Skip to content

Google Cloud Certificates Module#

Import and manage Google Cloud HTTPS SSL certificates for Global and Regional load balancers. Primary scope: import existing certificates.

Supports:

  • Import from Google Secret Manager (GSM)
  • Import from local PEM files (useful for when the certificate/key material is not available in Google Secret Manager and can be provided locally)
  • Self-signed generation

Compatibility#

This module is compatible with Terraform version ~> 1.0 and has been tested with the following provider versions:

  • Google Provider: >= 6.28.0, < 7.0.0
  • Google Beta Provider: >= 6.28.0, < 7.0.0
  • TLS Provider: >= 4.0.0

Usage#

This module creates google_compute_ssl_certificate (global) and google_compute_region_ssl_certificate (regional) resources. Its primary purpose is to import existing certificate/key material for use by Google Cloud load balancers. You can source certificate/key material in three ways:

  • From Google Secret Manager (default)
  • From local files when use_files = true
  • Self-signed generation with generate_certs = true for testing-only workflows

This module does not set up or operate a Certificate Authority (CA) and does not obtain publicly trusted certificates.

Basic Example using files on the filesystem#

module "certs" {
  source    = "github.com/myops-co/gcp-terraform-modules//modules/terraform-google-certs?ref=vX.Y.Z"
  use_files = true

  domains_files = {
    example = {
      project_id = "sample-project"
      key_file   = "example.key.pem"
      cert_file  = "example.cert.pem"
    }
  }

  regions_files = [
    {
      region     = "europe-west1"
      project_id = "sample-project"
      name       = "example-regional"
      key_file   = "example.key.pem"
      cert_file  = "example.cert.pem"
    }
  ]
}

Google Secrets Manager backed Example#

module "certs" {
  source          = "github.com/myops-co/gcp-terraform-modules//modules/terraform-google-certs?ref=vX.Y.Z"
  secrets_project = var.secrets_project

  domains = {
    example = {
      project_id  = var.project_id
      key_path    = "my-cert-key"
      cert_path   = "my-cert-crt"
      description = "Imported *.example.com"
    }
  }

  regions = [
    {
      region      = var.region
      project_id  = var.project_id
      name        = "example-regional"
      key_path    = "my-cert-key"
      cert_path   = "my-cert-crt"
      description = "Imported *.example.com"
    }
  ]
}

Self-signed certificates#

module "certs" {
  source        = "github.com/myops-co/gcp-terraform-modules//modules/terraform-google-certs?ref=vX.Y.Z"
  generate_certs = true

  domains = {
    example = {
      project_id  = var.project_id
      key_path    = "dummy-value" # Not used but required
      cert_path   = "dummy-value" # Not used but required
      description = "Generated (self-signed) *.example.com — do NOT use in production"
    }
  }

  regions = [
    {
      region      = var.region
      project_id  = var.project_id
      name        = "example-regional"
      key_path    = "dummy-value" # Not used but required
      cert_path   = "dummy-value" # Not used but required
      description = "Generated (self-signed) *.example.com — do NOT use in production"
    }
  ]
}

Software#

This module requires the following software dependencies:

Service Account#

The service account used to run this module must have the following IAM roles:

  • roles/compute.securityAdmin - To manage SSL certificates
  • roles/secretmanager.secretAccessor - To read certificate data from Secret Manager (when using GSM)
  • roles/secretmanager.admin - To create secrets for generated certificates (when using generate_certs = true)

APIs#

The following GCP APIs must be enabled in the target project:

  • Compute Engine API (compute.googleapis.com)
  • Secret Manager API (secretmanager.googleapis.com) - Required when using Google Secret Manager

License#

This module is covered by a commercial license. Please see LICENSE for details.

Support#

This module is developed and maintained by MyOps Limited. For any support inquiries, please contact us at info@myops.co.il.

Requirements#

Name Version
terraform ~> 1
google >= 6.28.0, < 7.0.0
google-beta >= 6.28.0, < 7.0.0
tls >= 4.0.0

Providers#

Name Version
google >= 6.28.0, < 7.0.0
tls >= 4.0.0

Modules#

No modules.

Resources#

Name Type
google_compute_region_ssl_certificate.regional_from_files resource
google_compute_region_ssl_certificate.regional_from_gsm resource
google_compute_region_ssl_certificate.regional_generated resource
google_compute_ssl_certificate.generated_certs resource
google_compute_ssl_certificate.imported_from_files resource
google_compute_ssl_certificate.imported_from_gsm resource
google_secret_manager_secret.generated_global_cert_secret resource
google_secret_manager_secret.generated_global_key_secret resource
google_secret_manager_secret.generated_regional_cert_secret resource
google_secret_manager_secret.generated_regional_key_secret resource
google_secret_manager_secret_version.generated_global_cert_version resource
google_secret_manager_secret_version.generated_global_key_version resource
google_secret_manager_secret_version.generated_regional_cert_version resource
google_secret_manager_secret_version.generated_regional_key_version resource
tls_private_key.global_key resource
tls_private_key.regional_key resource
tls_self_signed_cert.global_cert resource
tls_self_signed_cert.regional_cert resource
google_secret_manager_secret_version.certificate data source
google_secret_manager_secret_version.private_key data source
google_secret_manager_secret_version.regional_certificate data source
google_secret_manager_secret_version.regional_private_key data source

Inputs#

Name Description Type Default Required
domains Map of global certificates to import from GSM, keyed by logical name 
map(object({
 project_id = string
 key_path = string
 cert_path = string
 description = string
 domain_names = optional(list(string), []) # DNS names for the certificate
 }))
 {} no
domains_files Map of global certificates to import from local files, keyed by logical name 
map(object({
 project_id = string
 key_file = string
 cert_file = string
 description = optional(string)
 domain_names = optional(list(string), []) # DNS names for the certificate
 }))
 {} no
generate_certs Generate new certificates using the TLS provider instead of reading existing ones bool false no
regions List of regional certificates to import from GSM 
list(object({
 region = string
 project_id = string
 name = string
 key_path = string
 cert_path = string
 description = string
 domain_names = optional(list(string), []) # DNS names for the certificate
 }))
 [] no
regions_files List of regional certificates to import from local files 
list(object({
 region = string
 project_id = string
 name = string
 key_file = string
 cert_file = string
 description = optional(string)
 domain_names = optional(list(string), []) # DNS names for the certificate
 }))
 [] no
secrets_project Project where certificate secrets are stored (used when use_files = false) string null no
use_files Use local files for certificates instead of Google Secret Manager bool false no

Outputs#

Name Description
certificates Map of global certificate results keyed by logical name
regional_certificates Map of regional certificate results keyed by logical name