GCP

To use Terrateam with GCP, authentication and authorization need to be configured for your GCP account. Setup only takes a few minutes.

OpenID Connect (OIDC)

What is OIDC

OpenID Connect (OIDC) allows your GitHub Actions workflows to access resources in GCP, without having to store any credentials as long-lived GitHub secrets.

A Terraform module is available to easily create all of the GCP resources that Terrateam requires.

1. main.tf

   Note

   Replace GITHUB_ORG with your GitHub organization name and PROJECT_ID with your GCP project ID.

   module "terraform_gcp_terrateam_setup" {
     source                        = "github.com/terrateamio/terraform-gcp-terrateam-setup"
     github_org                    = "GITHUB_ORG"
     project_id                    = "PROJECT_ID"
     service_account_description   = "Terrateam service account"
     workload_identity_pool_id     = "terrateam-pool"
     workload_identity_provider    = "terrateam-provider"
     service_account_name          = "terrateam"
     service_account_role          = "roles/editor"
   }
   
   output "google_iam_workload_identity_pool_provider_github_provider_name" {
     value = module.terraform_gcp_terrateam_setup
   }

2. Apply changes

   terraform apply

Configure Terrateam for OIDC

Create the .terrateam/config.yml configuration file at the root of your Terraform repository.

Note

Replace PROJECT_ID with your GCP project ID and WORKLOAD_IDENTITY_PROVIDER with the output value of google_iam_workload_identity_pool_provider_github_provider_name.

hooks:
  all:
    pre:
      - type: oidc
        provider: gcp
        service_account: "terrateam@PROJECT_ID.iam.gserviceaccount.com"
        workload_identity_provider: "WORKLOAD_IDENTITY_PROVIDER"

Manual instructions

Follow the instructions below to manually configure GCP for Terrateam authentication and authorization.

Expand for step-by-step OIDC and static credentials instructions

OIDC

1. Create a Terrateam service account

   gcloud iam service-accounts create terrateam \
   --description="Terrateam" \
   --display-name="Terrateam" \
   --project="$PROJECT_ID"

2. Create the workload identity pool

   gcloud iam workload-identity-pools create "terrateam-pool" \
     --project="${PROJECT_ID}" \
     --location="global" \
     --display-name="Terrateam pool"

3. Create the OIDC provider

   gcloud iam workload-identity-pools providers create-oidc "terrateam-provider" \
     --project="${PROJECT_ID}" \
     --location="global" \
     --workload-identity-pool="terrateam-pool" \
     --display-name="Terrateam provider" \
     --attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository,attribute.repository_owner=assertion.repository_owner" \
     --issuer-uri="https://token.actions.githubusercontent.com"

4. Create IAM policy bindings

   gcloud iam service-accounts add-iam-policy-binding "terrateam@${PROJECT_ID}.iam.gserviceaccount.com" \
     --project="${PROJECT_ID}" \
     --role="roles/iam.workloadIdentityUser" \
     --member="principalSet://iam.googleapis.com/projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/terrateam-pool/attribute.repository_owner/${GITHUB_ORG}"

   gcloud projects add-iam-policy-binding ${PROJECT_ID} \
   --member="serviceAccount:terrateam@${PROJECT_ID}.iam.gserviceaccount.com" \
   --role='roles/editor'

5. Configure Terrateam for OIDC

Static Credentials

1. Create a terrateam service account

   gcloud iam service-accounts create terrateam \
   --description="Terrateam" \
   --display-name="Terrateam" \
   --project="$PROJECT_ID"

2. Add the roles/editor IAM policy binding

   gcloud projects add-iam-policy-binding "$PROJECT_ID" \
   --member="serviceAccount:terrateam@$PROJECT_ID.iam.gserviceaccount.com" \
   --role="roles/editor"

3. Create and download the service account key

   gcloud iam service-accounts keys create terrateam-service-account-key.json \
   --iam-account="terrateam@$PROJECT_ID.iam.gserviceaccount.com"

4. Export your Terraform organization/repo combination as an environment variable.

   export REPO="<OWNER/REPO>"

5. Create the GCP Service Account Key GitHub Secret

   gh secret --repo "$REPO" set GOOGLE_CREDENTIALS < terrateam-service-account-key.json

You are now able to use Terrateam for plan and apply operations against GCP resources.