mirror of
https://github.com/ryboe/private-ip-cloud-sql-db.git
synced 2025-12-19 18:14:59 -05:00
81d77bacb4
* terraform v1.0.0 -> v1.1.5 * hashicorp/google 3.80.0 -> 4.9.0 * hashicorp/tfe 0.25.3 -> 0.28.1 * postgres 13 -> 14
48 lines
1.8 KiB
HCL
48 lines
1.8 KiB
HCL
// vpc module
|
|
|
|
resource "google_compute_network" "vpc" {
|
|
name = var.name
|
|
routing_mode = "GLOBAL"
|
|
auto_create_subnetworks = true
|
|
}
|
|
|
|
# We need to allocate an IP block for private IPs. We want everything in the VPC
|
|
# to have a private IP. This improves security and latency, since requests to
|
|
# private IPs are routed through Google's network, not the Internet.
|
|
resource "google_compute_global_address" "private_ip_block" {
|
|
name = "private-ip-block"
|
|
description = "A block of private IP addresses that are accessible only from within the VPC."
|
|
purpose = "VPC_PEERING"
|
|
address_type = "INTERNAL"
|
|
ip_version = "IPV4"
|
|
# We don't specify a address range because Google will automatically assign one for us.
|
|
prefix_length = 20 # ~4k IPs
|
|
network = google_compute_network.vpc.self_link
|
|
}
|
|
|
|
# This enables private services access. This makes it possible for instances
|
|
# within the VPC and Google services to communicate exclusively using internal
|
|
# IP addresses. Details here:
|
|
# https://cloud.google.com/sql/docs/postgres/configure-private-services-access
|
|
resource "google_service_networking_connection" "private_vpc_connection" {
|
|
network = google_compute_network.vpc.self_link
|
|
service = "servicenetworking.googleapis.com"
|
|
reserved_peering_ranges = [google_compute_global_address.private_ip_block.name]
|
|
}
|
|
|
|
# We'll need this to connect to the Cloud SQL Proxy.
|
|
resource "google_compute_firewall" "allow_ssh" {
|
|
name = "allow-ssh"
|
|
description = "Allow SSH traffic to any instance tagged with 'ssh-enabled'"
|
|
network = google_compute_network.vpc.name
|
|
direction = "INGRESS"
|
|
|
|
allow {
|
|
protocol = "tcp"
|
|
ports = ["22"]
|
|
}
|
|
|
|
source_ranges = ["0.0.0.0/0"]
|
|
target_tags = ["ssh-enabled"]
|
|
}
|