Terraform Google Cloud Platform (Beta) Provider

The google_os_config_v2_policy_orchestrator resource is used to manage OS Config v2 policy resources (such as OS Policy Assignments) at scale across multiple projects and locations. It provides a mechanism to create, update, and delete these resources by defining an orchestrated resource payload.

resource "google_os_config_v2_policy_orchestrator" "policy_orchestrator" {
    policy_orchestrator_id = "po"
    
    state = "ACTIVE"
    action = "UPSERT"
    
    orchestrated_resource {
        id = "test-orchestrated-resource"
        os_policy_assignment_v1_payload {
            os_policies {
                id = "test-os-policy"
                mode = "VALIDATION"
                resource_groups {
                    resources {
                        id = "resource-tf"
                        file {
                            content = "file-content-tf"
                            path = "file-path-tf-1"
                            state = "PRESENT"
                        }
                    }
                }
            }
            instance_filter {
                inventories {
                    os_short_name = "windows-10"
                }
            }
            rollout {
                disruption_budget {
                    percent = 100
                }
                min_wait_duration = "60s"
            }
        }
    }
    labels = {
        state = "active"
    }
}

The google_os_config_v2_policy_orchestrator_for_organization resource allows you to manage project and zone-level policy resources (such as OS Policy Assignments) across multiple projects and locations at scale. It provides tools to create, update, and delete these resources across an entire organization.

resource "google_os_config_v2_policy_orchestrator_for_organization" "policy_orchestrator_for_organization" {
    policy_orchestrator_id = "po-org"
    organization_id = "123456789"
    
    state = "ACTIVE"
    action = "UPSERT"
    
    orchestrated_resource {
        id = "test-orchestrated-resource-org"
        os_policy_assignment_v1_payload {
            os_policies {
                id = "test-os-policy-org"
                mode = "VALIDATION"
                resource_groups {
                    resources {
                        id = "resource-tf"
                        file {
                            content = "file-content-tf"
                            path = "file-path-tf-1"
                            state = "PRESENT"
                        }
                    }
                }
            }
            instance_filter {
                inventories {
                    os_short_name = "windows-10"
                }
            }
            rollout {
                disruption_budget {
                    percent = 100
                }
                min_wait_duration = "60s"
            }
        }
    }
    labels = {
        state = "active"
    }
    orchestration_scope {
        selectors {
            location_selector {
                included_locations = [""]
            }
        }
    }
}

The google_gke_backup_restore_plan resource allows you to define how data from a GKE Backup Plan should be restored to a cluster. You can configure the scope of the restore (all namespaces, specific namespaces, or specific applications), define how conflicts are handled, and apply transformation rules to modify resources during the restore process.

Key configuration areas include:

• restore_config: Defines the logic for the restore operation.
• namespaced_resource_restore_mode: Determines how to handle existing namespaced resources (e.g., DELETE_AND_RESTORE, FAIL_ON_CONFLICT, or MERGE_SKIP_ON_CONFLICT).
• volume_data_restore_policy: Specifies how volume data is handled (e.g., RESTORE_VOLUME_DATA_FROM_BACKUP or REUSE_VOLUME_HANDLE_FROM_BACKUP).
• cluster_resource_restore_scope: Controls which cluster-level resources are included or excluded.
• transformation_rules: Allows for programmatic changes to resources (like renaming namespaces or copying environment variables) during restoration.

resource "google_gke_backup_restore_plan" "example" {
  name = "restore-plan-name"
  location = "us-central1"
  backup_plan = google_gke_backup_backup_plan.example.id
  cluster = google_container_cluster.primary.id
  restore_config {
    all_namespaces = true
    namespaced_resource_restore_mode = "FAIL_ON_CONFLICT"
    volume_data_restore_policy = "RESTORE_VOLUME_DATA_FROM_BACKUP"
    cluster_resource_restore_scope {
      all_group_kinds = true
    }
    cluster_resource_conflict_policy = "USE_EXISTING_VERSION"
  }
}

The google_compute_instance_template resource manages a VM instance template within Google Compute Engine (GCE). Global instance templates can be used in any region.

Note: To reduce the impact of regional outages and ensure data residency, consider using google_compute_region_instance_template instead.

resource "google_compute_instance_template" "default" {
  name        = "appserver-template"
  description = "This template is used to create app server instances."

  tags = ["foo", "bar"]

  labels = {
    environment = "dev"
  }

  instance_description = "description assigned to instances"
  machine_type         = "e2-medium"
  can_ip_forward       = false

  scheduling {
    automatic_restart   = true
    on_host_maintenance = "MIGRATE"
  }

  disk {
    source_image      = "debian-cloud/debian-11"
    auto_delete       = true
    boot              = true
    resource_policies = [google_compute_resource_policy.daily_backup.id]
  }

  network_interface {
    network = "default"
  }

  metadata = {
    foo = "bar"
  }

  service_account {
    email  = google_service_account.default.email
    scopes = ["cloud-platform"]
  }
}

The google_project resource allows you to create and manage Google Cloud Platform (GCP) projects.

Prerequisites

• Organization Association: Projects created with this resource must be associated with an Organization.
• Permissions: The identity running Terraform must have roles/resourcemanager.projectCreator on the target organization.
• Billing Permissions: If specifying a billing_account, the identity must have at least roles/billing.user privileges on that account. Terraform reads the billing account on every plan and apply operation.

Best Practices

• Default Network: Instead of setting auto_create_network = false, it is recommended to use the constraints/compute.skipDefaultNetworkCreation organization policy to remove the default network.
• Deletion Policy: Use the deletion_policy argument to protect projects from accidental destruction. The default is PREVENT.

resource "google_project" "my_project" {
  name       = "My Project"
  project_id = "your-project-id"
  org_id     = "1234567"
}

The google_network_connectivity_destination resource allows you to manage destinations for Multicloud Data Transfer. These destinations represent workloads on another Cloud Service Provider (CSP) that you want to connect to via Google Cloud Network Connectivity.

resource "google_network_connectivity_multicloud_data_transfer_config" "config" {
  name        = "basic-config"
  location    = "europe-west4"
  description = "A basic multicloud data transfer config for the destination example"
}

resource "google_network_connectivity_destination" "example" {
  name        = "basic-destination"
  location    = "europe-west4"
  multicloud_data_transfer_config = google_network_connectivity_multicloud_data_transfer_config.config.name
  description = "A basic destination"
  labels = {
    foo = "bar"
  }
  ip_prefix   = "10.0.0.0/8"
  endpoints {
    asn = "14618"
    csp = "AWS"
  }
}

The google_composer_environment resource allows you to create and manage environments for running orchestration tasks using Apache Airflow on Google Cloud infrastructure.

Important Considerations

• Infrastructure Layers: The environment resource is built upon multiple layers of Google Cloud infrastructure (such as GKE, Cloud Storage, and Compute networking). Terraform manages the high-level google_composer_environment resource but does not manage these underlying individual resources.
• Provisioning Time: Creating or updating an environment typically takes approximately 25 minutes.
• Error Detection: Configuration errors may only be detected during the environment creation process. Always verify configuration validity against Managed Airflow requirements.
• Data Persistence: Environments include Google Cloud Storage buckets that are not automatically deleted when the environment is destroyed. You must manage these buckets separately if you wish to delete them.
• Generations:
  • Gen 3: Recommended for new environments.
  • Gen 2: Supported.
  • Legacy Gen 1: In post-maintenance mode. No new updates, bugfixes, or security updates are released. Use Gen 3 or Gen 2 instead.

The google_firebase_ai_logic_prompt_template resource allows you to manage PromptTemplates for Firebase AI Logic. These templates use the Dotprompt format to define AI logic.

Note: This resource is in beta and requires the terraform-provider-google-beta provider.

Key Concepts

• Template String: The core of the resource is the template_string, which contains the raw Dotprompt content (including model definitions and instructions).
• Location: You must specify a location. For global templates, use global.
• Regional Propagation: For global locations, you can use regional_propagation_disabled to control whether changes propagate to all applicable regions or stay within the global region.

resource "google_firebase_ai_logic_prompt_template" "basic" {
  provider = google-beta
  location = "global"
  template_id = "basic-template"
  template_string = <<EOF
---
model: gemini-2.5-flash
---
Hello world!
EOF
}

The google_access_context_manager_access_levels resource allows you to perform a bulk, atomic update of all Access Levels within a specific Access Policy.

Warning: This resource is authoritative. It will replace all existing Access Levels in the policy with the ones you define in the access_levels block. If you have existing Access Levels created via the individual google_access_context_manager_access_level resource, using this resource will overwrite them, potentially causing a 'permadiff'.

Best Practice: To avoid accidentally wiping out existing rules, it is highly recommended to import the resource into your Terraform state before applying changes. This ensures the plan correctly displays the full set of changes relative to the current state of the policy.

resource "google_access_context_manager_access_levels" "access-levels" {
  parent = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}"
  access_levels {
    name   = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}/accessLevels/example_level"
    title  = "example_level"
    basic {
      conditions {
        regions = ["US", "CH"]
      }
    }
  }
}