete internal load balancing setup. It includes an instance template with a startup script that installs nginx and serves a web page, a region health check, a managed instance group, firewalls for health check and internal communication, and a test instance. The instance template uses create_before_destroy lifecycle and the health check and MIG use the google-beta provider.

```hcl
  network_interface {
    network    = google_compute_network.ilb_network.id
    subnetwork = google_compute_subnetwork.ilb_subnet.id
    access_config {
      # add external ip to fetch packages
    }
  }
  disk {
    source_image = "debian-cloud/debian-12"
    auto_delete  = true
    boot         = true
  }

  # install nginx and serve a simple web page
  metadata = {
    startup-script = <<-EOF1
      #! /bin/bash
      set -euo pipefail

      export DEBIAN_FRONTEND=noninteractive
      apt-get update
      apt-get install -y nginx-light jq

      NAME=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/hostname")
      IP=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip")
      METADATA=$(curl -f -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=True" | jq 'del(.["startup-script"])')

      cat <<EOF > /var/www/html/index.html
      <pre>
      Name: $NAME
      IP: $IP
      Metadata: $METADATA
      </pre>
      EOF
    EOF1
  }
  lifecycle {
    create_before_destroy = true
  }
}
```

```hcl
# health check
resource "google_compute_region_health_check" "default" {
  name     = "l4-ilb-hc"
  provider = google-beta
  region   = "europe-west1"
  http_health_check {
    port = "80"
  }
}
```

```hcl
# MIG
resource "google_compute_region_instance_group_manager" "mig" {
  name     = "l4-ilb-mig1"
  provider = google-beta
  region   = "europe-west1"
  version {
    instance_template = google_compute_instance_template.instance_template.id
    name              = "primary"
  }
  base_instance_name = "vm"
  target_size        = 2
}
```

```hcl
# allow all access from health check ranges
resource "google_compute_firewall" "fw_hc" {
  name          = "l4-ilb-fw-allow-hc"
  provider      = google-beta
  direction     = "INGRESS"
  network       = google_compute_network.ilb_network.id
  source_ranges = ["130.211.0.0/22", "35.191.0.0/16", "35.235.240.0/20"]
  allow {
    protocol = "tcp"
  }
  target_tags = ["allow-health-check"]
}
```

```hcl
# allow communication within the subnet 
resource "google_compute_firewall" "fw_ilb_to_backends" {
  name          = "l4-ilb-fw-allow-ilb-to-backends"
  provider      = google-beta
  direction     = "INGRESS"
  network       = google_compute_network.ilb_network.id
  source_ranges = ["10.0.1.0/24"]
  allow {
    protocol = "tcp"
  }
  allow {
    protocol = "udp"
  }
  allow {
    protocol = "icmp"
  }
}
```

```hcl
# allow SSH
resource "google_compute_firewall" "fw_ilb_ssh" {
  name          = "l4-ilb-fw-ssh"
  provider      = google-beta
  direction     = "INGRESS"
  network       = google_compute_network.ilb_network.id
  allow {
    protocol = "tcp"
    ports = ["22"]
  }
  target_tags   = ["allow-ssh"]
  source_ranges = ["0.0.0.0/0"]
}
```

```hcl
# test instance
resource "google_compute_instance" "vm_test" {
  name         = "l4-ilb-test-vm"
  provider     = google-beta
  zone         = "europe-west1-b"
  machine_type = "e2-small"
  network_interface {
    network    = google_compute_network.ilb_network.id
    subnetwork = google_compute_subnetwork.ilb_subnet.id
  }
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
    }
  }
}
```

--------------------------------

### Example resource ID for a compute instance

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/getting_started

Example of a resource ID for a compute instance in a project named `foo`.

```text
projects/foo/zones/us-central1-c/instances/terraform-instance
```

--------------------------------

### Get database info with google_sql_database data source

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/sql_database

Use this data source to get information about a database in a Cloud SQL instance. The example retrieves a database named 'test-sql-database' from the instance referenced by google_sql_database_instance.main.name.

```hcl
data "google_sql_database" "qa" {
  name = "test-sql-database"
  instance = google_sql_database_instance.main.name
}
```

--------------------------------

### Create a google_compute_target_instance with network, VM, and security policies

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_target_instance

This example creates a target instance with a custom network, subnetwork, VM instance, and security policies. It uses the google-beta provider and sets the security_policy on the target instance. The example includes resources for network, subnetwork, VM image, VM instance, region security policy for DDoS protection, edge security service, and a basic region security policy.

```hcl
resource "google_compute_network" "default" {
  provider                = google-beta
  name                    = "custom-default-network"
  auto_create_subnetworks = false
  routing_mode            = "REGIONAL"
}
      
resource "google_compute_subnetwork" "default" {
  provider                   = google-beta
  name                       = "custom-default-subnet"
  ip_cidr_range              = "10.1.2.0/24"
  network                    = google_compute_network.default.id
  private_ipv6_google_access = "DISABLE_GOOGLE_ACCESS"
  purpose                    = "PRIVATE"
  region                     = "southamerica-west1"
  stack_type                 = "IPV4_ONLY"
}

data "google_compute_image" "vmimage" {
  provider = google-beta
  family   = "debian-13"
  project  = "debian-cloud"
}

resource "google_compute_instance" "target-vm" {
  provider     = google-beta
  name         = "target-vm"
  machine_type = "e2-medium"
  zone         = "southamerica-west1-a"

  boot_disk {
    initialize_params {
      image = data.google_compute_image.vmimage.self_link
    }
  }

  network_interface {       
    network = google_compute_network.default.self_link
    subnetwork = google_compute_subnetwork.default.self_link
    access_config {
    }
  }
}

resource "google_compute_region_security_policy" "policyddosprotection" {
  provider    = google-beta
  region      = "southamerica-west1"
  name        = "tf-test-policyddos%{random_suffix}"
  description = "ddos protection security policy to set target instance"
  type        = "CLOUD_ARMOR_NETWORK"
  ddos_protection_config {
    ddos_protection = "ADVANCED_PREVIEW"
  }
}

resource "google_compute_network_edge_security_service" "edge_sec_service" {
  provider        = google-beta
  region          = "southamerica-west1"
  name            = "tf-test-edgesec%{random_suffix}"
  security_policy = google_compute_region_security_policy.policyddosprotection.self_link
}

resource "google_compute_region_security_policy" "regionsecuritypolicy" {
  provider    = google-beta
  name        = "region-secpolicy"
  region      = "southamerica-west1"
  description = "basic security policy for target instance"
  type        = "CLOUD_ARMOR_NETWORK"
  depends_on  = [google_compute_network_edge_security_service.edge_sec_service]
}

resource "google_compute_target_instance" "default" {
  provider        = google-beta
  name            = "target-instance"
  zone            = "southamerica-west1-a"
  instance        = google_compute_instance.target-vm.id
  security_policy = google_compute_region_security_policy.regionsecuritypolicy.self_link
}

```

--------------------------------

### Create a custom image with guest OS features

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_image

This example extends the basic image creation by adding guest OS features: UEFI_COMPATIBLE, VIRTIO_SCSI_MULTIQUEUE, GVNIC, SEV_CAPABLE, and SEV_LIVE_MIGRATABLE_V2. The image is named 'example-image'.

```hcl
data "google_compute_image" "debian" {
  family  = "debian-12"
  project = "debian-cloud"
}

resource "google_compute_disk" "persistent" {
  name  = "example-disk"
  image = data.google_compute_image.debian.self_link
  size  = 10
  type  = "pd-ssd"
  zone  = "us-central1-a"
}

resource "google_compute_image" "example" {
  name = "example-image"

  source_disk = google_compute_disk.persistent.id

  guest_os_features {
    type = "UEFI_COMPATIBLE"
  }

  guest_os_features {
    type = "VIRTIO_SCSI_MULTIQUEUE"
  }

  guest_os_features {
    type = "GVNIC"
  }

  guest_os_features {
    type = "SEV_CAPABLE"
  }

  guest_os_features {
    type = "SEV_LIVE_MIGRATABLE_V2"
  }
}
```

--------------------------------

### Router Peer Router Appliance

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_router_peer

Creates a complete router appliance setup including network, subnetwork, addresses, instance, hub, spoke, router, interfaces, and peer. The peer uses router_appliance_instance and peer_ip_address. This example is from the 'Example Usage - Router Peer Router Appliance' section.

```hcl
resource "google_compute_network" "network" {
  name                    = "my-router-net"
  auto_create_subnetworks = false
}

resource "google_compute_subnetwork" "subnetwork" {
  name          = "my-router-sub"
  network       = google_compute_network.network.self_link
  ip_cidr_range = "10.0.0.0/16"
  region        = "us-central1"
}

resource "google_compute_address" "addr_intf" {
  name         = "my-router-addr-intf"
  region       = google_compute_subnetwork.subnetwork.region
  subnetwork   = google_compute_subnetwork.subnetwork.id
  address_type = "INTERNAL"
}

resource "google_compute_address" "addr_intf_redundant" {
  name         = "my-router-addr-intf-red"
  region       = google_compute_subnetwork.subnetwork.region
  subnetwork   = google_compute_subnetwork.subnetwork.id
  address_type = "INTERNAL"
}

resource "google_compute_address" "addr_peer" {
  name         = "my-router-addr-peer"
  region       = google_compute_subnetwork.subnetwork.region
  subnetwork   = google_compute_subnetwork.subnetwork.id
  address_type = "INTERNAL"
}

resource "google_compute_instance" "instance" {
  name           = "router-appliance"
  zone           = "us-central1-a"
  machine_type   = "e2-medium"
  can_ip_forward = true

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }

  network_interface {
    network_ip = google_compute_address.addr_peer.address
    subnetwork = google_compute_subnetwork.subnetwork.self_link
  }
}

resource "google_network_connectivity_hub" "hub" {
  name = "my-router-hub"
}

resource "google_network_connectivity_spoke" "spoke" {
  name     = "my-router-spoke"
  location = google_compute_subnetwork.subnetwork.region
  hub      = google_network_connectivity_hub.hub.id

  linked_router_appliance_instances {
    instances {
      virtual_machine = google_compute_instance.instance.self_link
      ip_address      = google_compute_address.addr_peer.address
    }
    site_to_site_data_transfer = false
  }
}

resource "google_compute_router" "router" {
  name    = "my-router-router"
  region  = google_compute_subnetwork.subnetwork.region
  network = google_compute_network.network.self_link
  bgp {
    asn = 64514
  }
}

resource "google_compute_router_interface" "interface_redundant" {
  name               = "my-router-intf-red"
  region             = google_compute_router.router.region
  router             = google_compute_router.router.name
  subnetwork         = google_compute_subnetwork.subnetwork.self_link
  private_ip_address = google_compute_address.addr_intf_redundant.address
}

resource "google_compute_router_interface" "interface" {
  name                = "my-router-intf"
  region              = google_compute_router.router.region
  router              = google_compute_router.router.name
  subnetwork          = google_compute_subnetwork.subnetwork.self_link
  private_ip_address  = google_compute_address.addr_intf.address
  redundant_interface = google_compute_router_interface.interface_redundant.name
}

resource "google_compute_router_peer" "peer" {
  name                      = "my-router-peer"
  router                    = google_compute_router.router.name
  region                    = google_compute_router.router.region
  interface                 = google_compute_router_interface.interface.name
  router_appliance_instance = google_compute_instance.instance.self_link
  peer_asn                  = 65513
  peer_ip_address           = google_compute_address.addr_peer.address
}
```

--------------------------------

### Previous provider version configuration (7.30.0)

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/version_8_upgrade

Example of the previous Terraform configuration with the Google provider version constraint set to ~> 7.30.0. This is the starting point before upgrading to version 8.0.0.

```hcl
terraform {
  required_providers {
    google = {
      version = "~> 7.30.0"
    }
  }
}
```

--------------------------------

### Instance Template with Startup Script

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_global_forwarding_rule

Defines a Google Compute instance template with a startup script that installs Apache and serves a simple web page. The startup script uses the metadata server to fetch instance details and writes an HTML page. The lifecycle block sets create_before_destroy to true.

```hcl
# install nginx and serve a simple web page
  metadata = {
    startup-script = <<-EOF1
      #! /bin/bash
      set -euo pipefail
      export DEBIAN_FRONTEND=noninteractive
      sudo apt-get update
      sudo apt-get install  -y apache2 jq
      sudo a2ensite default-ssl
      sudo a2enmod ssl
      sudo service apache2 restart
      NAME=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/hostname")
      IP=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip")
      METADATA=$(curl -f -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=True" | jq 'del(.["startup-script"])')
      cat <<EOF > /var/www/html/index.html
      <h1>SSL Load Balancer</h1>
      <pre>
      Name: $NAME
      IP: $IP
      Metadata: $METADATA
      </pre>
      EOF
    EOF1
  }
  lifecycle {
    create_before_destroy = true
  }
}
```

--------------------------------

### Get info about a Google Compute SSL Certificate

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/compute_ssl_certificate

Use the google_compute_ssl_certificate data source to retrieve details of an SSL certificate by name. The example outputs the certificate, certificate_id, and self_link attributes.

```hcl
data "google_compute_ssl_certificate" "my_cert" {
  name = "my-cert"
}

output "certificate" {
  value = data.google_compute_ssl_certificate.my_cert.certificate
}

output "certificate_id" {
  value = data.google_compute_ssl_certificate.my_cert.certificate_id
}

output "self_link" {
  value = data.google_compute_ssl_certificate.my_cert.self_link
}
```

--------------------------------

### Create a region instance template with service account and disks

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_region_instance_template

This example creates a google_compute_region_instance_template with a custom service account, boot disk from an image, an existing disk, and a daily backup resource policy. It also creates the supporting resources: a service account, a region disk, a disk, a snapshot, and a resource policy. The template uses e2-medium machine type, tags, labels, and a network interface on the default network.

```hcl
resource "google_service_account" "default" {
  account_id   = "service-account-id"
  display_name = "Service Account"
}

resource "google_compute_region_instance_template" "default" {
  name        = "appserver-template"
  description = "This template is used to create app server instances."

  tags = ["foo", "bar"]

  labels = {
    environment = "dev"
  }

  instance_description = "description assigned to instances"
  machine_type         = "e2-medium"
  can_ip_forward       = false

  scheduling {
    automatic_restart   = true
    on_host_maintenance = "MIGRATE"
  }

  // Create a new boot disk from an image
  disk {
    source_image      = "debian-cloud/debian-11"
    auto_delete       = true
    boot              = true
    // backup the disk every day
    resource_policies = [google_compute_resource_policy.daily_backup.id]
  }

  // Use an existing disk resource
  disk {
    source      = google_compute_region_disk.foobar.self_link
    auto_delete = false
    boot        = false
  }

  network_interface {
    network = "default"
  }

  metadata = {
    foo = "bar"
  }

  service_account {
    # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
    email  = google_service_account.default.email
    scopes = ["cloud-platform"]
  }
}

data "google_compute_image" "my_image" {
  family  = "debian-11"
  project = "debian-cloud"
}

resource "google_compute_region_disk" "foobar" {
  name  = "existing-disk"
  snapshot                  = google_compute_snapshot.snap_disk.id
  type                      = "pd-ssd"
  region                    = "us-central1"
  physical_block_size_bytes = 4096

  replica_zones = ["us-central1-a", "us-central1-f"]
}

resource "google_compute_disk" "disk" {
  name  = "foo"
  image = data.google_compute_image.my_image.self_link
  size  = 10
  type  = "pd-ssd"
  zone  = "us-central1-a"
}

resource "google_compute_snapshot" "snap_disk" {
  name        = "snapDisk"
  source_disk = google_compute_disk.disk.name
  zone        = "us-central1-a"
}

resource "google_compute_resource_policy" "daily_backup" {
  name   = "every-day-4am"
  region = "us-central1"
  snapshot_schedule_policy {
    schedule {
      daily_schedule {
        days_in_cycle = 1
        start_time    = "04:00"
      }
    }
  }
}

```

--------------------------------

### Retrieve default service account with google_compute_default_service_account

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/compute_default_service_account

Use this data source to get the default service account for the provider project. The example outputs the email address of the default service account.

```hcl
data "google_compute_default_service_account" "default" {
}

output "default_account" {
  value = data.google_compute_default_service_account.default.email
}

```

--------------------------------

### Configure google-beta provider and data source for google_compute_resource_policy

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/compute_resource_policy

This example configures the google-beta provider and uses the google_compute_resource_policy data source to retrieve a resource policy named 'daily' in the 'us-central1' region. The provider block sets the region and zone, and the data source references the provider explicitly.

```hcl
provider "google-beta" {
  region = "us-central1"
  zone   = "us-central1-a"
}

data "google_compute_resource_policy" "daily" {
  provider = google-beta
  name     = "daily"
  region   = "us-central1"
}

```

--------------------------------

### Retrieve default App Engine service account

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/app_engine_default_service_account

Use this data source to get the default App Engine service account for the project. The example outputs the email address of the account.

```hcl
data "google_app_engine_default_service_account" "default" {
}

output "default_account" {
  value = data.google_app_engine_default_service_account.default.email
}
```

--------------------------------

### Terraform configuration for internal managed load balancer

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_global_forwarding_rule

This example creates a complete internal managed load balancer setup using the google-beta provider. It includes a backend subnet, a global forwarding rule with load_balancing_scheme INTERNAL_MANAGED, a target HTTP proxy, a URL map, a backend service, an instance template with a startup script that installs nginx, a health check, a managed instance group, firewalls for IAP and health check ranges, and a test instance. The forwarding rule depends on the proxy subnet and targets the HTTP proxy.

```hcl
# backend subnet
resource "google_compute_subnetwork" "gilb_subnet" {
  name          = "l7-gilb-subnet"
  provider      = google-beta
  ip_cidr_range = "10.0.1.0/24"
  region        = "europe-west1"
  network       = google_compute_network.gilb_network.id
}

# forwarding rule
resource "google_compute_global_forwarding_rule" "google_compute_forwarding_rule" {
  name                  = "l7-gilb-forwarding-rule"
  provider              = google-beta
  depends_on            = [google_compute_subnetwork.proxy_subnet]
  ip_protocol           = "TCP"
  load_balancing_scheme = "INTERNAL_MANAGED"
  port_range            = "80"
  target                = google_compute_target_http_proxy.default.id
  network               = google_compute_network.gilb_network.id
  subnetwork            = google_compute_subnetwork.gilb_subnet.id
}

# HTTP target proxy
resource "google_compute_target_http_proxy" "default" {
  name     = "l7-gilb-target-http-proxy"
  provider = google-beta
  url_map  = google_compute_url_map.default.id
}

# URL map
resource "google_compute_url_map" "default" {
  name            = "l7-gilb-url-map"
  provider        = google-beta
  default_service = google_compute_backend_service.default.id
}

# backend service
resource "google_compute_backend_service" "default" {
  name                  = "l7-gilb-backend-subnet"
  provider              = google-beta
  protocol              = "HTTP"
  load_balancing_scheme = "INTERNAL_MANAGED"
  timeout_sec           = 10
  health_checks         = [google_compute_health_check.default.id]
  backend {
    group           = google_compute_instance_group_manager.mig.instance_group
    balancing_mode  = "UTILIZATION"
    capacity_scaler = 1.0
  }
}

# instance template
resource "google_compute_instance_template" "instance_template" {
  name         = "l7-gilb-mig-template"
  provider     = google-beta
  machine_type = "e2-small"
  tags         = ["http-server"]

  network_interface {
    network    = google_compute_network.gilb_network.id
    subnetwork = google_compute_subnetwork.gilb_subnet.id
    access_config {
      # add external ip to fetch packages
    }
  }
  disk {
    source_image = "debian-cloud/debian-12"
    auto_delete  = true
    boot         = true
  }

  # install nginx and serve a simple web page
  metadata = {
    startup-script = <<-EOF1
      #! /bin/bash
      set -euo pipefail

      export DEBIAN_FRONTEND=noninteractive
      apt-get update
      apt-get install -y nginx-light jq

      NAME=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/hostname")
      IP=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip")
      METADATA=$(curl -f -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=True" | jq 'del(.["startup-script"])')

      cat <<EOF > /var/www/html/index.html
      <pre>
      Name: $NAME
      IP: $IP
      Metadata: $METADATA
      </pre>
      EOF
    EOF1
  }
  lifecycle {
    create_before_destroy = true
  }
}

# health check
resource "google_compute_health_check" "default" {
  name     = "l7-gilb-hc"
  provider = google-beta
  http_health_check {
    port_specification = "USE_SERVING_PORT"
  }
}

# MIG
resource "google_compute_instance_group_manager" "mig" {
  name     = "l7-gilb-mig1"
  provider = google-beta
  zone = "europe-west1-b"
  version {
    instance_template = google_compute_instance_template.instance_template.id
    name              = "primary"
  }
  base_instance_name = "vm"
  target_size        = 2
}

# allow all access from IAP and health check ranges
resource "google_compute_firewall" "fw-iap" {
  name          = "l7-gilb-fw-allow-iap-hc"
  provider      = google-beta
  direction     = "INGRESS"
  network       = google_compute_network.gilb_network.id
  source_ranges = ["130.211.0.0/22", "35.191.0.0/16", "35.235.240.0/20"]
  allow {
    protocol = "tcp"
  }
}

# allow http from proxy subnet to backends
resource "google_compute_firewall" "fw-gilb-to-backends" {
  name          = "l7-gilb-fw-allow-gilb-to-backends"
  provider      = google-beta
  direction     = "INGRESS"
  network       = google_compute_network.gilb_network.id
  source_ranges = ["10.0.0.0/24"]
  target_tags   = ["http-server"]
  allow {
    protocol = "tcp"
    ports    = ["80", "443", "8080"]
  }
}

# test instance
resource "google_compute_instance" "vm-test" {
  name         = "l7-gilb-test-vm"
  provider     = google-beta
  zone         = "europe-west1-b"
  machine_type = "e2-small"
  network_interface {
    network    = google_compute_network.gilb_network.id
    subnetwork = google_compute_subnetwork.gilb_subnet.id
  }
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
    }
  }
}
```

--------------------------------

### Stateful RIGM Example

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_region_per_instance_config

Creates a regional instance group manager with a per-instance config that preserves stateful metadata and a disk. The example includes an instance template, a regional instance group manager, a disk, and the per-instance config. Note the comment about adding a reference to the instance template in metadata to ensure updates on the stateful instance.

```hcl
data "google_compute_image" "my_image" {
  family  = "debian-13"
  project = "debian-cloud"
}

resource "google_compute_instance_template" "igm-basic" {
  name           = "my-template"
  machine_type   = "e2-medium"
  can_ip_forward = false
  tags           = ["foo", "bar"]

  disk {
    source_image = data.google_compute_image.my_image.self_link
    auto_delete  = true
    boot         = true
  }

  network_interface {
    network = "default"
  }

  service_account {
    scopes = ["userinfo-email", "compute-ro", "storage-ro"]
  }
}

resource "google_compute_region_instance_group_manager" "rigm" {
  description = "Terraform test instance group manager"
  name        = "my-rigm"

  version {
    name              = "prod"
    instance_template = google_compute_instance_template.igm-basic.self_link
  }

  update_policy {
    type                         = "OPPORTUNISTIC"
    instance_redistribution_type = "NONE"
    minimal_action               = "RESTART"
  }

  base_instance_name = "rigm"
  region             = "us-central1"
  target_size        = 2
}

resource "google_compute_disk" "default" {
  name  = "my-disk-name"
  type  = "pd-ssd"
  zone  = "us-central1-a"
  image = "debian-13-trixie-v20260827"
  physical_block_size_bytes = 4096
}

resource "google_compute_region_per_instance_config" "with_disk" {
  region = google_compute_region_instance_group_manager.igm.region
  region_instance_group_manager = google_compute_region_instance_group_manager.rigm.name
  name = "instance-1"
  preserved_state {
    metadata = {
      foo = "bar"
      // Adding a reference to the instance template used causes the stateful instance to update
      // if the instance template changes. Otherwise there is no explicit dependency and template
      // changes may not occur on the stateful instance
      instance_template = google_compute_instance_template.igm-basic.self_link
    }

    disk {
      device_name = "my-stateful-disk"
      source      = google_compute_disk.default.id
      mode        = "READ_ONLY"
    }
  }
}
```

--------------------------------

### Get all attributes from a single namespace

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/compute_instance_guest_attributes

Retrieves guest attributes from a specific namespace using the query_path parameter. The example fetches attributes from the 'variables/' namespace of the instance named 'primary-application-server' in zone 'us-central1-a'.

```hcl
data "google_compute_instance_guest_attributes" "appserver_ga" {
  name       = "primary-application-server"
  zone       = "us-central1-a"
  query_path = "variables/"
}
```

--------------------------------

### Create basic instance settings with metadata

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance_settings

Defines a google_compute_instance_settings resource in the us-east7-b zone with a metadata item foo=baz.

```hcl
resource "google_compute_instance_settings" "gce_instance_settings" {
  zone = "us-east7-b"
  metadata {
    items = {
      foo = "baz"
    }
  }
}

```

--------------------------------

### Example Usage with multiple versions (google-beta provider)

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance_group_manager

Creates a google_compute_instance_group_manager with two versions, one as the primary and one as a canary with a fixed target size. Uses the google-beta provider.

```hcl
resource "google_compute_instance_group_manager" "appserver" {
  provider = google-beta
  name     = "appserver-igm"

  base_instance_name = "app"
  zone               = "us-central1-a"

  target_size = 5

  version {
    name              = "appserver"
    instance_template = google_compute_instance_template.appserver.self_link_unique
  }

  version {
    name              = "appserver-canary"
    instance_template = google_compute_instance_template.appserver-canary.self_link_unique
    target_size {
      fixed = 1
    }
  }
}

```

--------------------------------

### Get a specific variable with google_compute_instance_guest_attributes

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/compute_instance_guest_attributes

Defines a data source to fetch a guest attribute variable from an instance. The example uses the name, zone, and variable_key arguments to retrieve the value of 'variables/key1' from the instance 'primary-application-server' in 'us-central1-a'.

```hcl
data "google_compute_instance_guest_attributes" "appserver_ga" {
  name         = "primary-application-server"
  zone         = "us-central1-a"
  variable_key = "variables/key1"
}

```

--------------------------------

### Example Usage: google_service_account_key data source

Source: https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/service_account_key

Creates a service account and key, then retrieves the public key using the data source with public_key_type TYPE_X509_PEM_FILE.

```hcl
resource "google_service_account" "myaccount" {
  account_id = "dev-foo-account"
}

resource "google_service_account_key" "mykey" {
  service_account_id = google_service_account.myaccount.name
}

data "google_service_account_key" "mykey" {
  name            = google_service_account_key.mykey.name
  public_key_type = "TYPE_X509_PEM_FILE"
}
```
Tokens:
Raw