Cloud Foundation Fabric

The net-lb-app-ext module is used to manage Google Cloud Global HTTP/HTTPS Classic Load Balancers (GLBs). It is designed to expose the full configuration of the underlying resources while providing sensible defaults for common usage patterns. The module can optionally manage prerequisite resources such as health checks and instance groups.

Important Migration Note: Because the underlying resources are complex, configuration changes that require resource recreation should be applied in stages to minimize impact. A recommended workflow is:

1. Disable the configuration in the urlmap that references the resources needing recreation.
2. Disable the configuration in the backend_service.
3. Proceed with the resource recreation.

The cloudsql-instance module manages the creation of Cloud SQL instances, including support for cross-regional read replicas. It can also provision an initial set of databases and users.

Key Behaviors:

• Inheritance: Replicas inherit most settings from the primary instance (e.g., disks, labels, flags). However, the tier can be overridden per-replica using replicas.<name>.tier.
• Security Warning: If you use the users parameter to define users, their passwords will be stored in plain text within your Terraform state file.

Fabric FAST is a design and reference implementation for setting up a production-ready Google Cloud Platform (GCP) organization. It provides a blueprint for enterprise-grade GCP structures, including typical elements required by large organizations, implemented using Terraform.

While the reference implementation uses Terraform, the FAST design is conceptual and refers only to GCP constructs, meaning it can theoretically be implemented with other tools like Pulumi or direct API calls. It is designed to be scalable for organizations of all sizes, from startups to large enterprises, through various customization points.

The net-lb-app-int module is used to manage Google Cloud Internal HTTP/HTTPS Load Balancers (L7 ILBs). It is designed to expose the full configuration of the underlying resources while providing sensible defaults for common usage patterns. The module can optionally manage prerequisite resources such as health checks and instance groups.

Important Migration Note: Due to the complexity of the underlying resources, if you need to make configuration changes that require resource recreation, it is recommended to apply these changes in stages. A safe sequence is:

1. Disable the configuration in the urlmap that references the resources needing recreation.
2. Disable the configuration in the backend_service.
3. Proceed with the resource recreation.

The SecOps Stage automates the configuration of a Google SecOps instance at both the infrastructure and application levels. It leverages native Terraform resources and the restful_resource to interact with SecOps APIs.

Key capabilities include:

• Enabling APIs and services.
• Configuring Data RBAC with labels and scopes.
• Setting up IAM for the SecOps instance using Cloud Identity groups or Workload Identity Federation (WIF).
• Managing Detection Rules and reference lists via Terraform (using the secops-rules module).
• Setting up API Keys for Webhook feeds.
• Integrating with Google Workspace for alert and log ingestion via SecOps Feeds.

The net-lb-int module manages a Google Compute Engine (GCE) Internal Passthrough Network Load Balancer. It integrates the following resources:

• Forwarding rules
• Regional backends
• Optional health checks

This module is designed to work alongside the compute-vm module, which is typically used to manage instance templates and instance groups that serve as the load balancer's backends.

The Project Factory stage enables simplified management of Google Cloud folder hierarchies and projects using YAML-based configuration files. It acts as a thin wrapper around the project-factory module, which exposes the interfaces of the project and folder modules.

Key features include:

• Context Interpolation: It can consume resources from previous stages (Bootstrap, Networking, Security, VPC SC) using var.context to automatically reference folder IDs, project IDs, IAM principals, tags, KMS keys, and VPC SC perimeters.
• Project Defaults: It allows setting defaults for prefix, billing account, and storage location.
• Multi-pattern Support: Multiple project factories can coexist in a single landing zone, each pointing to different configuration files to implement different organizational patterns (e.g., business units, applications, or teams).