Google Compute Engine Router NAT

google_compute_router_nat (Terraform)

The Router NAT in Compute Engine can be configured in Terraform with the resource name google_compute_router_nat. The following sections describe 4 examples of how to use the resource and its parameters.

Example Usage from GitHub

gilyas/infracost

resource "google_compute_router_nat" "no_usage" {
  name                               = "example"
  router                             = "example-router"
  region                             = "us-central1"
  nat_ip_allocate_option             = "MANUAL_ONLY"
  source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"

jonathanpaliza/gcloudProjects

resource "google_compute_router_nat" "nat-config-usce1" {
    name = "nat-config-usce1"
    router = google_compute_router.nat-router-usce1.name
    region = google_compute_router.nat-router-usce1.region
    nat_ip_allocate_option = "AUTO_ONLY"
    source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"

infracost/infracost

resource "google_compute_router_nat" "no_usage" {
  name                               = "example"
  router                             = "example-router"
  region                             = "us-central1"
  nat_ip_allocate_option             = "MANUAL_ONLY"
  source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"

boreal321/terraform-bigip-gcp

resource "google_compute_router_nat" "mgmt_nat" {
  name                               = "mgmt-router-nat"
  router                             = google_compute_router.mgmt_router.name
  region                             = var.region
  nat_ip_allocate_option             = "AUTO_ONLY"
  source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"

Parameters

• drain_nat_ips optional - set of string

A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT.

• enable_endpoint_independent_mapping optional - bool

Specifies if endpoint independent mapping is enabled. This is enabled by default. For more information see the official documentation.

• icmp_idle_timeout_sec optional - number

Timeout (in seconds) for ICMP connections. Defaults to 30s if not set.

• id optional computed - string
• min_ports_per_vm optional - number

Minimum number of ports allocated to a VM from this NAT.

• name required - string

Name of the NAT service. The name must be 1-63 characters long and comply with RFC1035.

• nat_ip_allocate_option required - string

How external IPs should be allocated for this NAT. Valid values are 'AUTO_ONLY' for only allowing NAT IPs allocated by Google Cloud Platform, or 'MANUAL_ONLY' for only user-allocated NAT IP addresses. Possible values: ["MANUAL_ONLY", "AUTO_ONLY"]

• nat_ips optional - set of string

Self-links of NAT IPs. Only valid if natIpAllocateOption is set to MANUAL_ONLY.

• project optional computed - string
• region optional computed - string

Region where the router and NAT reside.

• router required - string

The name of the Cloud Router in which this NAT will be configured.

• source_subnetwork_ip_ranges_to_nat required - string

How NAT should be configured per Subnetwork. If 'ALL_SUBNETWORKS_ALL_IP_RANGES', all of the IP ranges in every Subnetwork are allowed to Nat. If 'ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES', all of the primary IP ranges in every Subnetwork are allowed to Nat. 'LIST_OF_SUBNETWORKS': A list of Subnetworks are allowed to Nat (specified in the field subnetwork below). Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other RouterNat section in any Router for this network in this region. Possible values: ["ALL_SUBNETWORKS_ALL_IP_RANGES", "ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES", "LIST_OF_SUBNETWORKS"]

• tcp_established_idle_timeout_sec optional - number

Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.

• tcp_transitory_idle_timeout_sec optional - number

Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.

• udp_idle_timeout_sec optional - number

Timeout (in seconds) for UDP connections. Defaults to 30s if not set.

• log_config list block
  • enable required - bool

  Indicates whether or not to export logs.

  • filter required - string

  Specifies the desired filtering of logs on this NAT. Possible values: ["ERRORS_ONLY", "TRANSLATIONS_ONLY", "ALL"]

• subnetwork set block
  • name required - string

  Self-link of subnetwork to NAT

  • secondary_ip_range_names optional - set of string

  List of the secondary ranges of the subnetwork that are allowed to use NAT. This can be populated only if 'LIST_OF_SECONDARY_IP_RANGES' is one of the values in sourceIpRangesToNat

  • source_ip_ranges_to_nat required - set of string

  List of options for which source IPs in the subnetwork should have NAT enabled. Supported values include: 'ALL_IP_RANGES', 'LIST_OF_SECONDARY_IP_RANGES', 'PRIMARY_IP_RANGE'.

• timeouts single block
  • create optional - string
  • delete optional - string
  • update optional - string

Explanation in Terraform Registry

A NAT service created in a router. To get more information about RouterNat, see:

• API documentation
• How-to Guides
  • Google Cloud Router

Tips: Best Practices for The Other Google Compute Engine Resources

In addition to the google_compute_disk, Google Compute Engine has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

google_compute_disk

Ensure the encryption key for your GCE disk is stored securely

It is better to store the encryption key for your GCE disk securely. Secret Manager could be used instead.

google_compute_firewall

Ensure your VPC firewall blocks unwanted outbound traffic

It is better to block unwanted outbound traffic not to expose resources in the VPC to unwanted attacks.

google_compute_instance

Ensure appropriate service account is assigned to your GCE instance

It is better to create a custom service account for the instance and assign it.

google_compute_project_metadata

Ensure OS login for your GCE instances is enabled at project level

It is better to enable OS login for your GCE instances. Enabling OS login ensures that SSH keys used to connect to instances are mapped with IAM users, allowing centralized and automated SSH key management.

google_compute_ssl_policy

Ensure to use modern TLS protocols

It's better to adopt TLS v1.2+ instead of outdated TLS protocols.

google_compute_subnetwork

Ensure VPC flow logging is enabled

It is better to enable VPC flow logging. VPC flow logging allows us to audit traffic in your network.