Terraform Google Provider

repository·main·Indexed Jun 23, 2026

https://github.com/hashicorp/terraform-provider-google

The Terraform Google provider manages Google Cloud Platform (GCP) resources. It includes the 'google' provider for generally available features and the 'google-beta' provider for preview and beta features. Key capabilities include managing Compute Engine, GKE, Cloud Storage, Cloud SQL, Spanner IAM, and Cloud Security Compliance frameworks using CEL.

Tokens
1.1M
Snippets
1.9K
Records
4.6K
Agent score
83%

What's inside terraform-provider-google

  1. Retrieve VMwareEngine network details with google_vmwareengine_network

    main

    Use the google_vmwareengine_network data source to fetch information about an existing VMwareEngine network resource. You must provide the name and location of the network. You can optionally specify the project ID; if omitted, the provider's default project is used.

    data "google_vmwareengine_network" "my_nw" {
      name     = "us-central1-default"
      location = "us-central1"
    }
  2. Retrieve a Mesh Istio monitoring service with google_monitoring_mesh_istio_service

    main

    Use the google_monitoring_mesh_istio_service data source to retrieve information about a Monitoring Service that was automatically created by GCP to monitor Mesh Istio services.

    To identify a specific service, you must provide the mesh_uid, service_namespace, and service_name. These values correspond to the meshUid, destination_service_namespace, and destination_service_name metric labels in Istio metrics, respectively.

    data "google_monitoring_mesh_istio_service" "default" {
            mesh_uid = "proj-573164786102"
            service_namespace = "istio-system" 
            service_name = "prometheus"
    }
  3. Retrieve a service attachment with google_compute_service_attachment

    main

    Use the google_compute_service_attachment data source to retrieve information about a specific service attachment within a region. This is useful for accessing attributes of an existing Private Service Connect service attachment.

    data "google_compute_service_attachment" "default" {
      project = "my-project"
      name    = "my-service-attachment"
      region  = "us-west2"
    }
  4. Retrieve VMware Engine network peering details with google_vmwareengine_network_peering

    main

    Use the google_vmwareengine_network_peering data source to fetch information about an existing VMware Engine network peering resource. You must provide the name of the resource to retrieve its details.

    data "google_vmwareengine_network_peering" "my_network_peering" {
      name     = "my-network-peering"
    }
  5. Retrieve a Google Compute Security Policy with google_compute_security_policy

    main

    Use the google_compute_security_policy data source to fetch information about an existing Google Compute Security Policy. You can identify the policy using either its name and project or its self_link.

    data "google_compute_security_policy" "sp1" {
      name = "my-policy"
      project = "my-project"
    }
    
    data "google_compute_security_policy" "sp2" {
      self_link = "https://www.googleapis.com/compute/v1/projects/my-project/global/securityPolicies/my-policy"
    }
  6. Retrieve Secret Manager Regional Secret details with google_secret_manager_regional_secret

    main

    Use the google_secret_manager_regional_secret data source to fetch information about an existing Secret Manager Regional Secret.

    Arguments

    • secret_id (Required): The name of the regional secret.
    • location (Required): The location of the regional secret (e.g., us-central1).
    • project (Optional): The ID of the project in which the resource belongs.
    data "google_secret_manager_regional_secret" "secret_datasource" {
      secret_id = "secretname"
      location  = "us-central1"
    }
  7. Retrieve a service account with google_service_account

    main

    Use the google_service_account data source to fetch information about an existing Google service account within a project. You can identify the account using its ID, its fully-qualified resource path, or its email address.

    Arguments

    • account_id (Required): The service account ID, the fully-qualified path (e.g., projects/my-project/serviceAccounts/...), or the email address (e.g., my-service@my-project.iam.gserviceaccount.com).
    • project (Optional): The ID of the project containing the service account. Defaults to the project configured in the provider.
    data "google_service_account" "object_viewer" {
      account_id = "object-viewer"
    }
  8. Retrieve a KMS CryptoKeyVersion with google_kms_crypto_key_version

    main

    Use the google_kms_crypto_key_version data source to access information about a specific cryptographic key version in Google Cloud KMS. This includes the key's state, protection level, algorithm, and public key details if applicable.

    Arguments

    • crypto_key (Required): The id of the google_kms_crypto_key resource or data source to which this version belongs.
    • version (Optional): The version number for this CryptoKeyVersion. Defaults to 1.

    Attributes

    • id: The identifier for the resource in the format //cloudkms.googleapis.com/v1/{{crypto_key}}/cryptoKeyVersions/{{version}}.
    • name: The resource name in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*.
    • state: The current state of the CryptoKeyVersion.
    • protection_level: The ProtectionLevel describing how crypto operations are performed.
    • algorithm: The CryptoKeyVersionAlgorithm supported by this version.
    • public_key: If the enclosing CryptoKey is used for ASYMMETRIC_SIGN or ASYMMETRIC_DECRYPT, this block contains:
      • pem: The public key encoded in PEM format.
      • algorithm: The supported CryptoKeyVersionAlgorithm.
    data "google_kms_key_ring" "my_key_ring" {
      name     = "my-key-ring"
      location = "us-central1"
    }
    
    data "google_kms_crypto_key" "my_crypto_key" {
      name     = "my-crypto-key"
      key_ring = data.google_kms_key_ring.my_key_ring.id
    }
    
    data "google_kms_crypto_key_version" "my_crypto_key_version" {
      crypto_key = data.google_kms_crypto_key.my_crypto_key.id
    }
  9. Retrieve information about a compute network peering with google_compute_network_peering

    main

    Use the google_compute_network_peering data source to fetch details of an existing VPC network peering. You must provide the name of the peering and the network (the primary network's self-link) to locate the resource.

    Note: VPC peering is a bidirectional relationship. To establish peering between two networks, you must create two peering resources: one in each network pointing to the other.

    resource "google_compute_network" "default" {
      name                    = "foobar"
      auto_create_subnetworks = "false"
    }
    
    resource "google_compute_network" "other" {
      name                    = "other"
      auto_create_subnetworks = "false"
    }
    
    resource "google_compute_network_peering" "peering1" {
      name         = "peering1"
      network      = google_compute_network.default.self_link
      peer_network = google_compute_network.other.self_link
    }
    
    resource "google_compute_network_peering" "peering2" {
      name         = "peering2"
      network      = google_compute_network.other.self_link
      peer_network = google_compute_network.default.self_link
    }
    
    data "google_compute_network_peering" "peering1_ds" {
      name    = google_compute_network_peering.peering1.name
      network = google_compute_network_peering.peering1.network
    }
  10. Retrieve a Cluster Istio monitoring service with google_monitoring_cluster_istio_service

    main

    Use the google_monitoring_cluster_istio_service data source to retrieve information about a Monitoring Service that was automatically created by GCP to monitor Cluster Istio services. The filters provided must match exactly one service.

    Required Arguments

    • location: The location of the Kubernetes cluster where the Istio service is defined (corresponds to the location resource label in k8s_cluster resources).
    • cluster_name: The name of the Kubernetes cluster where the Istio service is defined (corresponds to the clusterName resource label in k8s_cluster resources).
    • service_namespace: The namespace of the Istio service (corresponds to the destination_service_namespace metric label in Istio metrics).
    • service_name: The name of the Istio service (corresponds to the destination_service_name metric label in Istio metrics).

    Optional Arguments

    • project: The ID of the project in which the resource belongs. If not provided, the provider's default project is used.
    data "google_monitoring_cluster_istio_service" "default" {
            location = "us-west2-a"
            cluster_name = "west"
            service_namespace = "istio-system"
            service_name = "istio-policy"
    }
  11. Retrieve Cloud VMware Engine external address details with google_vmwareengine_external_address

    main

    Use the google_vmwareengine_external_address data source to fetch information about an existing external address resource within Cloud VMware Engine.

    Arguments

    • name (Required): The name of the external address resource.
    • parent (Required): The resource name of the private cloud that this external address belongs to. The format should be project/{project}/locations/{location}/privateClouds/{private_cloud}.

    Attributes Reference

    For a full list of available attributes, refer to the google_vmwareengine_external_address resource documentation.

    data "google_vmwareengine_external_address" "my_external_address" {
      name     = "my-external-address"
      parent   = "project/my-project/locations/us-west1-a/privateClouds/my-cloud"
    }
  12. Retrieve information about a Compute Engine RegionTargetHttpProxy

    main

    Use the google_compute_region_target_http_proxy data source to fetch details about an existing Regional HTTP Target Proxy in Google Cloud.

    Arguments

    • name (Required): The name of the target HTTP proxy. Must be 1-63 characters long and comply with RFC1035 (starts with a lowercase letter, contains only lowercase letters, digits, or dashes, and cannot end with a dash).
    • region (Optional): The region where the proxy resides. Defaults to the provider's configured region if not specified.
    • project (Optional): The ID of the project containing the resource. Defaults to the provider's configured project if not specified.
    data "google_compute_region_target_http_proxy" "default" {
      name = google_compute_region_target_http_proxy.default.name
    }