Google App Engine Flexible App Version

This page shows how to write Terraform for App Engine Flexible App Version and write them securely.

google_app_engine_flexible_app_version (Terraform)

The Flexible App Version in App Engine can be configured in Terraform with the resource name google_app_engine_flexible_app_version. The following sections describe 3 examples of how to use the resource and its parameters.

Example Usage from GitHub

main.tf#L1
resource "google_app_engine_flexible_app_version" "flexible_app" {
  count   = ""
  runtime = ""
  version_id = ""
  inbound_services = []
  instance_class = ""
main.tf#L77
resource "google_app_engine_flexible_app_version" "default_app" {
  count      = var.create_default_service ? 1 : 0
  service    = "default"
  version_id = "mlflow-default"
  runtime    = "custom"

main.tf#L9
resource "google_app_engine_flexible_app_version" "first_app" {
  version_id = "v1"
  project    = "gcptutorials"
  service    = "kafka-service"
  runtime    = "custom"

Review your Terraform file for Google best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).

Parameters

Metadata settings that are supplied to this version to enable beta runtime features.

Duration that static files should be cached by web proxies and browsers. Only applicable if the corresponding StaticFilesHandler does not specify its own expiration time.

Environment variables available to the application. As these are not returned in the API request, Terraform will not detect any changes made outside of the Terraform config.

A list of the types of messages that this application is able to receive. Possible values: ["INBOUND_SERVICE_MAIL", "INBOUND_SERVICE_MAIL_BOUNCE", "INBOUND_SERVICE_XMPP_ERROR", "INBOUND_SERVICE_XMPP_MESSAGE", "INBOUND_SERVICE_XMPP_SUBSCRIBE", "INBOUND_SERVICE_XMPP_PRESENCE", "INBOUND_SERVICE_CHANNEL_PRESENCE", "INBOUND_SERVICE_WARMUP"]

Instance class that is used to run this version. Valid values are AutomaticScaling: F1, F2, F4, F4_1G ManualScaling: B1, B2, B4, B8, B4_1G Defaults to F1 for AutomaticScaling and B1 for ManualScaling.

  • name optional computed - string

Full path to the Version resource in the API. Example, "v1".

Files that match this pattern will not be built into this version. Only applicable for Go runtimes.

Desired runtime. Example python27.

The version of the API in the given runtime environment. Please see the app.yaml reference for valid values at https://cloud.google.com/appengine/docs/standard//config/appref

The channel of the runtime to use. Only available for some runtimes.

The path or name of the app's main executable.

AppEngine service resource

Current serving status of this version. Only the versions with a SERVING status create instances and can be billed. Default value: "SERVING" Possible values: ["SERVING", "STOPPED"]

Relative name of the version within the service. For example, 'v1'. Version names can contain only lowercase letters, numbers, or hyphens. Reserved names,"default", "latest", and any name with the prefix "ah-".

  • api_config list block

    Action to take when users access resources that require authentication. Default value: "AUTH_FAIL_ACTION_REDIRECT" Possible values: ["AUTH_FAIL_ACTION_REDIRECT", "AUTH_FAIL_ACTION_UNAUTHORIZED"]

    Level of login required to access this resource. Default value: "LOGIN_OPTIONAL" Possible values: ["LOGIN_OPTIONAL", "LOGIN_ADMIN", "LOGIN_REQUIRED"]

    Path to the script from the application root directory.

    Security (HTTPS) enforcement for this URL. Possible values: ["SECURE_DEFAULT", "SECURE_NEVER", "SECURE_OPTIONAL", "SECURE_ALWAYS"]

    • url optional - string

    URL to serve the endpoint at.

  • automatic_scaling list block

    The time period that the Autoscaler should wait before it starts collecting information from a new instance. This prevents the autoscaler from collecting information when the instance is initializing, during which the collected usage would not be reliable. Default: 120s

    Number of concurrent requests an automatic scaling instance can accept before the scheduler spawns a new instance. Defaults to a runtime-specific value.

    Maximum number of idle instances that should be maintained for this version.

    Maximum amount of time that a request should wait in the pending queue before starting a new instance to handle it.

    Maximum number of instances that should be started to handle requests for this version. Default: 20

    Minimum number of idle instances that should be maintained for this version. Only applicable for the default version of a service.

    Minimum amount of time a request should wait in the pending queue before starting a new instance to handle it.

    Minimum number of running instances that should be maintained for this version. Default: 2

  • deployment list block
    • cloud_build_options list block

      Path to the yaml file used in deployment, used to determine runtime configuration details.

      The Cloud Build timeout used as part of any dependent builds performed by version creation. Defaults to 10 minutes. A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".

    • container list block

      URI to the hosted container image in Google Container Registry. The URI must be fully qualified and include a tag or digest. Examples: "gcr.io/my-project/image:tag" or "gcr.io/my-project/image@digest"

    • files set block

      SHA1 checksum of the file

      Source URL

    • zip list block

      files count

      Source URL

  • endpoints_api_service list block

    Endpoints service configuration ID as specified by the Service Management API. For example "2016-09-19r1". By default, the rollout strategy for Endpoints is "FIXED". This means that Endpoints starts up with a particular configuration ID. When a new configuration is rolled out, Endpoints must be given the new configuration ID. The configId field is used to give the configuration ID and is required in this case. Endpoints also has a rollout strategy called "MANAGED". When using this, Endpoints fetches the latest configuration and does not need the configuration ID. In this case, configId must be omitted.

    Enable or disable trace sampling. By default, this is set to false for enabled.

    Endpoints service name which is the name of the "service" resource in the Service Management API. For example "myapi.endpoints.myproject.cloud.goog"

    Endpoints rollout strategy. If FIXED, configId must be specified. If MANAGED, configId must be omitted. Default value: "FIXED" Possible values: ["FIXED", "MANAGED"]

  • entrypoint list block

    The format should be a shell command that can be fed to bash -c.

  • handlers list block

    Actions to take when the user is not logged in. Possible values: ["AUTH_FAIL_ACTION_REDIRECT", "AUTH_FAIL_ACTION_UNAUTHORIZED"]

    Methods to restrict access to a URL based on login status. Possible values: ["LOGIN_OPTIONAL", "LOGIN_ADMIN", "LOGIN_REQUIRED"]

    30x code to use when performing redirects for the secure field. Possible values: ["REDIRECT_HTTP_RESPONSE_CODE_301", "REDIRECT_HTTP_RESPONSE_CODE_302", "REDIRECT_HTTP_RESPONSE_CODE_303", "REDIRECT_HTTP_RESPONSE_CODE_307"]

    Security (HTTPS) enforcement for this URL. Possible values: ["SECURE_DEFAULT", "SECURE_NEVER", "SECURE_OPTIONAL", "SECURE_ALWAYS"]

    URL prefix. Uses regular expression syntax, which means regexp special characters must be escaped, but should not contain groupings. All URLs that begin with this prefix are handled by this handler, using the portion of the URL after the prefix as part of the file path.

    • script list block

      Path to the script from the application root directory.

    • static_files list block

      Whether files should also be uploaded as code data. By default, files declared in static file handlers are uploaded as static data and are only served to end users; they cannot be read by the application. If enabled, uploads are charged against both your code and static data storage resource quotas.

      Time a static file served by this handler should be cached by web proxies and browsers. A duration in seconds with up to nine fractional digits, terminated by 's'. Example "3.5s". Default is '0s'

      HTTP headers to use for all responses from these URLs. An object containing a list of "key:value" value pairs.".

      MIME type used to serve all files served by this handler. Defaults to file-specific MIME types, which are derived from each file's filename extension.

      Path to the static files matched by the URL pattern, from the application root directory. The path can refer to text matched in groupings in the URL pattern.

      Whether this handler should match the request if the file referenced by the handler does not exist.

      Regular expression that matches the file paths for all files that should be referenced by this handler.

  • liveness_check list block

    Interval between health checks.

    Number of consecutive failed checks required before considering the VM unhealthy. Default: 4.

    Host header to send when performing a HTTP Readiness check. Example: "myapp.appspot.com"

    The initial delay before starting to execute the checks. Default: "300s"

    The request path.

    Number of consecutive successful checks required before considering the VM healthy. Default: 2.

    Time before the check is considered failed. Default: "4s"

  • manual_scaling list block

    Number of instances to assign to the service at the start. Note: When managing the number of instances at runtime through the App Engine Admin API or the (now deprecated) Python 2 Modules API set_num_instances() you must use 'lifecycle.ignore_changes = ["manual_scaling"[0].instances]' to prevent drift detection.

  • network list block

    List of ports, or port pairs, to forward from the virtual machine to the application container.

    Tag to apply to the instance during creation.

    Google Compute Engine network where the virtual machines are created. Specify the short name, not the resource path.

    Enable session affinity.

    Google Cloud Platform sub-network where the virtual machines are created. Specify the short name, not the resource path. If the network that the instance is being created in is a Legacy network, then the IP address is allocated from the IPv4Range. If the network that the instance is being created in is an auto Subnet Mode Network, then only network name should be specified (not the subnetworkName) and the IP address is created from the IPCidrRange of the subnetwork that exists in that zone for that network. If the network that the instance is being created in is a custom Subnet Mode Network, then the subnetworkName must be specified and the IP address is created from the IPCidrRange of the subnetwork. If specified, the subnetwork must exist in the same region as the App Engine flexible environment application.

  • readiness_check list block

    A maximum time limit on application initialization, measured from moment the application successfully replies to a healthcheck until it is ready to serve traffic. Default: "300s"

    Interval between health checks. Default: "5s".

    Number of consecutive failed checks required before removing traffic. Default: 2.

    Host header to send when performing a HTTP Readiness check. Example: "myapp.appspot.com"

    The request path.

    Number of consecutive successful checks required before receiving traffic. Default: 2.

    Time before the check is considered failed. Default: "4s"

  • resources list block
    • cpu optional - number

    Number of CPU cores needed.

    Disk size (GB) needed.

    Memory (GB) needed.

    • volumes list block

      Unique name for the volume.

      Volume size in gigabytes.

      Underlying volume type, e.g. 'tmpfs'.

  • timeouts single block
  • vpc_access_connector list block

    Full Serverless VPC Access Connector name e.g. /projects/my-project/locations/us-central1/connectors/c1.

Explanation in Terraform Registry

Flexible App Version resource to create a new version of flexible GAE Application. Based on Google Compute Engine, the App Engine flexible environment automatically scales your app up and down while also balancing the load. Learn about the differences between the standard environment and the flexible environment at https://cloud.google.com/appengine/docs/the-appengine-environments.

Note: The App Engine flexible environment service account uses the member ID service-[YOUR_PROJECT_NUMBER]@gae-api-prod.google.com.iam.gserviceaccount.com It should have the App Engine Flexible Environment Service Agent role, which will be applied when the appengineflex.googleapis.com service is enabled. To get more information about FlexibleAppVersion, see:

Frequently asked questions

What is Google App Engine Flexible App Version?

Google App Engine Flexible App Version is a resource for App Engine of Google Cloud Platform. Settings can be wrote in Terraform.

Where can I find the example code for the Google App Engine Flexible App Version?

For Terraform, the mikamakusa/terraform, artefactory-global/one-click-mlflow and AnudeepKonaboina/GoogleCloudPlatform source code examples are useful. See the Terraform Example section for further details.

security-icon

Automate config file reviews on your commits

Fix issues in your infrastructure as code with auto-generated patches.