Google Access Context Manager (VPC Service Controls) Service Perimeter Resource

google_access_context_manager_service_perimeter_resource (Terraform)

The Service Perimeter Resource in Access Context Manager (VPC Service Controls) can be configured in Terraform with the resource name google_access_context_manager_service_perimeter_resource. The following sections describe 1 example of how to use the resource and its parameters.

Example Usage from GitHub

niveklabs/google

resource "google_access_context_manager_service_perimeter_resource" "this" {
  perimeter_name = var.perimeter_name
  resource       = var.resource

  dynamic "timeouts" {
    for_each = var.timeouts

Parameters

• id optional computed - string
• perimeter_name required - string

The name of the Service Perimeter to add this resource to.

• resource required - string

A GCP resource that is inside of the service perimeter. Currently only projects are allowed. Format: projects/[project_number]

• timeouts single block
  • create optional - string
  • delete optional - string

Explanation in Terraform Registry

Allows configuring a single GCP resource that should be inside of a service perimeter. This resource is intended to be used in cases where it is not possible to compile a full list of projects to include in a google_access_context_manager_service_perimeter resource, to enable them to be added separately.

Note: If this resource is used alongside a google_access_context_manager_service_perimeter resource, the service perimeter resource must have a lifecycle block with ignore_changes = [status[0].resources] so they don't fight over which resources should be in the policy. To get more information about ServicePerimeterResource, see:

• API documentation
• How-to Guides
  • Service Perimeter Quickstart

    Warning: If you are using User ADCs (Application Default Credentials) with this resource, you must specify a billing_project and set user_project_override to true in the provider configuration. Otherwise the ACM API will return a 403 error. Your account must have the serviceusage.services.use permission on the billing_project you defined.