Skip to content

Google Cloud Apigee Module#

This module simplifies the creation of Apigee resources (organization, environment groups, environment group attachments, environments, instances and instance attachments). This module is forked from Google Cloud Fabric modules and it enables end to end deployment of Apigee Hybrid.

Compatibility#

This module has been tested using Terraform v1.12.2

Usage#

Examples#

All resources (HYBRID control plane)#

module "apigee" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-apigee?ref=vX.Y.Z"

  project_id              = "acme-audit"
  nonprod_sa_email        = "project-service-account@acme-audit.iam.gserviceaccount.com"
  synchronizer_sa_email   = "project-service-account@acme-audit.iam.gserviceaccount.com"
  apigee_runtime_sa_email = "project-service-account@acme-audit.iam.gserviceaccount.com"
  apigee_hybrid           = true

  organization = {
    display_name     = "test-org"
    description      = "Test Organization"
    analytics_region = "me-west1"
    runtime_type     = "HYBRID"
  }
  envgroups = {
    dev  = ["dev.nip.io"]
  }
  environments = {
    apis-dev = {
      display_name = "APIs dev"
      description  = "APIs Dev"
      envgroups    = ["dev"]
    }
  }
}

Minimal example (CLOUD)#

This example shows how to create to create an Apigee organization and deploy instance in it.

module "apigee-minimal" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-apigee?ref=vX.Y.Z"

  project_id = var.project_id
  organization = {
    display_name       = "Apigee"
    billing_type       = "PAYG"
    analytics_region   = "europe-west1"
    authorized_network = var.vpc.id
    runtime_type       = "CLOUD"
  }
  envgroups = {
    prod = ["prod.example.com"]
  }
  environments = {
    apis-prod = {
      display_name = "APIs prod"
      description  = "APIs Prod"
      envgroups    = ["prod"]
    }
  }
  instances = {
    europe-west1 = {
      environments                  = ["apis-prod"]
      runtime_ip_cidr_range         = "10.32.0.0/22"
      troubleshooting_ip_cidr_range = "10.64.0.0/28"
    }
  }
}

Minimal example with existing organization (CLOUD)#

This example shows how to create to work with an existing organization in the project. Note that in this case we don't specify the IP ranges for the instance, so it requests and allocates an available /22 and /28 CIDR block from Service Networking to deploy the instance.

module "apigee-existing" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-apigee?ref=vX.Y.Z"

  project_id = var.project_id
  envgroups = {
    prod = ["prod.example.com"]
  }
  environments = {
    apis-prod = {
      display_name = "APIs prod"
      envgroups    = ["prod"]
    }
  }
  instances = {
    europe-west1 = {
      environments = ["apis-prod"]
    }
  }
}

Disable VPC Peering (CLOUD)#

When a new Apigee organization is created, it is automatically peered to the authorized network. You can prevent this from happening by using the disable_vpc_peering key in the organization variable, as shown below:

module "apigee-no-peering" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-apigee?ref=vX.Y.Z"

  project_id = var.project_id
  organization = {
    display_name        = "Apigee"
    billing_type        = "PAYG"
    analytics_region    = "europe-west1"
    runtime_type        = "CLOUD"
    disable_vpc_peering = true
  }
  envgroups = {
    prod = ["prod.example.com"]
  }
  environments = {
    apis-prod = {
      display_name = "APIs prod"
      envgroups    = ["prod"]
    }
  }
  instances = {
    europe-west1 = {
      environments = ["apis-prod"]
    }
  }
}

All resources (CLOUD)#

module "apigee-full" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-apigee?ref=vX.Y.Z"

  project_id = "my-project"
  organization = {
    display_name            = "My Organization"
    description             = "My Organization"
    authorized_network      = "my-vpc"
    runtime_type            = "CLOUD"
    billing_type            = "PAYG"
    database_encryption_key = "123456789"
    analytics_region        = "europe-west1"
  }
  envgroups = {
    test = ["test.example.com"]
    prod = ["prod.example.com"]
  }
  environments = {
    apis-test = {
      display_name = "APIs test"
      description  = "APIs Test"
      envgroups    = ["test"]
    }
    apis-prod = {
      display_name = "APIs prod"
      description  = "APIs prod"
      envgroups    = ["prod"]
    }
  }
  instances = {
    europe-west1 = {
      runtime_ip_cidr_range         = "10.0.4.0/22"
      troubleshooting_ip_cidr_range = "10.1.1.0.0/28"
      environments                  = ["apis-test"]
    }
    europe-west3 = {
      runtime_ip_cidr_range         = "10.0.8.0/22"
      troubleshooting_ip_cidr_range = "10.1.16.0/28"
      environments                  = ["apis-prod"]
      enable_nat                    = true
    }
  }
  endpoint_attachments = {
    endpoint-backend-1 = {
      region             = "europe-west1"
      service_attachment = "projects/my-project-1/serviceAttachments/gkebackend1"
    }
    endpoint-backend-2 = {
      region             = "europe-west1"
      service_attachment = "projects/my-project-2/serviceAttachments/gkebackend2"
    }
  }
}

New environment group#

module "apigee-envgroup" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-apigee?ref=vX.Y.Z"

  project_id = "my-project"
  envgroups = {
    test = ["test.example.com"]
  }
}

New environment#

module "apigee-env" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-apigee?ref=vX.Y.Z"

  project_id = "my-project"
  environments = {
    apis-test = {
      display_name = "APIs test"
      description  = "APIs Test"
    }
  }
}

New instance (VPC Peering Provisioning Mode)#

module "apigee-instance" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-apigee?ref=vX.Y.Z"

  project_id = "my-project"
  instances = {
    europe-west1 = {
      runtime_ip_cidr_range         = "10.0.4.0/22"
      troubleshooting_ip_cidr_range = "10.1.1.0/28"
    }
  }
}

New instance (Non VPC Peering Provisioning Mode)#

module "apigee-instance-no-peering" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-apigee?ref=vX.Y.Z"

  project_id = "my-project"
  organization = {
    display_name            = "My Organization"
    description             = "My Organization"
    runtime_type            = "CLOUD"
    billing_type            = "Pay-as-you-go"
    database_encryption_key = "123456789"
    analytics_region        = "europe-west1"
    disable_vpc_peering     = true
  }
  instances = {
    europe-west1 = {}
  }
}

New endpoint attachment#

Endpoint attachments allow to implement Apigee southbound network patterns.

module "apigee-endpoint-attachment" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-apigee?ref=vX.Y.Z"

  project_id = "my-project"
  endpoint_attachments = {
    endpoint-backend-1 = {
      region             = "europe-west1"
      service_attachment = "projects/my-project-1/serviceAttachments/gkebackend1"
    }
  }
}

Apigee add-ons#

module "apigee-add-ons" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-apigee?ref=vX.Y.Z"

  project_id = "my-project"
  addons_config = {
    monetization = true
  }
}

New DNS ZONE#

module "apigee-dns-zone" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-apigee?ref=vX.Y.Z"

  project_id = "my-project"
  dns_zones = {
    test = {
      domain            = "mydomain.com"
      description       = "Zone for mydomain.com"
      target_project_id = "my-other-project"
      target_network_id = "projects/my-other-projects/global/networks/vpc"
    }
  }
}

IAM#

module "apigee-iam" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-apigee?ref=vX.Y.Z"

  project_id = "my-project"
  organization = {
    display_name            = "My Organization"
    description             = "My Organization"
    authorized_network      = "my-vpc"
    runtime_type            = "CLOUD"
    billing_type            = "PAYG"
    database_encryption_key = "123456789"
    analytics_region        = "europe-west1"
  }
  envgroups = {
    test = ["test.example.com"]
    prod = ["prod.example.com"]
  }
  environments = {
    apis-test = {
      display_name = "APIs test"
      description  = "APIs Test"
      envgroups    = ["test"]
      iam = {
        "roles/apigee.environmentAdmin" = ["group:apigee-env-admin@myorg.com"]
      }
      iam_bindings_additive = {
        viewer = {
          role   = "roles/viewer"
          member = "user:user1@myorg.com"
        }
      }
    }
    apis-prod = {
      display_name = "APIs prod"
      description  = "APIs prod"
      envgroups    = ["prod"]
      iam_bindings = {
        apigee-env-admin = {
          role    = "roles/apigee.environmentAdmin"
          members = ["group:apigee-env-admin@myorg.com"]
        }
      }
    }
  }
}

Software#

The following dependencies must be available:

  • Terraform >= 1.0.0
  • [Terraform Provider for GCP][terraform-provider-gcp] plugin >= v6.28.0

Service Account#

User or service account credentials with the following roles must be used to provision the resources of this module:

  • Apigee Organization Admin: roles/apigee.organizationAdmin
  • Compute Network Admin: roles/compute.networkAdmin (for VPC peering and network configurations)
  • Service Networking Admin: roles/servicenetworking.networksAdmin (for private service connections)
  • DNS Administrator: roles/dns.admin (if using DNS zones)

APIs#

A project with the following APIs enabled must be used to host the resources of this module:

  • Apigee API: apigee.googleapis.com
  • Compute Engine API: compute.googleapis.com
  • Service Networking API: servicenetworking.googleapis.com
  • Cloud DNS API: dns.googleapis.com (if using DNS zones)
  • Cloud KMS API: cloudkms.googleapis.com (if using encryption keys)

License#

This module is covered by a commercial license. Please see LICENSE for details.

Support#

This module is developed and maintained by MyOps Limited. For any support inquiries, please contact us at info@myops.co.il.

Requirements#

Name Version
terraform ~> 1
google >= 6.28.0, < 7.0.0
google-beta >= 6.28.0, < 7.0.0

Providers#

Name Version
google >= 6.28.0, < 7.0.0

Modules#

No modules.

Resources#

Name Type
google_apigee_addons_config.addons_config resource
google_apigee_control_plane_access.apigee_control_plane_access resource
google_apigee_dns_zone.dns_zones resource
google_apigee_endpoint_attachment.endpoint_attachments resource
google_apigee_envgroup.envgroups resource
google_apigee_envgroup_attachment.envgroup_attachments resource
google_apigee_environment.environments resource
google_apigee_environment_iam_binding.authoritative resource
google_apigee_environment_iam_binding.bindings resource
google_apigee_environment_iam_member.bindings resource
google_apigee_instance.instances resource
google_apigee_instance_attachment.instance_attachments resource
google_apigee_nat_address.apigee_nat resource
google_apigee_organization.organization resource

Inputs#

Name Description Type Default Required
addons_config Addons configuration. 
object({
 advanced_api_ops = optional(bool, false)
 api_security = optional(bool, false)
 connectors_platform = optional(bool, false)
 integration = optional(bool, false)
 monetization = optional(bool, false)
 })
 null no
apigee_hybrid Whether Apigee hybrid is deployed. bool true no
apigee_runtime_sa_email Apigee runtime service account email. string "" no
dns_zones DNS zones. 
map(object({
 domain = string
 description = string
 target_project_id = string
 target_network_id = string
 }))
 {} no
endpoint_attachments Endpoint attachments. 
map(object({
 region = string
 service_attachment = string
 }))
 {} no
envgroups Environment groups (NAME => [HOSTNAMES]). map(list(string)) {} no
environments Environments. 
map(object({
 api_proxy_type = optional(string)
 description = optional(string, "Terraform-managed")
 display_name = optional(string)
 deployment_type = optional(string)
 envgroups = optional(list(string), [])
 forward_proxy_uri = optional(string)
 iam = optional(map(list(string)), {})
 iam_bindings = optional(map(object({
 role = string
 members = list(string)
 })), {})
 iam_bindings_additive = optional(map(object({
 role = string
 member = string
 })), {})
 node_config = optional(object({
 min_node_count = optional(number)
 max_node_count = optional(number)
 }))
 type = optional(string)
 }))
 {} no
instances Instances ([REGION] => [INSTANCE]). 
map(object({
 consumer_accept_list = optional(list(string))
 description = optional(string, "Terraform-managed")
 disk_encryption_key = optional(string)
 display_name = optional(string)
 enable_nat = optional(bool, false)
 activate_nat = optional(bool, false)
 environments = optional(list(string), [])
 name = optional(string)
 runtime_ip_cidr_range = optional(string)
 troubleshooting_ip_cidr_range = optional(string)
 }))
 {} no
nonprod_sa_email Non-production service account email. string "" no
organization Apigee organization. If set to null the organization must already exist. 
object({
 analytics_region = optional(string)
 api_consumer_data_encryption_key = optional(string)
 api_consumer_data_location = optional(string)
 authorized_network = optional(string)
 billing_type = optional(string)
 control_plane_encryption_key = optional(string)
 database_encryption_key = optional(string)
 description = optional(string, "Terraform-managed")
 disable_vpc_peering = optional(bool, false)
 display_name = optional(string)
 properties = optional(map(string), {})
 runtime_type = optional(string, "CLOUD")
 retention = optional(string)
 })
 null no
project_id Project ID. string n/a yes
synchronizer_sa_email Synchronizer service account email. string "" no

Outputs#

Name Description
endpoint_attachment_hosts Endpoint hosts.
envgroups Environment groups.
environments Environment.
instances Instances.
nat_ips NAT IP addresses used in instances.
org_id Organization ID.
org_name Organization name.
organization Organization.
service_attachments Service attachments.