terraform-example-foundation VS terraform-provider-google

- How do we secure?

You can use this approach for each step along the way, how to secure secrets in your cloud? code? IaC? container deployments? CI/CD?

If we assume infra / app is code, the tooling matters a lot less. How do you provision certificates via IaC? How do you grant IAM to resources and how do you revoke?

There are examples like https://github.com/terraform-google-modules/terraform-exampl... of more advanced IaC architectures, but you can start as small or as complex as you want and evolve if done properly.

Personally, I love me some Kubernetes + ArgoCD (GitOps) + Google Workload Identity + Google Secret Manager, but I am 100% biased.

Also looked for something similar, and unfortunately didnt find one. Based our enterprise repo off the caf model (not using the module) similar to this google repo: https://github.com/terraform-google-modules/terraform-example-foundation

How did I tackle this exam? 1. On github there is an example foundation for GCP on terraform. https://github.com/terraform-google-modules/terraform-example-foundation I went through this week after week to help me learn. I made customizations and I deployed and destroyed over and over again, making changes. I used this to create a basic organization with a website, this is how I learnt.

If you are looking to setup a new cloud project with Terraform, then that is an another thing. For GCP, Google offers a toolkit: https://github.com/terraform-google-modules/terraform-example-foundation

https://github.com/terraform-google-modules/terraform-example-foundation maybe have a look at the layer approach from Google?

> DNS without CGO works perfectly

It does not. I know this because it impacts my daily work and the work of others. Honestly if you could make my day and go figure out exactly what's going wrong with the pure go DNS implementation it would make my life alot simpler and I wouldn't have to maintain shell scripts that update etc/hosts to hard code in ipv4 addresses for the APIs I access with terraform.

https://github.com/hashicorp/terraform-provider-google/issue...

GCP Terraform Provider

I think the equivalent for AWS is https://registry.terraform.io/providers/hashicorp/aws/latest/docs and for GCP https://registry.terraform.io/providers/hashicorp/google/latest/docs

There's an open issue in the gcp provider for exactly this. I'd recommend thumbs-upping it if you haven't already, as well as subscribing to notifications so you can see when there are updates.

only some people inside google could answer that but here's an issue already? https://github.com/hashicorp/terraform-provider-google/issues/11648

Not sure if you've solved for this or not, but it didn't work for me running terraform as a service account, it appears that it doesn't handle HTTP headers correctly: https://github.com/hashicorp/terraform-provider-google/issues/6738 but it does work with impersonation of that account, which is what I did. Note that your org can only have 1 access policy, and in my case I had to make google_access_context_manager_access_level anyways.

All I can find is an old thread saying cannot do. https://github.com/hashicorp/terraform-provider-google/issues/6413 Has there been any update to this, or does anyone know of a work around?

If you followed that request, you get to this PR which added the feature and updated this documentation