Google Cloud Platform Project

google_project (Terraform)

The Project in Cloud Platform can be configured in Terraform with the resource name google_project. The following sections describe 5 examples of how to use the resource and its parameters.

Example Usage from GitHub

melscoop-test/check

resource "google_project" "project_good" {
  name = "good"
  project_id = "123456"
}

resource "google_project" "project_bad_1" {

sinmetal/godtf

resource "google_project" "tftest-20181128d" {
  name            = "tftest-20181128d"
  project_id      = "tftest-20181128d"
  org_id          = "190932998497"
  billing_account = "00B800-C1B810-4248C9"
}

doitintl/terraform-gcp-templates

resource "google_project" "shared_network_production" {
  name      = "shared-nw-prod"
  folder_id = google_folder.shared_services.name
  project_id = format(
    "shared-nw-prod-%s",
    var.shared_suffix,

melscoop-test/check

resource "google_project" "project_good_1" {
  name       = "My Project"
  project_id = "good"
  org_id     = "1234567"
}

anubhavvirtmo/data-lake-gcp-demo

resource "google_project" "data-lake" {
  name       = "Data Lake"
  project_id = "cloud-iac-data-lake" # Replace with an unique project ID
  billing_account = "" # Replace with your billing ID
}

Security Best Practices for google_project

There is 1 setting in google_project that should be taken care of for security reasons. The following section explain an overview and example code.

Ensure project-level default network creation is disabled

It is better to disable the auto-creation of default networks. The default network for a GCP project is usually configured coarsely, leaving the risk of unwanted access to resources in the network.

Parameters

• auto_create_network optional - bool

Create the 'default' network automatically. Default true. If set to false, the default network will be deleted. Note that, for quota purposes, you will still need to have 1 network slot available to create the project successfully, even if you set auto_create_network to false, since the network will exist momentarily.

• billing_account optional - string

The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details.

• folder_id optional computed - string

The numeric ID of the folder this project should be created under. Only one of org_id or folder_id may be specified. If the folder_id is specified, then the project is created under the specified folder. Changing this forces the project to be migrated to the newly specified folder.

• id optional computed - string
• labels optional - map from string to string

A set of key/value label pairs to assign to the project.

• name required - string

The display name of the project.

• number optional computed - string

The numeric identifier of the project.

• org_id optional computed - string

The numeric ID of the organization this project belongs to. Changing this forces a new project to be created. Only one of org_id or folder_id may be specified. If the org_id is specified then the project is created at the top level. Changing this forces the project to be migrated to the newly specified organization.

• project_id required - string

The project ID. Changing this forces a new project to be created.

• skip_delete optional computed - bool

If true, the Terraform resource can be deleted without deleting the Project via the Google API.

• timeouts single block
  • create optional - string
  • delete optional - string
  • read optional - string
  • update optional - string

Explanation in Terraform Registry

Allows creation and management of a Google Cloud Platform project. Projects created with this resource must be associated with an Organization. See the Organization documentation for more details. The user or service account that is running Terraform when creating a google_project resource must have roles/resourcemanager.projectCreator on the specified organization. See the Access Control for Organizations Using IAM doc for more information.

This resource reads the specified billing account on every terraform apply and plan operation so you must have permissions on the specified billing account. It is recommended to use the constraints/compute.skipDefaultNetworkCreation constraint to remove the default network instead of setting auto_create_network to false. To get more information about projects, see:

• API documentation
• How-to Guides
  • Creating and managing projects