Represents a ServiceAttachment resource.
To get more information about ServiceAttachment, see:
resource "google_compute_service_attachment" "psc_ilb_service_attachment" {
name = "my-psc-ilb"
region = "us-west2"
description = "A service attachment configured with Terraform"
domain_names = ["gcp.tfacc.hashicorptest.com."]
enable_proxy_protocol = true
connection_preference = "ACCEPT_AUTOMATIC"
nat_subnets = [google_compute_subnetwork.psc_ilb_nat.id]
target_service = google_compute_forwarding_rule.psc_ilb_target_service.id
}
resource "google_compute_address" "psc_ilb_consumer_address" {
name = "psc-ilb-consumer-address"
region = "us-west2"
subnetwork = "default"
address_type = "INTERNAL"
}
resource "google_compute_forwarding_rule" "psc_ilb_consumer" {
name = "psc-ilb-consumer-forwarding-rule"
region = "us-west2"
target = google_compute_service_attachment.psc_ilb_service_attachment.id
load_balancing_scheme = "" # need to override EXTERNAL default when target is a service attachment
network = "default"
ip_address = google_compute_address.psc_ilb_consumer_address.id
}
resource "google_compute_forwarding_rule" "psc_ilb_target_service" {
name = "producer-forwarding-rule"
region = "us-west2"
load_balancing_scheme = "INTERNAL"
backend_service = google_compute_region_backend_service.producer_service_backend.id
all_ports = true
network = google_compute_network.psc_ilb_network.name
subnetwork = google_compute_subnetwork.psc_ilb_producer_subnetwork.name
}
resource "google_compute_region_backend_service" "producer_service_backend" {
name = "producer-service"
region = "us-west2"
health_checks = [google_compute_health_check.producer_service_health_check.id]
}
resource "google_compute_health_check" "producer_service_health_check" {
name = "producer-service-health-check"
check_interval_sec = 1
timeout_sec = 1
tcp_health_check {
port = "80"
}
}
resource "google_compute_network" "psc_ilb_network" {
name = "psc-ilb-network"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "psc_ilb_producer_subnetwork" {
name = "psc-ilb-producer-subnetwork"
region = "us-west2"
network = google_compute_network.psc_ilb_network.id
ip_cidr_range = "10.0.0.0/16"
}
resource "google_compute_subnetwork" "psc_ilb_nat" {
name = "psc-ilb-nat"
region = "us-west2"
network = google_compute_network.psc_ilb_network.id
purpose = "PRIVATE_SERVICE_CONNECT"
ip_cidr_range = "10.1.0.0/16"
}
resource "google_compute_service_attachment" "psc_ilb_service_attachment" {
name = "my-psc-ilb"
region = "us-west2"
description = "A service attachment configured with Terraform"
domain_names = ["gcp.tfacc.hashicorptest.com."]
enable_proxy_protocol = true
connection_preference = "ACCEPT_MANUAL"
nat_subnets = [google_compute_subnetwork.psc_ilb_nat.id]
target_service = google_compute_forwarding_rule.psc_ilb_target_service.id
consumer_reject_lists = ["673497134629", "482878270665"]
consumer_accept_lists {
project_id_or_num = "658859330310"
connection_limit = 4
}
}
resource "google_compute_address" "psc_ilb_consumer_address" {
name = "psc-ilb-consumer-address"
region = "us-west2"
subnetwork = "default"
address_type = "INTERNAL"
}
resource "google_compute_forwarding_rule" "psc_ilb_consumer" {
name = "psc-ilb-consumer-forwarding-rule"
region = "us-west2"
target = google_compute_service_attachment.psc_ilb_service_attachment.id
load_balancing_scheme = "" # need to override EXTERNAL default when target is a service attachment
network = "default"
ip_address = google_compute_address.psc_ilb_consumer_address.id
}
resource "google_compute_forwarding_rule" "psc_ilb_target_service" {
name = "producer-forwarding-rule"
region = "us-west2"
load_balancing_scheme = "INTERNAL"
backend_service = google_compute_region_backend_service.producer_service_backend.id
all_ports = true
network = google_compute_network.psc_ilb_network.name
subnetwork = google_compute_subnetwork.psc_ilb_producer_subnetwork.name
}
resource "google_compute_region_backend_service" "producer_service_backend" {
name = "producer-service"
region = "us-west2"
health_checks = [google_compute_health_check.producer_service_health_check.id]
}
resource "google_compute_health_check" "producer_service_health_check" {
name = "producer-service-health-check"
check_interval_sec = 1
timeout_sec = 1
tcp_health_check {
port = "80"
}
}
resource "google_compute_network" "psc_ilb_network" {
name = "psc-ilb-network"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "psc_ilb_producer_subnetwork" {
name = "psc-ilb-producer-subnetwork"
region = "us-west2"
network = google_compute_network.psc_ilb_network.id
ip_cidr_range = "10.0.0.0/16"
}
resource "google_compute_subnetwork" "psc_ilb_nat" {
name = "psc-ilb-nat"
region = "us-west2"
network = google_compute_network.psc_ilb_network.id
purpose = "PRIVATE_SERVICE_CONNECT"
ip_cidr_range = "10.1.0.0/16"
}
resource "google_compute_service_attachment" "psc_ilb_service_attachment" {
name = "my-psc-ilb"
region = "us-west2"
description = "A service attachment configured with Terraform"
enable_proxy_protocol = false
connection_preference = "ACCEPT_MANUAL"
nat_subnets = [google_compute_subnetwork.psc_ilb_nat.id]
target_service = google_compute_forwarding_rule.psc_ilb_target_service.id
consumer_accept_lists {
network_url = google_compute_network.psc_ilb_consumer_network.self_link
connection_limit = 1
}
}
resource "google_compute_network" "psc_ilb_consumer_network" {
name = "psc-ilb-consumer-network"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "psc_ilb_consumer_subnetwork" {
name = "psc-ilb-consumer-network"
ip_cidr_range = "10.0.0.0/16"
region = "us-west2"
network = google_compute_network.psc_ilb_consumer_network.id
}
resource "google_compute_address" "psc_ilb_consumer_address" {
name = "psc-ilb-consumer-address"
region = "us-west2"
subnetwork = google_compute_subnetwork.psc_ilb_consumer_subnetwork.id
address_type = "INTERNAL"
}
resource "google_compute_forwarding_rule" "psc_ilb_consumer" {
name = "psc-ilb-consumer-forwarding-rule"
region = "us-west2"
target = google_compute_service_attachment.psc_ilb_service_attachment.id
load_balancing_scheme = "" # need to override EXTERNAL default when target is a service attachment
network = google_compute_network.psc_ilb_consumer_network.id
subnetwork = google_compute_subnetwork.psc_ilb_consumer_subnetwork.id
ip_address = google_compute_address.psc_ilb_consumer_address.id
}
resource "google_compute_forwarding_rule" "psc_ilb_target_service" {
name = "producer-forwarding-rule"
region = "us-west2"
load_balancing_scheme = "INTERNAL"
backend_service = google_compute_region_backend_service.producer_service_backend.id
all_ports = true
network = google_compute_network.psc_ilb_network.name
subnetwork = google_compute_subnetwork.psc_ilb_producer_subnetwork.name
}
resource "google_compute_region_backend_service" "producer_service_backend" {
name = "producer-service"
region = "us-west2"
health_checks = [google_compute_health_check.producer_service_health_check.id]
}
resource "google_compute_health_check" "producer_service_health_check" {
name = "producer-service-health-check"
check_interval_sec = 1
timeout_sec = 1
tcp_health_check {
port = "80"
}
}
resource "google_compute_network" "psc_ilb_network" {
name = "psc-ilb-network"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "psc_ilb_producer_subnetwork" {
name = "psc-ilb-producer-subnetwork"
region = "us-west2"
network = google_compute_network.psc_ilb_network.id
ip_cidr_range = "10.0.0.0/16"
}
resource "google_compute_subnetwork" "psc_ilb_nat" {
name = "psc-ilb-nat"
region = "us-west2"
network = google_compute_network.psc_ilb_network.id
purpose = "PRIVATE_SERVICE_CONNECT"
ip_cidr_range = "10.1.0.0/16"
}
resource "google_compute_service_attachment" "psc_ilb_service_attachment" {
name = "my-psc-ilb"
region = "us-west2"
description = "A service attachment configured with Terraform"
domain_names = ["gcp.tfacc.hashicorptest.com."]
enable_proxy_protocol = true
connection_preference = "ACCEPT_MANUAL"
nat_subnets = [google_compute_subnetwork.psc_ilb_nat.id]
target_service = google_compute_forwarding_rule.psc_ilb_target_service.id
consumer_reject_lists = ["673497134629", "482878270665"]
consumer_accept_lists {
project_id_or_num = "658859330310"
connection_limit = 4
}
reconcile_connections = false
}
resource "google_compute_forwarding_rule" "psc_ilb_target_service" {
name = "producer-forwarding-rule"
region = "us-west2"
load_balancing_scheme = "INTERNAL"
backend_service = google_compute_region_backend_service.producer_service_backend.id
all_ports = true
network = google_compute_network.psc_ilb_network.name
subnetwork = google_compute_subnetwork.psc_ilb_producer_subnetwork.name
}
resource "google_compute_region_backend_service" "producer_service_backend" {
name = "producer-service"
region = "us-west2"
health_checks = [google_compute_health_check.producer_service_health_check.id]
}
resource "google_compute_health_check" "producer_service_health_check" {
name = "producer-service-health-check"
check_interval_sec = 1
timeout_sec = 1
tcp_health_check {
port = "80"
}
}
resource "google_compute_network" "psc_ilb_network" {
name = "psc-ilb-network"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "psc_ilb_producer_subnetwork" {
name = "psc-ilb-producer-subnetwork"
region = "us-west2"
network = google_compute_network.psc_ilb_network.id
ip_cidr_range = "10.0.0.0/16"
}
resource "google_compute_subnetwork" "psc_ilb_nat" {
name = "psc-ilb-nat"
region = "us-west2"
network = google_compute_network.psc_ilb_network.id
purpose = "PRIVATE_SERVICE_CONNECT"
ip_cidr_range = "10.1.0.0/16"
}
The following arguments are supported:
name
-
(Required)
Name of the resource. The name must be 1-63 characters long, and
comply with RFC1035. Specifically, the name must be 1-63 characters
long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?
which means the first character must be a lowercase letter, and all
following characters must be a dash, lowercase letter, or digit,
except the last character, which cannot be a dash.
connection_preference
-
(Required)
The connection preference to use for this service attachment. Valid
values include "ACCEPT_AUTOMATIC", "ACCEPT_MANUAL".
target_service
-
(Required)
The URL of a forwarding rule that represents the service identified by
this service attachment.
nat_subnets
-
(Required)
An array of subnets that is provided for NAT in this service attachment.
enable_proxy_protocol
-
(Required)
If true, enable the proxy protocol which is for supplying client TCP/IP
address data in TCP connections that traverse proxies on their way to
destination servers.
description
-
(Optional)
An optional description of this resource.
domain_names
-
(Optional)
If specified, the domain name will be used during the integration between
the PSC connected endpoints and the Cloud DNS. For example, this is a
valid domain name: "p.mycompany.com.". Current max number of domain names
supported is 1.
consumer_reject_lists
-
(Optional)
An array of projects that are not allowed to connect to this service
attachment.
consumer_accept_lists
-
(Optional)
An array of projects that are allowed to connect to this service
attachment.
Structure is documented below.
reconcile_connections
-
(Optional)
This flag determines whether a consumer accept/reject list change can reconcile the statuses of existing ACCEPTED or REJECTED PSC endpoints.
If false, connection policy update will only affect existing PENDING PSC endpoints. Existing ACCEPTED/REJECTED endpoints will remain untouched regardless how the connection policy is modified .
If true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list.
region
-
(Optional)
URL of the region where the resource resides.
project
- (Optional) The ID of the project in which the resource belongs.
If it is not provided, the provider project is used.
The consumer_accept_lists
block supports:
project_id_or_num
-
(Optional)
A project that is allowed to connect to this service attachment.
Only one of project_id_or_num and network_url may be set.
network_url
-
(Optional)
The network that is allowed to connect to this service attachment.
Only one of project_id_or_num and network_url may be set.
connection_limit
-
(Required)
The number of consumer forwarding rules the consumer project can
create.
In addition to the arguments listed above, the following computed attributes are exported:
id
- an identifier for the resource with format projects/{{project}}/regions/{{region}}/serviceAttachments/{{name}}
fingerprint
-
Fingerprint of this resource. This field is used internally during
updates of this resource.
connected_endpoints
-
An array of the consumer forwarding rules connected to this service
attachment.
Structure is documented below.
self_link
- The URI of the created resource.The connected_endpoints
block contains:
endpoint
-
(Output)
The URL of the consumer forwarding rule.
status
-
(Output)
The status of the connection from the consumer forwarding rule to
this service attachment.
This resource provides the following Timeouts configuration options:
create
- Default is 20 minutes.update
- Default is 20 minutes.delete
- Default is 20 minutes.ServiceAttachment can be imported using any of these accepted formats:
projects/{{project}}/regions/{{region}}/serviceAttachments/{{name}}
{{project}}/{{region}}/{{name}}
{{region}}/{{name}}
{{name}}
In Terraform v1.5.0 and later, use an import
block to import ServiceAttachment using one of the formats above. For example:
import {
id = "projects/{{project}}/regions/{{region}}/serviceAttachments/{{name}}"
to = google_compute_service_attachment.default
}
When using the terraform import
command, ServiceAttachment can be imported using one of the formats above. For example:
$ terraform import google_compute_service_attachment.default projects/{{project}}/regions/{{region}}/serviceAttachments/{{name}}
$ terraform import google_compute_service_attachment.default {{project}}/{{region}}/{{name}}
$ terraform import google_compute_service_attachment.default {{region}}/{{name}}
$ terraform import google_compute_service_attachment.default {{name}}
This resource supports User Project Overrides.