Terraform on GCP: A Complete Beginner's Guide

# Install Google Cloud CLI
curl https://sdk.cloud.google.com | bash
gcloud init
gcloud auth application-default login
 
# Install Terraform
# See: /articles/install-terraform-debian/
terraform version

terraform {
  required_version = ">= 1.5"
 
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.20"
    }
  }
}
 
provider "google" {
  project = var.project_id
  region  = var.region
}
 
variable "project_id" {
  type        = string
  description = "GCP project ID"
}
 
variable "region" {
  type    = string
  default = "us-central1"
}

gcloud auth application-default login
# Terraform uses ADC (Application Default Credentials) automatically

# Create service account
gcloud iam service-accounts create terraform \
  --display-name "Terraform"
 
# Grant permissions
gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member "serviceAccount:terraform@${PROJECT_ID}.iam.gserviceaccount.com" \
  --role "roles/editor"
 
# Create and download key
gcloud iam service-accounts keys create key.json \
  --iam-account terraform@${PROJECT_ID}.iam.gserviceaccount.com
 
export GOOGLE_APPLICATION_CREDENTIALS="key.json"

resource "google_storage_bucket" "data" {
  name          = "${var.project_id}-data"
  location      = "US"
  force_destroy = false
 
  uniform_bucket_level_access = true
 
  versioning {
    enabled = true
  }
 
  lifecycle_rule {
    condition {
      age = 90
    }
    action {
      type          = "SetStorageClass"
      storage_class = "NEARLINE"
    }
  }
}

resource "google_compute_network" "main" {
  name                    = "main-vpc"
  auto_create_subnetworks = false
}
 
resource "google_compute_subnetwork" "app" {
  name          = "app-subnet"
  ip_cidr_range = "10.0.1.0/24"
  region        = var.region
  network       = google_compute_network.main.id
 
  secondary_ip_range {
    range_name    = "pods"
    ip_cidr_range = "10.1.0.0/16"
  }
}

resource "google_compute_instance" "web" {
  name         = "web-server"
  machine_type = "e2-medium"
  zone         = "${var.region}-a"
 
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
      size  = 20
    }
  }
 
  network_interface {
    subnetwork = google_compute_subnetwork.app.id
    access_config {} # Adds external IP
  }
 
  metadata_startup_script = <<-EOF
    #!/bin/bash
    apt-get update
    apt-get install -y nginx
    systemctl enable nginx
  EOF
 
  tags = ["http-server"]
}
 
resource "google_compute_firewall" "http" {
  name    = "allow-http"
  network = google_compute_network.main.name
 
  allow {
    protocol = "tcp"
    ports    = ["80", "443"]
  }
 
  source_ranges = ["0.0.0.0/0"]
  target_tags   = ["http-server"]
}

terraform {
  backend "gcs" {
    bucket = "myproject-terraform-state"
    prefix = "prod"
  }
}

resource "google_project_service" "apis" {
  for_each = toset([
    "compute.googleapis.com",
    "storage.googleapis.com",
    "container.googleapis.com",
    "iam.googleapis.com",
  ])
  service            = each.value
  disable_on_destroy = false
}