Google Compute Engine Route

This page shows how to write Terraform for Compute Engine Route and write them securely.

google_compute_route (Terraform)

The Route in Compute Engine can be configured in Terraform with the resource name google_compute_route. The following sections describe how to use the resource and its parameters.

Example Usage from GitHub

An example could not be found in GitHub.

Review your Terraform file for Google best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).


An optional description of this resource. Provide this property when you create the resource.

The destination range of outgoing packets that this route applies to. Only IPv4 is supported.

  • id optional computed - string
  • name required - string

Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression 'a-z?' which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.

The network that this route applies to.

URL to a gateway that should handle matching packets. Currently, you can only specify the internet gateway, using a full or partial valid URL: '' 'projects/project/global/gateways/default-internet-gateway' 'global/gateways/default-internet-gateway' The string 'default-internet-gateway'.

The URL to a forwarding rule of type loadBalancingScheme=INTERNAL that should handle matching packets. You can only specify the forwarding rule as a partial or full URL. For example, the following are all valid URLs: regions/region/forwardingRules/forwardingRule Note that this can only be used when the destinationRange is a public (non-RFC 1918) IP CIDR range.

URL to an instance that should handle matching packets. You can specify this as a full or partial URL. For example: '' 'projects/project/zones/zone/instances/instance' 'zones/zone/instances/instance' Just the instance name, with the zone in 'next_hop_instance_zone'.

The zone of the instance specified in next_hop_instance. Omit if next_hop_instance is specified as a URL.

Network IP address of an instance that should handle matching packets.

URL to a Network that should handle matching packets.

URL to a VpnTunnel that should handle matching packets.

The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In the case of two routes with equal prefix length, the one with the lowest-numbered priority value wins. Default value is 1000. Valid range is 0 through 65535.

A list of instance tags to which this route applies.

Explanation in Terraform Registry

Represents a Route resource. A route is a rule that specifies how certain packets should be handled by the virtual network. Routes are associated with virtual machines by tag, and the set of routes for a particular virtual machine is called its routing table. For each packet leaving a virtual machine, the system searches that virtual machine's routing table for a single best matching route. Routes match packets by destination IP address, preferring smaller or more specific ranges over larger ones. If there is a tie, the system selects the route with the smallest priority value. If there is still a tie, it uses the layer three and four packet headers to select just one of the remaining matching routes. The packet is then forwarded as specified by the next_hop field of the winning route -- either to another virtual machine destination, a virtual machine gateway or a Compute Engine-operated gateway. Packets that do not match any route in the sending virtual machine's routing table will be dropped. A Route resource must have exactly one specification of either nextHopGateway, nextHopInstance, nextHopIp, nextHopVpnTunnel, or nextHopIlb. To get more information about Route, see:

Tips: Best Practices for The Other Google Compute Engine Resources

In addition to the google_compute_disk, Google Compute Engine has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.



Ensure the encryption key for your GCE disk is stored securely

It is better to store the encryption key for your GCE disk securely. Secret Manager could be used instead.



Ensure your VPC firewall blocks unwanted outbound traffic

It is better to block unwanted outbound traffic not to expose resources in the VPC to unwanted attacks.



Ensure appropriate service account is assigned to your GCE instance

It is better to create a custom service account for the instance and assign it.



Ensure OS login for your GCE instances is enabled at project level

It is better to enable OS login for your GCE instances. Enabling OS login ensures that SSH keys used to connect to instances are mapped with IAM users, allowing centralized and automated SSH key management.



Ensure to use modern TLS protocols

It's better to adopt TLS v1.2+ instead of outdated TLS protocols.



Ensure VPC flow logging is enabled

It is better to enable VPC flow logging. VPC flow logging allows us to audit traffic in your network.

Review your Google Compute Engine settings

In addition to the above, there are other security points you should be aware of making sure that your .tf files are protected in Shisho Cloud.

Frequently asked questions

What is Google Compute Engine Route?

Google Compute Engine Route is a resource for Compute Engine of Google Cloud Platform. Settings can be wrote in Terraform.


Automate config file reviews on your commits

Fix issues in your infrastructure as code with auto-generated patches.