Skip to content

Google Cloud Artifact Registry Module#

This module simplifies the creation and management of Artifact Registry repositories on Google Cloud Platform. Google Artifact Registry is a single place for your organization to manage container images and language packages (such as Maven and npm).

Overview#

  • Creates a google_artifact_registry_repository
  • Optionally enables Container Scanning API
  • Manages IAM bindings for read/read-write access
  • Supports optional CMEK via kms_key_name

Note: Modules are Terraform-native and Terragrunt-agnostic.

Comparison to upstream modules#

  • Provides comprehensive IAM bindings for repository access
  • Adds optional CMEK support via kms_key_name

Compatibility#

This module has been tested using Terraform >= 1.5

Usage#

Basic Example#

module "artifact_registry" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-artifact-registry?ref=vX.Y.Z"

  project_id = "my-project-id"
  location   = "me-west1"

  repository_id          = "docker"
  repository_format      = "DOCKER"
  repository_description = "Team container registry"

  labels = {
    env         = "dev"
    cost_center = "platform"
    managed_by  = "terraform"
  }
}

Advanced Example#

module "artifact_registry" {
  source = "github.com/<org>/gcp-terraform-modules//modules/terraform-google-artifact-registry?ref=vX.Y.Z"

  project_id = "my-project-id"
  location   = "me-west1"

  repository_id          = "apps"
  repository_format      = "DOCKER"
  repository_description = "Apps registry"
  kms_key_name           = "projects/PROJ/locations/REG/keyRings/RING/cryptoKeys/KEY"

  enable_scanning = true

  permission_readonly  = [
    "group:devs@example.com",
  ]
  permission_readwrite = [
    "group:platform@example.com",
  ]

  labels = {
    env         = "prod"
    cost_center = "platform"
    managed_by  = "terraform"
  }
}

Software#

The following dependencies must be available:

  • Terraform >= 1.5
  • [Terraform Provider for GCP][terraform-provider-gcp] plugin >= v5.0

Service Account#

User or service account credentials with the following roles must be used to provision the resources of this module:

  • Artifact Registry Admin: roles/artifactregistry.admin
  • Service Usage Admin: roles/serviceusage.serviceUsageAdmin (if enabling APIs)

APIs#

A project with the following APIs enabled must be used to host the resources of this module:

  • Artifact Registry API: artifactregistry.googleapis.com
  • Container Analysis API: containeranalysis.googleapis.com (if vulnerability scanning is enabled)

Security Considerations#

  • Grant least privilege for IAM bindings
  • Validate CMEK key permissions for the Artifact Registry service account

License#

This module is covered by a commercial license. Please see LICENSE for details.

Support#

This module is developed and maintained by MyOps Limited. For any support inquiries, please contact us at info@myops.co.il.

Requirements#

Name Version
terraform >= 1.5
google >= 5.0
google-beta >= 5.0

Providers#

Name Version
google >= 5.0
google-beta >= 5.0

Modules#

No modules.

Resources#

Name Type
google-beta_google_artifact_registry_repository.this resource
google-beta_google_artifact_registry_repository_iam_member.readonly resource
google-beta_google_artifact_registry_repository_iam_member.readwrite resource
google_project_service.containerscanning resource

Inputs#

Name Description Type Default Required
enable_scanning Enable Container Vulnerability scanning bool true no
kms_key_name The Cloud KMS resource name of the customer managed encryption key string "" no
labels Labels with user-defined metadata map(string) {} no
location Region where to create Artifact Registry string n/a yes
permission_readonly List of IAM Members to attach Read Only permission set(string) [] no
permission_readwrite List of IAM Members to attach Read/Write permission set(string) [] no
project_id GCP project ID where to create Artifact Registry string n/a yes
repository_description Description of Artifact Registry string "Artifact Registry" no
repository_format The format of packages: DOCKER, MAVEN, NPM, PYTHON, APT, YUM string "DOCKER" no
repository_id The last part of the repository name string n/a yes

Outputs#

Name Description
id ID of the created Artifact Registry repository
name Full name of the Artifact Registry repository