GCP

To use Terrateam with GCP, authentication and authorization need to be configured for your GCP account. Setup only takes a few minutes.

OpenID Connect (OIDC)

What is OIDC

OpenID Connect (OIDC) allows your GitHub Actions workflows to access resources in GCP, without having to store any credentials as long-lived GitHub secrets.

A Terraform module is available to easily create all of the GCP resources that Terrateam requires.

1. main.tf

   Note

   Replace GITHUB_ORG with your GitHub organization name and PROJECT_ID with your GCP project ID.

   module "terraform_gcp_terrateam_setup" {
     source                        = "github.com/terrateamio/terraform-gcp-terrateam-setup"
     github_org                    = "GITHUB_ORG"
     project_id                    = "PROJECT_ID"
     service_account_description   = "Terrateam service account"
     workload_identity_pool_id     = "terrateam-pool"
     workload_identity_provider    = "terrateam-provider"
     service_account_name          = "terrateam"
     service_account_role          = "roles/editor"
   }
   
   output "google_iam_workload_identity_pool_provider_github_provider_name" {
     value = module.terraform_gcp_terrateam_setup
   }

2. Apply Changes

   terraform apply

Configure Terrateam for OIDC

Create the .terrateam/config.yml configuration file at the root of your Terraform repository.

Note

Replace PROJECT_ID with your GCP project ID and WORKLOAD_IDENTITY_PROVIDER with the output value of google_iam_workload_identity_pool_provider_github_provider_name.

hooks:
  all:
    pre:
      - type: oidc
        provider: gcp
        service_account: "terrateam@PROJECT_ID.iam.gserviceaccount.com"
        workload_identity_provider: "WORKLOAD_IDENTITY_PROVIDER"

Did you know?

You can utilize distinct ARNs for various environments and operations. For more details, read the Cloud Credentials documentation.

Manual Instructions

Follow the instructions below to manually configure GCP for Terrateam authentication and authorization.

Expand for step-by-step OIDC and static credentials instructions

OIDC

1. Create a Terrateam service account

   gcloud iam service-accounts create terrateam \
   --description="Terrateam" \
   --display-name="Terrateam" \
   --project="$PROJECT_ID"

2. Create the workload identity pool

   gcloud iam workload-identity-pools create "terrateam-pool" \
     --project="${PROJECT_ID}" \
     --location="global" \
     --display-name="Terrateam pool"

3. Create the OIDC provider

   gcloud iam workload-identity-pools providers create-oidc "terrateam-provider" \
     --project="${PROJECT_ID}" \
     --location="global" \
     --workload-identity-pool="terrateam-pool" \
     --display-name="Terrateam provider" \
     --attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository,attribute.repository_owner=assertion.repository_owner" \
     --issuer-uri="https://token.actions.githubusercontent.com"

4. Create IAM policy bindings

   gcloud iam service-accounts add-iam-policy-binding "terrateam@${PROJECT_ID}.iam.gserviceaccount.com" \
     --project="${PROJECT_ID}" \
     --role="roles/iam.workloadIdentityUser" \
     --member="principalSet://iam.googleapis.com/projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/terrateam-pool/attribute.repository_owner/${GITHUB_ORG}"

   gcloud projects add-iam-policy-binding ${PROJECT_ID} \
   --member="serviceAccount:terrateam@${PROJECT_ID}.iam.gserviceaccount.com" \
   --role='roles/editor'

5. Configure Terrateam for OIDC

Static Credentials

1. Create a terrateam service account

   gcloud iam service-accounts create terrateam \
   --description="Terrateam" \
   --display-name="Terrateam" \
   --project="$PROJECT_ID"

2. Add the roles/editor IAM policy binding

   gcloud projects add-iam-policy-binding "$PROJECT_ID" \
   --member="serviceAccount:terrateam@$PROJECT_ID.iam.gserviceaccount.com" \
   --role="roles/editor"

3. Create and download the service account key

   gcloud iam service-accounts keys create terrateam-service-account-key.json \
   --iam-account="terrateam@$PROJECT_ID.iam.gserviceaccount.com"

4. Export your Terraform organization/repo combination as an environment variable.

   export REPO="<OWNER/REPO>"

5. Create the GCP Service Account Key GitHub Secret

   gh secret --repo "$REPO" set GOOGLE_CREDENTIALS < terrateam-service-account-key.json

You are now able to use Terrateam for plan and apply operations against GCP resources.