Fix Terraform Error - GCP Network Firewall Rule Already Exists

Quick Answer

A firewall rule with that name already exists in the GCP project. Firewall rule names are unique per project. Import it with terraform import, use a unique name, or delete the existing rule.

The Error

Error: Error creating Firewall: googleapi: Error 409: 
The resource 'projects/my-project/global/firewalls/allow-http' 
already exists, alreadyExists

What Causes This

• Default network rules — GCP creates default firewall rules (default-allow-ssh, default-allow-icmp, etc.)
• Manually created rule — someone added it via Console or gcloud
• Previous Terraform apply partially succeeded
• Duplicate names across different Terraform configs managing the same project

How to Fix It

Solution 1: Import the Existing Rule

# Import format: projects/PROJECT/global/firewalls/RULE_NAME
terraform import google_compute_firewall.allow_http \
  projects/my-project/global/firewalls/allow-http

Solution 2: Use Unique Names

resource "google_compute_firewall" "allow_http" {
  name    = "${var.project}-${var.environment}-allow-http"
  network = google_compute_network.main.name
 
  allow {
    protocol = "tcp"
    ports    = ["80", "443"]
  }
 
  source_ranges = ["0.0.0.0/0"]
  target_tags   = ["http-server"]
}

Solution 3: Manage Default Network Rules

# List existing rules
gcloud compute firewall-rules list --project my-project
 
# Delete default rules if you want Terraform to manage everything
gcloud compute firewall-rules delete default-allow-ssh \
  --project my-project --quiet

Or import them:

terraform import google_compute_firewall.default_ssh \
  projects/my-project/global/firewalls/default-allow-ssh

GCP Default Firewall Rules

When you create a default network, GCP auto-creates:

Best practice: Use auto_create_subnetworks = false to avoid default rules, then create your own.

Troubleshooting Checklist

1. ✅ Does the firewall rule exist? (gcloud compute firewall-rules list)
2. ✅ Is it a GCP default rule?
3. ✅ Can you import it or use a different name?
4. ✅ Are you using auto_create_subnetworks = false for custom VPCs?

Related Articles

• Fix GCP 403 Forbidden
• Terraform on GCP Guide
• Terraform Glossary

Conclusion

GCP firewall rule names are unique per project. Import existing rules, use environment-prefixed names, and create custom VPCs with auto_create_subnetworks = false to avoid conflicts with default rules.