Skip to content

Projects Module#

This module provides a comprehensive solution for managing Google Cloud Platform (GCP) projects and their associated resources. It handles project creation, VPC networking, service accounts, API enablement, and IAM bindings in a modular and flexible way.

Compatibility#

This module is compatible with Terraform version ~> 1.0 and has been tested with the following provider versions:

  • Google Provider: >= 6.28.0, < 7.0.0
  • Google Beta Provider: >= 6.28.0, < 7.0.0

Features#

Project Management

  • Create multiple service projects with customizable settings
  • Configure project-level service accounts
  • Set up project liens and deletion policies
  • Enable/disable services on project creation/destruction
  • Configure project quotas and limits

Networking

  • Create VPCs with custom subnets
  • Configure private service access
  • Set up private service connect
  • Manage secondary IP ranges

Security & Access

  • Manage IAM bindings at the project level
  • Create and configure service accounts
  • Enable Firebase integration (optional)

Optional Components#

The following components are optional and can be configured as needed:

VPC Configuration (vpcs variable)

  • VPC creation and subnet configuration
  • Private service access
  • Private service connect
  • Secondary IP ranges
  • Custom routes

Project IAM (project_iam_bindings variable)

  • IAM role bindings at the project level
  • Only created if bindings are specified

Project Quotas (project_quotas variable)

  • Custom quota overrides for specific services
  • Only applied if quotas are specified

Firebase Integration (firebase_enabled in service projects)

  • Firebase project creation and configuration
  • Only enabled if specified in service project configuration

Service Accounts (service_accounts in service projects)

  • Custom service account creation (supports multiple service accounts per project)
  • Only created if specified in service project configuration as a list of service account names

Usage#

module "projects" {
  source = "git:https:git@github.com:your-repo/terraform-google-projects.git"
  billing_account = "YOUR_BILLING_ACCOUNT_ID" # Your GCP billing account ID
  domain          = "labs.example.com"        # Your organization's domain

  # Optional but recommended
  env_prefix = "dev" # Environment prefix for project naming

  # Service Projects configuration
  service_projects = {
    sdlc = {
      project_name = "sdlc"
      folder_id    = "folders/123456789123"
      lien         = false
          service_accounts = [
      "app-sa",
      "backend-sa",
      "monitoring-sa"
    ]
      active_apis = [
        "compute.googleapis.com",
        "container.googleapis.com",
        "cloudbuild.googleapis.com"
      ]
      activate_api_identities     = []
      random_project_id           = true
      disable_dependent_services  = true
      disable_services_on_destroy = true
      shared_vpc_host_name        = ""
      shared_vpc_subnets          = []
      default_service_account     = "keep"
      deletion_policy             = "DELETE"
    }
  }

  # VPC configuration (if needed)
  vpcs = {
    sdlc = {
      network_name = "sdlc-network"
      project      = "sdlc"
      subnets = [
        {
          subnet_name           = "subnet-us-central1"
          subnet_ip             = "10.0.10.0/24"
          subnet_region         = "us-central1"
          subnet_private_access = "true"
        }
      ]
      subnets_beta = [
        {
          subnet_name           = "sdlc-proxy"
          subnet_ip             = "10.100.0.0/24"
          subnet_region         = "us-central1"
          subnet_private_access = false
          subnet_flow_logs      = false
          purpose               = "REGIONAL_MANAGED_PROXY"
          role                  = "ACTIVE"
        }
      ]
      private_service_connect    = true
      private_service_connect_ip = "10.0.11.100"
    }
  }

  # Project quotas (if needed)
  project_quotas = {
    sdlc = {
      service        = "compute.googleapis.com"
      metric         = "compute.googleapis.com/a2_cpus"
      limit          = "/project/region"
      override_value = "8"
    }
  }

  # Labels (optional)
  labels = {
    environment = "lab"
    team        = "og"
  }

  project_iam_bindings = {
    "roles/editor" = [
      "serviceAccount:gh-sdlc-sa@og-il-labs-infra.iam.gserviceaccount.com"
    ]
  }
}

Software#

This module requires the following software dependencies:

Service Account#

The service account used to run this module must have the following IAM roles:

  • roles/resourcemanager.projectCreator - To create projects
  • roles/billing.projectManager - To associate billing accounts with projects
  • roles/resourcemanager.folderAdmin - To manage projects within folders
  • roles/compute.networkAdmin - To create and manage VPC networks
  • roles/servicenetworking.networksAdmin - To configure private service access
  • roles/iam.serviceAccountAdmin - To create and manage service accounts
  • roles/serviceusage.serviceUsageAdmin - To enable APIs on projects
  • roles/iam.serviceAccountUser - To use service accounts
  • roles/firebase.managementServiceAgent - To enable Firebase (when using Firebase)

APIs#

The following GCP APIs must be enabled in the target organization/folder:

  • Cloud Resource Manager API (cloudresourcemanager.googleapis.com)
  • Cloud Billing API (cloudbilling.googleapis.com)
  • Compute Engine API (compute.googleapis.com)
  • Service Networking API (servicenetworking.googleapis.com)
  • Identity and Access Management (IAM) API (iam.googleapis.com)
  • Service Usage API (serviceusage.googleapis.com)
  • Firebase Management API (firebase.googleapis.com) - Required when using Firebase

License#

This module is covered by a commercial license. Please see LICENSE for details.

Support#

This module is developed and maintained by MyOps Limited. For any support inquiries, please contact us at info@myops.co.il.

Requirements#

Name Version
terraform ~> 1
google >= 6.28.0, < 7.0.0
google-beta >= 6.28.0, < 7.0.0

Providers#

Name Version
google >= 6.28.0, < 7.0.0
google-beta >= 6.28.0, < 7.0.0

Modules#

Name Source Version
active_apis terraform-google-modules/project-factory/google//modules/project_services ~> 18.0
private_service_connect terraform-google-modules/network/google//modules/private-service-connect ~> 11.0.0
project_iam terraform-google-modules/iam/google//modules/projects_iam ~> 8.0.0
service_project terraform-google-modules/project-factory/google ~> 18.0
subnets_beta terraform-google-modules/network/google//modules/subnets-beta ~> 11.0.0
vpc terraform-google-modules/network/google ~> 11.0.0

Resources#

Name Type
google-beta_google_compute_global_address.private resource
google-beta_google_firebase_project.this resource
google-beta_google_service_networking_connection.private_vpc_connection resource
google-beta_google_service_usage_consumer_quota_override.quota resource
google_compute_network_peering_routes_config.peering_routes resource
google_service_account.service_accounts resource
google_organization.org data source

Inputs#

Name Description Type Default Required
billing_account Billing Account string n/a yes
default_apis List of APIs that are enabled by default for every service project created list(any) 
[
 "compute.googleapis.com",
 "servicenetworking.googleapis.com",
 "cloudresourcemanager.googleapis.com",
 "vpcaccess.googleapis.com",
 "secretmanager.googleapis.com",
 "networkmanagement.googleapis.com"
]
 no
delete_default_routes If set, ensure that all routes within the network specified whose names begin with 'default-route' and with a next hop of 'default-internet-gateway' are deleted bool false no
domain Organization domain string n/a yes
env_prefix (optional) env_prefix for project naming string "" no
folder_id Folder id to create projects in. Can be specified individually per project string "" no
labels Labels with user-defined metadata map(any) {} no
project_iam_bindings Map of IAM bindings to apply to service projects. Key is the role, value is list of members. map(list(string)) {} no
project_quotas Map of Project quotas to override 
map(object({
 service = string
 metric = string
 limit = string
 override_value = string
 }))
 {} no
service_projects Map of service projects and their configs. Key = project_name Value = Project Factory Config. More info: https://github.com/terraform-google-modules/terraform-google-project-factory/tree/v9.0.0 map(any) {} no
vpcs This option allows creation of VPCs in the service project if shared VPC is not enough. Key = Project Name, Value = Network Config. More info: https://github.com/terraform-google-modules/terraform-google-network/tree/v2.5.0 
map(object({
 project = optional(string)
 network_name = optional(string)
 subnets = list(map(string))
 subnets_beta = optional(list(map(string)))
 secondary_ranges = optional(map(list(object({ range_name = string, ip_cidr_range = string }))))
 delete_default_routes = optional(bool)
 private_service_connect = optional(bool)
 private_service_connect_ip = optional(string)
 private_service_access = optional(bool)
 private_service_access_range = optional(string)
 forwarding_rule_target = optional(string)
 }))
 {} no

Outputs#

Name Description
active_apis Map of projects and their active apis
iam_bindings_outputs Map of projects and their iam bindings
projects Map of projects and their outputs from the project factory
service_accounts Map of projects and their service_accounts
vpcs Map of projects and their outputs from the network factory