{"id":48852,"date":"2023-10-30T12:32:26","date_gmt":"2022-11-26T12:33:07","guid":{"rendered":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8-terraform-%e5%9c%a8gcp%e4%b8%8a%e5%bb%ba%e7%ab%8b%e7%bb%84%e7%bb%87%e8%ae%be%e7%bd%ae%e3%80%81%e5%85%b1%e4%ba%abvpc%e5%92%8cvpn%e3%80%82\/"},"modified":"2024-05-04T06:42:48","modified_gmt":"2024-05-03T22:42:48","slug":"%e4%bd%bf%e7%94%a8-terraform-%e5%9c%a8gcp%e4%b8%8a%e5%bb%ba%e7%ab%8b%e7%bb%84%e7%bb%87%e8%ae%be%e7%bd%ae%e3%80%81%e5%85%b1%e4%ba%abvpc%e5%92%8cvpn%e3%80%82","status":"publish","type":"post","link":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8-terraform-%e5%9c%a8gcp%e4%b8%8a%e5%bb%ba%e7%ab%8b%e7%bb%84%e7%bb%87%e8%ae%be%e7%bd%ae%e3%80%81%e5%85%b1%e4%ba%abvpc%e5%92%8cvpn%e3%80%82\/","title":{"rendered":"\u4f7f\u7528 Terraform \u5728GCP\u4e0a\u5efa\u7acb\u7ec4\u7ec7\u8bbe\u7f6e\u3001\u5171\u4eabVPC\u548cVPN"},"content":{"rendered":"<h2>\u8bf7\u5c06\u4ee5\u4e0b\u5185\u5bb9\u7528\u4e2d\u6587\u8fdb\u884c\u91ca\u4e49\u3002<\/h2>\n<p>\u56e0\u4e3a\u7528 Terraform \u5de5\u5177\u5c06\u4ee5\u524d\u624b\u52a8\u6784\u5efa\u7684 GCP\uff08Google Cloud Platform\uff09\u90e8\u7f72\u8f6c\u53d8\u4e3a\u57fa\u7840\u8bbe\u65bd\u5373\u4ee3\u7801\uff0c\u6240\u4ee5\u5728\u6b64\u8bb0\u5f55\u8fd9\u4e9b\u53d8\u5316\u7684\u8be6\u7ec6\u5185\u5bb9\u3002<\/p>\n<h4>\u8fc4\u4eca\u4e3a\u6b62\uff0c\u4ee5\u624b\u52a8\u65b9\u5f0f\uff08\u5305\u62ecWeb\u63a7\u5236\u53f0\u3001gcloud\u7b49\uff09\u6267\u884c\u7684\u4efb\u52a1\uff08Terraform\u4ee3\u7801\u5316\u76ee\u6807\uff09\u3002<\/h4>\n<h2>\u5efa\u7acb\u5167\u5bb9<\/h2>\n<p>\u5b9e\u65bd\u524d\u8ff0\u7684\u300c\u4e4b\u524d\u8fdb\u884c\u7684\u5185\u5bb9\uff08Terraform \u4ee3\u7801\u5316\u76ee\u6807\uff09\u300d\u7684\u94fe\u63a5\u5185\u5bb9\u3002<br \/>\n\u5185\u5bb9\u5982\u4e0b\uff0c\u5df2\u7ecf\u5199\u660e\u7684\u5185\u5bb9\u7701\u7565\u89e3\u91ca\uff0c\u8865\u5145\u7684\u5185\u5bb9\u5219\u6807\u6ce8\u4e86\u8865\u5145\u8bf4\u660e\u7684\u90e8\u5206\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">\u7d44\u7e54\u306e\u4f5c\u6210\u3068\u5171\u6709 VPC \u69cb\u7bc9<\/ul>\n<\/li>\n<\/ul>\n<p>\u30db\u30b9\u30c8\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u4f5c\u6210<br \/>\n\u30b5\u30fc\u30d3\u30b9\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u4f5c\u6210<br \/>\n\u5171\u6709 VPC<br \/>\nSubnet \u306e\u8a2d\u5b9a<br \/>\n[\u8ffd\u52a0] \u7d44\u7e54\u306e\u30dd\u30ea\u30b7\u30fc\u8ffd\u52a0<br \/>\n[\u8ffd\u52a0] \u6a29\u9650\u306e\u8ffd\u52a0<\/p>\n<p>HA VPN<\/p>\n<p>\u81ea\u5b85\u30e9\u30dc\u5411\u3051\u306b HA VPN \u3092\u69cb\u7bc9\u3059\u308b<br \/>\n\u81ea\u5b85\u30e9\u30dc\u5411\u3051\u306b\u8a2d\u5b9aConfig\u4f8b\u3092\u51fa\u529b\u3059\u308b (EdgeRouer\u5411\u3051)<\/p>\n<p>VPC Service Controls<\/p>\n<p>\u30b5\u30fc\u30d3\u30b9\u5883\u754c\u306e\u4f5c\u6210<\/p>\n<p>\u9650\u5b9a\u516c\u958b Google \u30a2\u30af\u30bb\u30b9<\/p>\n<p>googleapis.com \u5411\u3051\u306e Private \u5411\u3051 DNS \u8a2d\u5b9a<\/p>\n<h3>GCP\u8d44\u6e90\u914d\u7f6e<\/h3>\n<p>\u5728\u7ec4\u7ec7\u4e2d\u521b\u5efa\u6587\u4ef6\u5939\uff08\u7c7b\u4f3c\u4e8e\u90e8\u95e8\uff09\uff0c\u5e76\u5c06\u9879\u76ee\u7ec4\u7ec7\u6210\u5c5e\u4e8e\u6587\u4ef6\u5939\u7684\u7ed3\u6784\uff08\u53c2\u8003\u5199\u6cd5\uff09\u3002<br \/>\n\u6309\u7167 Terraform \u7684\u6307\u5bfc\uff08\u53c2\u8003\u94fe\u63a5\uff1ahttps:\/\/cloud.google.com\/community\/tutorials\/managing-gcp-projects-with-terraform\uff09\uff0c\u76f4\u63a5\u5728\u7ec4\u7ec7\u4e2d\u6784\u5efa\u7ba1\u7406\u9879\u76ee\u3002<\/p>\n<div><img decoding=\"async\" class=\"post-images\" title=\"\" src=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d8742913a08637a6bf572\/12-0.png\" alt=\"\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8 2021-03-27 12.36.14.png\" \/><\/div>\n<p>\u5173\u4e8e\u9879\u76ee\u540d\u79f0\uff0c\u8bf7\u53c2\u8003\u4f01\u4e1a\u7ea7\u6307\u5357\u4e2d\u7684\u9879\u76ee\u540d\u79f0\uff0c\u5e76\u6dfb\u52a0\u60a8\u81ea\u5df1\u7684ID\u4ee5\u786e\u4fdd\u4e0e\u5176\u4ed6\u9879\u76ee\u4e0d\u91cd\u590d\uff08ID\u5fc5\u987b\u552f\u4e00\uff09\u3002<br \/>\n&#8211; \u9879\u76ee\u540d\u79f0\uff08ID\uff09\uff1a[\u7ec4\u7ec7\u540d\u79f0]-[\u670d\u52a1\u540d\u79f0]-[\u73af\u5883\u540d\u79f0]<\/p>\n<h3>Terraform \u76ee\u5f55\u7ed3\u6784<\/h3>\n<p>\u7531\u4e8e\u4e0d\u77e5\u9053\u6b63\u786e\u7684\u89e3\u51b3\u65b9\u6cd5\uff0c\u56e0\u6b64\u7b80\u5355\u5730\u8fdb\u884c\u4e86\u6587\u4ef6\u5206\u5272\u3002(\u6a21\u5757\u5316\u7b49\u4ee5\u540e\u518d\u8003\u8651\u3002\u4f3c\u4e4e\u6ca1\u6709\u4e8b\u5148\u5b9a\u4e49\u7684\u6807\u51c6\u3002)<br \/>\n\u6709\u5173\u9884\u5148\u64cd\u4f5c\u548cTerraform\u9879\u76ee\u7684\u521b\u5efa\uff0c\u5c06\u5176\u653e\u5728\u5355\u72ec\u7684\u6587\u4ef6\u5939\uff08prestage\uff09\u4e2d\u3002<br \/>\n\u7531\u4e8e\u5168\u90e8\u90fd\u5199\u5728\u4e86Qiita\u4e2d\u4f1a\u5f88\u957f\uff0c\u6240\u4ee5\u8fdb\u884c\u4e86\u7701\u7565\u63cf\u8ff0\uff0c\u6574\u4f53\u5728GitHub\u4e0a\u516c\u5f00\u4e86\uff08URL\uff1ahttps:\/\/github.com\/suzuyu\/terraform-public\uff09\u3002<br \/>\n\u203bbackend.tf\u5c06\u6839\u636eprestage\/\u6267\u884c\u7684\u8f93\u51fa\u8fdb\u884c\u521b\u5efa\uff08GitHub\u4e0a\u6ca1\u6709\uff09\u3002<\/p>\n<pre class=\"post-pre\"><code>.\r\n\u251c\u2500\u2500 README.md\r\n\u251c\u2500\u2500 backend.tf\r\n\u251c\u2500\u2500 cloudnat.tf\r\n\u251c\u2500\u2500 dns.tf\r\n\u251c\u2500\u2500 firewall.tf\r\n\u251c\u2500\u2500 host.tf\r\n\u251c\u2500\u2500 main.tf\r\n\u251c\u2500\u2500 organization.tf\r\n\u251c\u2500\u2500 prestage\r\n\u2502\u00a0\u00a0 \u251c\u2500\u2500 main.tf\r\n\u2502\u00a0\u00a0 \u251c\u2500\u2500 output.tf\r\n\u2502\u00a0\u00a0 \u251c\u2500\u2500 variables.tf\r\n\u251c\u2500\u2500 service1.tf\r\n\u251c\u2500\u2500 subnet.tf\r\n\u251c\u2500\u2500 terraform_pj\r\n\u251c\u2500\u2500 variables.tf\r\n\u251c\u2500\u2500 vpc_service_controls.tf\r\n\u2514\u2500\u2500 vpn.tf\r\n\r\n<\/code><\/pre>\n<div><img decoding=\"async\" class=\"post-images\" title=\"\" src=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d8742913a08637a6bf572\/17-0.png\" alt=\"\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8 2021-03-27 12.36.32.png\" \/><\/div>\n<p>\u6839\u636e\u6587\u4ef6\u5206\u7c7b\u3001\u89e3\u91ca\u548c\u8bb0\u5f55\u6bcf\u4e2a\u6587\u4ef6\u7684\u7ed3\u6784\u548c\u5185\u5bb9<\/p>\n<h2>\u5efa\u7acb<\/h2>\n<p>\u6211\u4eec\u6309\u7167\u4e0b\u9762\u7684\u987a\u5e8f\u8fdb\u884c\u5b9e\u65bd\u3002<\/p>\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\u524d\u671f\u51c6\u5907 \/ \u57df\u540d\u83b7\u53d6\u00b7CloudIdentity\u542f\u7528\uff08\u624b\u52a8\uff09<\/ol>\n<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\u521b\u5efaterraform\u7ba1\u7406\u9879\u76ee\uff08prestage\/\uff09<\/ol>\n<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\u7ec4\u7ec7\u8bbe\u7f6e\uff08organaization.tf\uff09<\/ol>\n<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\u521b\u5efa\u4e3b\u673a\u9879\u76ee\uff08host.tf\uff09<\/ol>\n<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\u521b\u5efa\u670d\u52a1\u9879\u76ee\uff08service1.tf\uff09<\/ol>\n<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\u521b\u5efa\u5b50\u7f51\uff08subnet.tf\uff09<\/ol>\n<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\u8bbe\u7f6e\u9632\u706b\u5899\uff08firewall.tf\uff09<\/ol>\n<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\u8bbe\u7f6eDNS\uff08\u9650\u5b9a\u516c\u5f00Google\u8bbf\u95ee\uff09\uff08dns.tf\uff09<\/ol>\n<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\u521b\u5efaHA VPN\uff08vpn.tf\uff09<\/ol>\n<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\u8bbe\u7f6e\u9762\u5411\u4e92\u8054\u7f51\u7684NAT\uff08cloudnat.tf\uff09<\/ol>\n<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol>\u521b\u5efaVPC\u670d\u52a1\u63a7\u5236\uff08vpc_service_controls.tf\uff09<\/ol>\n<h3>1. \u51c6\u5907\u5de5\u4f5c\/\u8d2d\u4e70\u57df\u540d\u548c\u542f\u7528\u4e91\u8eab\u4efd\uff08\u624b\u52a8\u65b9\u5f0f\uff09<\/h3>\n<p>\u76f4\u5230\u57df\u540d\u6ce8\u518c\u548c\u7ec4\u7ec7\u751f\u6548\u90fd\u9700\u8981\u624b\u52a8\u64cd\u4f5c\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">\u30c9\u30e1\u30a4\u30f3\u53d6\u5f97<\/ul>\n<\/li>\n<\/ul>\n<p>https:\/\/qiita.com\/suzuyui\/items\/947867f52897417ee31b#1-%E3%83%89%E3%83%A1%E3%82%A4%E3%83%B3%E5%8F%96%E5%BE%97<\/p>\n<p>\u7d44\u7e54\u306e\u4f5c\u6210 (Cloud Identity, \u7d44\u7e54\u306e\u4f5c\u6210\u307e\u3067\u3092\u5b8c\u4e86\u3055\u305b\u308b)<\/p>\n<p>https:\/\/qiita.com\/suzuyui\/items\/947867f52897417ee31b#2-%E7%B5%84%E7%B9%94%E3%81%AE%E4%BD%9C%E6%88%90<\/p>\n<div><img decoding=\"async\" class=\"post-images\" title=\"\" src=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d8742913a08637a6bf572\/25-0.png\" alt=\"\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8 2021-03-21 21.19.32.png\" \/><\/div>\n<p>\u5728\u5de5\u4f5c\u73af\u5883\u4e2d\uff0c\u4e8b\u5148\u5b89\u88c5 Terraform \u548c gcloud\u3002<\/p>\n<p>\u5b89\u88c5\u65b9\u6cd5\uff1ahttps:\/\/qiita.com\/suzuyui\/items\/231b39a60ff545032bc6#terraform-\u5b89\u88c5<\/p>\n<pre class=\"post-pre\"><code>% terraform version\r\nTerraform v0.14.6\r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code>% gcloud --version\r\nGoogle Cloud SDK 327.0.0\r\nalpha 2021.02.05\r\nbeta 2021.02.05\r\nbq 2.0.64\r\ncore 2021.02.05\r\ngsutil 4.58\r\n<\/code><\/pre>\n<p>\u7ee7\u7eed\u4f7f\u7528terraform\u8fdb\u884c\u6784\u5efa<\/p>\n<h3>2. \u521b\u5efaterraform\u7ba1\u7406\u9879\u76ee\uff08\u9884\u9636\u6bb5\/\uff09<\/h3>\n<p>\u53c2\u8003\u4e86Google Cloud\u793e\u533a\u4e2dGoogle\u5458\u5de5\u7f16\u5199\u7684\u6559\u7a0b\uff0c\u5728Terraform\u4e2d\u521b\u5efa\u7ba1\u7406\u9879\u76ee\u3002<br \/>\n\u5c06\u6559\u7a0b\u4e2d\u624b\u52a8\u6267\u884c\u7684\u90e8\u5206\u8f6c\u5316\u4e3aprestage\u4e2d\u7684Terraform\u4ee3\u7801\u5e76\u6267\u884c\uff08\u4e5f\u53ef\u4ee5\u624b\u52a8\u6267\u884c\uff09\u3002<br \/>\n\u7531\u4e8e\u8fd8\u672a\u521b\u5efa\u9002\u7528\u4e8eTerraform\u7684\u670d\u52a1\u5e10\u53f7\uff0c\u56e0\u6b64\u5c06\u4f7f\u7528gcloud\u7684\u8ba4\u8bc1\u4fe1\u606f\u6765\u8bbf\u95eeGCP\u3002<\/p>\n<p>\u521b\u5efa Terraform \u7ba1\u7406\u9879\u76ee\uff1ahttps:\/\/cloud.google.com\/community\/tutorials\/managing-gcp-projects-with-terraform<\/p>\n<p>\u4ee5\u4e0b\u5185\u5bb9\u5df2\u7ecf\u5728\u4e0a\u8ff0URL\u4e2d\u53c2\u8003\u5e76\u8fdb\u884c\u4e86\u7f16\u7801\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">Create the Terraform Admin Project<\/ul>\n<\/li>\n<\/ul>\n<p>terraform admin project \u306e\u4f5c\u6210<br \/>\n\u7d44\u7e54\u914d\u4e0b\u306e\u6307\u5b9a\u3092\u3059\u308b<\/p>\n<p>Create the Terraform service account<\/p>\n<p>terraform \u3092\u52d5\u304b\u3059\u305f\u3081\u306e service account \u3092\u4f5c\u6210\u3059\u308b<br \/>\nprestage \u306f gcloud \u306e\u8a8d\u8a3c\u30a2\u30ab\u30a6\u30f3\u30c8\u3067\u52d5\u304b\u3059\u304c\u3001\u4eca\u5f8c\u30b5\u30fc\u30d0\u7b49\u3067\u52d5\u304b\u3059\u3053\u3068\u304c\u53ef\u80fd\u306b\u306a\u308b<br \/>\nservice account \u306e\u8a8d\u8a3c\u30ad\u30fc (json) \u306f\u30d5\u30a1\u30a4\u30eb\u3068\u3057\u3066\u51fa\u529b\u3057\u3001\u305d\u306e\u5f8c\u306e\u5fc5\u8981\u30b3\u30de\u30f3\u30c9\u306f output \u3067\u51fa\u529b\u3059\u308b<br \/>\nterraform \u3067\u5fc5\u8981\u306a API \u3092\u6709\u52b9\u5316\u3059\u308b<\/p>\n<p>Add organization\/folder-level permissions<\/p>\n<p>terraform service account \u306b\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u4f5c\u6210\u6a29\u9650\u3068\u8ab2\u91d1\u30e6\u30fc\u30b6\u6a29\u9650\u306a\u3069\u3092\u4ed8\u4e0e\u3059\u308b<\/p>\n<p>terraform state \u306e\u4fdd\u5b58\u5148\u30b9\u30c8\u30ec\u30fc\u30b8\u306e\u4f5c\u6210 \/ Set up remote state in Cloud Storage<\/p>\n<p>terraform \u306e backend \u306b\u3059\u308b Cloud Storage \u3092\u4f5c\u6210\u3059\u308b<br \/>\nbackend \u8a2d\u5b9a\u306e\u8a18\u8f09\u65b9\u6cd5\u306f output \u3067\u51fa\u529b\u3059\u308b<\/p>\n<pre class=\"post-pre\"><code>\u251c\u2500\u2500 prestage\r\n\u2502\u00a0\u00a0 \u251c\u2500\u2500 main.tf\r\n\u2502\u00a0\u00a0 \u251c\u2500\u2500 output.tf\r\n\u2502\u00a0\u00a0 \u251c\u2500\u2500 variables.tf\r\n<\/code><\/pre>\n<p>\u4f5c\u4e3a\u53d8\u91cf\uff0c\u51c6\u5907\u4ee5\u4e0b\u5185\u5bb9\uff1a<br \/>\n\u6839\u636e\u8bc4\u8bba\u6240\u5199\uff0c\u5728\u88ab\u6807\u8bb0\u4e3a xxx \u5e76\u906e\u853d\u7684\u5730\u65b9\u8fdb\u884c\u66f4\u6539\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c1\"># org_id (\u4e0b\u8a18\u3067\u51fa\u529b\u3055\u308c\u308b \"ID\" \u3092 \"org_id\" \u306e\u5024\u306b\u3059\u308b)<\/span>\r\n<span class=\"c1\">## gcloud organizations list<\/span>\r\n<span class=\"c1\"># billing_account (\u4e0b\u8a18\u3067\u51fa\u529b\u3055\u308c\u308b \"ACCOUNT_ID\" \u3092 \"billing_account\" \u306e\u5024\u306b\u3059\u308b)<\/span>\r\n<span class=\"c1\">## gcloud beta billing accounts list<\/span>\r\n<span class=\"c1\"># gcp-terraform-admin@[xxx.xxx]<\/span>\r\n<span class=\"c1\">## \u7d44\u7e54\u3067\u4f7f\u7528\u3059\u308b\u30c9\u30e1\u30a4\u30f3(xxx.xxx)\u306e Cloud Identity \u3067\u4e8b\u524d\u306b Terraform \u7ba1\u7406\u30e6\u30fc\u30b6\u30b0\u30eb\u30fc\u30d7\u306e\u30a2\u30ab\u30a6\u30f3\u30c8\u30b0\u30eb\u30fc\u30d7\u3092\u4f5c\u6210\u3057\u3066\u304a\u304f(\u540c\u3058\u6a29\u9650\u306b\u3057\u3066\u5207\u308a\u5206\u3051\u3088\u3046)<\/span>\r\n<span class=\"c1\"># org_name<\/span>\r\n<span class=\"c1\">## \u7d44\u7e54\u306e\u8b58\u5225\u5b50\u3001\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u306e\u547d\u540d\u306b\u5fc5\u8981\u306a\u3060\u3051\u3067\u4f55\u3067\u3082\u826f\u3044<\/span>\r\n\r\n<span class=\"nx\">variable<\/span> <span class=\"s2\">\"gcp_common\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">type<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">object<\/span><span class=\"err\">(<\/span><span class=\"p\">{<\/span>\r\n    <span class=\"nx\">org_name<\/span>        <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n    <span class=\"nx\">org_id<\/span>          <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n    <span class=\"nx\">billing_account<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n  <span class=\"p\">}<\/span><span class=\"err\">)<\/span>\r\n  <span class=\"nx\">default<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">org_name<\/span>        <span class=\"p\">=<\/span> <span class=\"s2\">\"xxxxxx\"<\/span>\r\n    <span class=\"nx\">org_id<\/span>          <span class=\"p\">=<\/span> <span class=\"s2\">\"xxxxxxxxxxxx\"<\/span>\r\n    <span class=\"nx\">billing_account<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"xxxxxx-xxxxxx-xxxxxx\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">variable<\/span> <span class=\"s2\">\"admin_user_group\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">type<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">object<\/span><span class=\"err\">(<\/span><span class=\"p\">{<\/span>\r\n    <span class=\"nx\">email<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n  <span class=\"p\">}<\/span><span class=\"err\">)<\/span>\r\n  <span class=\"nx\">default<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">email<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"gcp-terraform-admin@[xxx.xxx]\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">variable<\/span> <span class=\"s2\">\"terraform_pj\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">type<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">object<\/span><span class=\"err\">(<\/span><span class=\"p\">{<\/span>\r\n    <span class=\"nx\">identity_name<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n  <span class=\"p\">}<\/span><span class=\"err\">)<\/span>\r\n  <span class=\"nx\">default<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">identity_name<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"terraformadmin\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<p>\u5728 terraform \u4e2d\u7684\u6267\u884c\u5185\u5bb9\u5982\u4e0b\u6240\u793a\u7684 main.tf \u6587\u4ef6\u6240\u793a<br \/>\n\u6839\u636e\u6ce8\u91ca\u8fdb\u884c\u9884\u5148\u64cd\u4f5c(\u6267\u884c\u547d\u4ee4\u8bf7\u53c2\u8003\u6ce8\u91ca)<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">\u8ab2\u91d1\u30a2\u30ab\u30a6\u30f3\u30c8\u3078\u6a29\u9650\u3092\u4ed8\u4e0e\u3059\u308b<\/ul>\n<\/li>\n<\/ul>\n<p>\u8ab2\u91d1\u30a2\u30ab\u30a6\u30f3\u30c8(variables.tf\u3067billing_account)\u3078\u4eca\u56de gcloud \u3092\u5b9f\u65bd\u3059\u308b\u7d44\u7e54\u7ba1\u7406\u8005\u30a2\u30ab\u30a6\u30f3\u30c8\u3078\u6a29\u9650\u3092\u4ed8\u4e0e\u3059\u308b<\/p>\n<p>\u7d44\u7e54\u7ba1\u7406\u8005\u30a2\u30ab\u30a6\u30f3\u30c8\u3067 gcloud \u8a2d\u5b9a\u3092\u3059\u308b<br \/>\n\u7d44\u7e54\u30dd\u30ea\u30b7\u30fc\u3092\u64cd\u4f5c\u3067\u304d\u308b\u3088\u3046\u306b\u6a29\u9650\u3092\u4ed8\u4e0e\u3059\u308b<br \/>\nworkspace \u306e\u540d\u524d\u3067\u74b0\u5883\u540d\u3068\u3057\u3066\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u306b\u540d\u79f0\u4ed8\u4e0e\u3059\u308b\u306e\u3067\u3001terraform workspace \u3092\u5207\u308a\u66ff\u3048\u308b<\/p>\n<p>workspace\u3000\u3092\u4f7f\u3063\u305f\u307b\u3046\u304c\u3044\u3044\u304b\u306f\u60a9\u307f\u3069\u3053\u308d\u3060\u304c\u8a66\u3057\u306b\u4f7f\u7528\u3057\u3066\u307f\u3066\u3044\u308b<\/p>\n<pre class=\"post-pre\"><code><span class=\"c1\">## \u5185\u5bb9<\/span>\r\n<span class=\"c1\"># Terraform \u7528\u306e\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3092\u4f5c\u6210\u3059\u308b<\/span>\r\n<span class=\"c1\"># \u53c2\u7167 https:\/\/cloud.google.com\/community\/tutorials\/managing-gcp-projects-with-terraform<\/span>\r\n<span class=\"c1\">## \u524d\u63d0<\/span>\r\n<span class=\"c1\"># \u7d44\u7e54\u3092\u4f5c\u6210\u6e08\u307f<\/span>\r\n<span class=\"c1\"># \u8ab2\u91d1\u30a2\u30ab\u30a6\u30f3\u30c8\u4f5c\u6210\u6e08\u307f<\/span>\r\n<span class=\"c1\"># \u7ba1\u7406\u30e6\u30fc\u30b6\u30b0\u30eb\u30fc\u30d7\u3092 admin.google \u3067\u4f5c\u6210\u6e08\u307f<\/span>\r\n<span class=\"c1\">## \u7d44\u7e54\u7ba1\u7406\u8005\u304c\u8ab2\u91d1\u30a2\u30ab\u30a6\u30f3\u30c8\u3078\u6a29\u9650\u4ed8\u4e0e\u3067\u304d\u308b\u3088\u3046\u306b\u3059\u308b<\/span>\r\n<span class=\"c1\"># gcloud config set account [\u8ab2\u91d1\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u30a2\u30c9\u30df\u30f3\u30a2\u30ab\u30a6\u30f3\u30c8]<\/span>\r\n<span class=\"c1\"># gcloud beta billing accounts list<\/span>\r\n<span class=\"c1\"># gcloud beta billing accounts add-iam-policy-binding [var.gcp_common.billing_account] --member=user:[org admin user account] --role roles\/billing.admin<\/span>\r\n<span class=\"c1\">## \u7d44\u7e54\u7ba1\u7406\u8005\u306e\u30a2\u30ab\u30a6\u30f3\u30c8\u3067 gcloud \u30b3\u30de\u30f3\u30c9\u3092\u5229\u7528\u3067\u304d\u308b\u3088\u3046\u306b\u3059\u308b<\/span>\r\n<span class=\"c1\"># gcloud auth login [org admin user account]<\/span>\r\n<span class=\"c1\"># gcloud config set account [org admin user account]<\/span>\r\n<span class=\"c1\"># gcloud auth application-default login<\/span>\r\n<span class=\"c1\">## \u7d44\u7e54\u7ba1\u7406\u8005\u304c\u7d44\u7e54\u30dd\u30ea\u30b7\u30fc\u3092\u7de8\u96c6\u3067\u304d\u308b\u3088\u3046\u306b\u3059\u308b<\/span>\r\n<span class=\"c1\"># gcloud organizations list<\/span>\r\n<span class=\"c1\"># gcloud organizations add-iam-policy-binding [var.gcp_common.org_id] --member=user:[org admin user account] --role=roles\/orgpolicy.policyAdmin<\/span>\r\n<span class=\"c1\">## workspace \u3092 \"dev\", \"prd\" \u306a\u3069\u306b\u3059\u308b<\/span>\r\n<span class=\"c1\"># terraform workspace new dev<\/span>\r\n\r\n<span class=\"nx\">provider<\/span> <span class=\"s2\">\"google\"<\/span> <span class=\"p\">{}<\/span>\r\n\r\n<span class=\"c1\"># Terraform Project \u4f5c\u6210<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"google_project\"<\/span> <span class=\"s2\">\"terraform\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">name<\/span>                <span class=\"p\">=<\/span> <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\"-\"<\/span><span class=\"err\">,<\/span> <span class=\"p\">[<\/span><span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">gcp_common<\/span><span class=\"err\">.<\/span><span class=\"nx\">org_name<\/span><span class=\"p\">,<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform_pj<\/span><span class=\"err\">.<\/span><span class=\"nx\">identity_name<\/span><span class=\"p\">,<\/span> <span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">workspace<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n  <span class=\"nx\">project_id<\/span>          <span class=\"p\">=<\/span> <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\"-\"<\/span><span class=\"err\">,<\/span> <span class=\"p\">[<\/span><span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">gcp_common<\/span><span class=\"err\">.<\/span><span class=\"nx\">org_name<\/span><span class=\"p\">,<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform_pj<\/span><span class=\"err\">.<\/span><span class=\"nx\">identity_name<\/span><span class=\"p\">,<\/span> <span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">workspace<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n  <span class=\"nx\">org_id<\/span>              <span class=\"p\">=<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">gcp_common<\/span><span class=\"err\">.<\/span><span class=\"nx\">org_id<\/span>\r\n  <span class=\"nx\">billing_account<\/span>     <span class=\"p\">=<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">gcp_common<\/span><span class=\"err\">.<\/span><span class=\"nx\">billing_account<\/span>\r\n  <span class=\"nx\">auto_create_network<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">false<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\"># Sevice API \u6709\u52b9\u5316 (google_project \u3068\u540c\u3058 terraform \u3067\u5b9f\u65bd\u304c\u5fc5\u9808)<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"google_project_service\"<\/span> <span class=\"s2\">\"terraform\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">project<\/span>                    <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">id<\/span>\r\n  <span class=\"nx\">disable_dependent_services<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">true<\/span>\r\n\r\n  <span class=\"nx\">for_each<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">toset<\/span><span class=\"err\">(<\/span><span class=\"p\">[<\/span>\r\n    <span class=\"s2\">\"cloudresourcemanager.googleapis.com\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"serviceusage.googleapis.com\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"cloudidentity.googleapis.com\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"cloudbilling.googleapis.com\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"iam.googleapis.com\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"compute.googleapis.com\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"container.googleapis.com\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"accesscontextmanager.googleapis.com\"<\/span><span class=\"p\">,<\/span> <span class=\"c1\"># VPC Service Controls \u306b\u5fc5\u8981<\/span>\r\n  <span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n  <span class=\"nx\">service<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">each<\/span><span class=\"err\">.<\/span><span class=\"nx\">value<\/span>\r\n\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_project<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\"># Terraform \u30b5\u30fc\u30d3\u30b9\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u4f5c\u6210<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"google_service_account\"<\/span> <span class=\"s2\">\"terraform\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">account_id<\/span>   <span class=\"p\">=<\/span> <span class=\"s2\">\"terraform\"<\/span>\r\n  <span class=\"nx\">display_name<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"Terraform IaC Account\"<\/span>\r\n  <span class=\"nx\">project<\/span>      <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">project_id<\/span>\r\n\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_project<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\"># Terraform \u3078\u30db\u30b9\u30c8\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u306e\u95b2\u89a7\u30ed\u30fc\u30eb\u3092\u4ed8\u4e0e<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"google_project_iam_binding\"<\/span> <span class=\"s2\">\"storage_serviceusage\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">project<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">project_id<\/span>\r\n  <span class=\"nx\">for_each<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">toset<\/span><span class=\"err\">(<\/span><span class=\"p\">[<\/span>\r\n    <span class=\"s2\">\"roles\/storage.admin\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"roles\/serviceusage.serviceUsageAdmin\"<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n\r\n  <span class=\"nx\">role<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">each<\/span><span class=\"err\">.<\/span><span class=\"nx\">value<\/span>\r\n\r\n  <span class=\"nx\">members<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\":\"<\/span><span class=\"p\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"serviceAccount\"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">google_service_account<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">email<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\":\"<\/span><span class=\"p\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"group\"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">admin_user_group<\/span><span class=\"err\">.<\/span><span class=\"nx\">email<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_service_account<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\"># Terraform \u3078\u30db\u30b9\u30c8\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u306e\u95b2\u89a7\u30ed\u30fc\u30eb\u3092\u4ed8\u4e0e<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"google_project_iam_binding\"<\/span> <span class=\"s2\">\"viewer\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">project<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">project_id<\/span>\r\n  <span class=\"nx\">for_each<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">toset<\/span><span class=\"err\">(<\/span><span class=\"p\">[<\/span>\r\n    <span class=\"s2\">\"roles\/viewer\"<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n\r\n  <span class=\"nx\">role<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">each<\/span><span class=\"err\">.<\/span><span class=\"nx\">value<\/span>\r\n\r\n  <span class=\"nx\">members<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\":\"<\/span><span class=\"p\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"serviceAccount\"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">google_service_account<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">email<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_service_account<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\"># Terraform \u3078\u30db\u30b9\u30c8\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u306e\u7de8\u96c6\u30ed\u30fc\u30eb\u3092\u4ed8\u4e0e<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"google_project_iam_binding\"<\/span> <span class=\"s2\">\"editor\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">project<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">project_id<\/span>\r\n  <span class=\"nx\">for_each<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">toset<\/span><span class=\"err\">(<\/span><span class=\"p\">[<\/span>\r\n    <span class=\"s2\">\"roles\/editor\"<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n\r\n  <span class=\"nx\">role<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">each<\/span><span class=\"err\">.<\/span><span class=\"nx\">value<\/span>\r\n\r\n  <span class=\"nx\">members<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\":\"<\/span><span class=\"p\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"group\"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">admin_user_group<\/span><span class=\"err\">.<\/span><span class=\"nx\">email<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_service_account<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\"># Terraform \u3078\u7d44\u7e54\u5185\u306e\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u4f5c\u6210\u6a29\u9650\u3092\u4ed8\u4e0e<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"google_organization_iam_binding\"<\/span> <span class=\"s2\">\"terraform\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">org_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">org_id<\/span>\r\n  <span class=\"nx\">for_each<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">toset<\/span><span class=\"err\">(<\/span><span class=\"p\">[<\/span>\r\n    <span class=\"s2\">\"roles\/resourcemanager.projectCreator\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"c1\">#    \"roles\/billing.projectManager\",<\/span>\r\n    <span class=\"s2\">\"roles\/billing.user\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"roles\/compute.xpnAdmin\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"roles\/resourcemanager.projectIamAdmin\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"roles\/resourcemanager.organizationAdmin\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"roles\/orgpolicy.policyAdmin\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"roles\/resourcemanager.folderAdmin\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"roles\/accesscontextmanager.policyAdmin\"<\/span><span class=\"p\">,<\/span> <span class=\"c1\"># VPC SC \u6642\u306b\u5fc5\u8981<\/span>\r\n  <span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n  <span class=\"nx\">role<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">each<\/span><span class=\"err\">.<\/span><span class=\"nx\">value<\/span>\r\n\r\n  <span class=\"nx\">members<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\":\"<\/span><span class=\"p\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"serviceAccount\"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">google_service_account<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">email<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"c1\">#    join(\":\", [\"user\", var.admin_user.email]),<\/span>\r\n    <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\":\"<\/span><span class=\"p\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"group\"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">admin_user_group<\/span><span class=\"err\">.<\/span><span class=\"nx\">email<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n  <span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_project<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">google_service_account<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\"># Terraform \u3078\u8ab2\u91d1\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u5229\u7528\u6a29\u9650\u3092\u4ed8\u4e0e<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"google_billing_account_iam_binding\"<\/span> <span class=\"s2\">\"user\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">billing_account_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">billing_account<\/span>\r\n  <span class=\"nx\">role<\/span>               <span class=\"p\">=<\/span> <span class=\"s2\">\"roles\/billing.user\"<\/span>\r\n  <span class=\"nx\">members<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\":\"<\/span><span class=\"p\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"serviceAccount\"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">google_service_account<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">email<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"c1\">#    join(\":\", [\"user\", var.admin_user.email]),<\/span>\r\n    <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\":\"<\/span><span class=\"p\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"group\"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">admin_user_group<\/span><span class=\"err\">.<\/span><span class=\"nx\">email<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n  <span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_project<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\"># Terraform \u306e\u30b9\u30c6\u30fc\u30c8\u30d5\u30a1\u30a4\u30eb\u7f6e\u304d\u5834\u306e\u4f5c\u6210<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"google_storage_bucket\"<\/span> <span class=\"s2\">\"terraform\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">name<\/span>          <span class=\"p\">=<\/span> <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\"-\"<\/span><span class=\"err\">,<\/span> <span class=\"p\">[<\/span><span class=\"nx\">google_project<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">project_id<\/span><span class=\"p\">,<\/span> <span class=\"s2\">\"terraform-backet\"<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n  <span class=\"nx\">project<\/span>       <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">project_id<\/span>\r\n  <span class=\"nx\">location<\/span>      <span class=\"p\">=<\/span> <span class=\"s2\">\"US\"<\/span>\r\n  <span class=\"nx\">force_destroy<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">true<\/span>\r\n  <span class=\"nx\">storage_class<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"STANDARD\"<\/span>\r\n\r\n  <span class=\"nx\">lifecycle_rule<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">condition<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">num_newer_versions<\/span> <span class=\"p\">=<\/span> <span class=\"mi\">5<\/span>\r\n    <span class=\"p\">}<\/span>\r\n    <span class=\"nx\">action<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">type<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"Delete\"<\/span>\r\n    <span class=\"p\">}<\/span>\r\n  <span class=\"p\">}<\/span>\r\n\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_project<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<\/code><\/pre>\n<p>\u786e\u4fdd\u8f93\u51fa\u4ee5\u4e0b\u5185\u5bb9\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">\u4f5c\u6210\u3057\u305fterraform \u30b5\u30fc\u30d3\u30b9\u30a2\u30ab\u30a6\u30f3\u30c8\u540d<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">backend.tf \u306e\u4f5c\u6210\u30b3\u30de\u30f3\u30c9<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">terraform \u7528\u306e\u30b5\u30fc\u30d3\u30b9\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u30ad\u30fc\u30d5\u30a1\u30a4\u30eb\u4f5c\u6210\u30b3\u30de\u30f3\u30c9\u3001\u79fb\u52d5\u30b3\u30de\u30f3\u30c9<\/ul>\n<pre class=\"post-pre\"><code><span class=\"nx\">output<\/span> <span class=\"s2\">\"A001_Terraform_Service_Account\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">value<\/span>       <span class=\"p\">=<\/span> <span class=\"nx\">google_service_account<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">email<\/span>\r\n  <span class=\"nx\">description<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"Terraform Account\"<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">output<\/span> <span class=\"s2\">\"A002_GCP_BACKEND\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">value<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\"<\/span><span class=\"err\">\\<\/span><span class=\"s2\">n\"<\/span><span class=\"err\">,<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"s2\">\"cat &gt; backend.tf &lt;&lt; EOF\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"terraform {\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"  backend <\/span><span class=\"se\">\\\"<\/span><span class=\"s2\">gcs<\/span><span class=\"se\">\\\"<\/span><span class=\"s2\"> {\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"    bucket = <\/span><span class=\"se\">\\\"<\/span><span class=\"s2\">${google_storage_bucket.terraform.name}<\/span><span class=\"se\">\\\"<\/span><span class=\"s2\">\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"    prefix = <\/span><span class=\"se\">\\\"<\/span><span class=\"s2\">terraform\/state<\/span><span class=\"se\">\\\"<\/span><span class=\"s2\">\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"  }\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"}\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"EOF\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"mv backend.tf ..\/\"<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"nx\">output<\/span> <span class=\"s2\">\"A003_Next_Commands\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">value<\/span>       <span class=\"p\">=<\/span> <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\"\"<\/span><span class=\"err\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"gcloud iam service-accounts keys create terraform_serviceacoount_credential.json --iam-account \"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">google_service_account<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">.<\/span><span class=\"nx\">email<\/span><span class=\"p\">,<\/span> <span class=\"s2\">\";cp terraform_serviceacoount_credential.json ..\/;cd ..\/\"<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n  <span class=\"nx\">description<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"Next\"<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h4>\u6267\u884c<\/h4>\n<p>\u8bf7\u4f7f\u7528\u4e0b\u8ff0\u547d\u4ee4\u5728 prestage \u73af\u5883\u4e2d\u6267\u884c Terraform\u3002<\/p>\n<pre class=\"post-pre\"><code>cd prestage\r\nterraform workspace new dev\r\nterraform apply\r\n<\/code><\/pre>\n<p>\u6839\u636e\u4e0a\u8ff0\u6267\u884c\u540e\u7684\u8f93\u51fa\u4fe1\u606f\uff0c\u521b\u5efabackend.tf\u6587\u4ef6\u548cterraform\u7684\u51ed\u8bc1JSON\u6587\u4ef6\u3002<\/p>\n<p>\u4ee5\u4e0a\u7684\u8a71\uff0c\u53ef\u4ee5\u8aaa\u5728\u57f7\u884c Terraform \u524d\u7684\u6e96\u5099\u5de5\u4f5c\u5df2\u7d93\u5b8c\u6210\u4e86\uff08\u5373\u624b\u52d5\u8a2d\u5b9a\uff0c\u53c3\u8003 Terraterm \u57f7\u884c\u6b65\u9a5f\uff09\u3002<\/p>\n<h3>3. \u7ec4\u7ec7\u7684\u8bbe\u5b9a (organaization.tf)<\/h3>\n<p>\u5728\u8fd9\u91cc\uff0c\u6211\u4eec\u53ef\u4ee5\u8fdb\u884c\u6574\u4f53\u8bbe\u7f6e\u3001\u7ed9\u4e88\u7528\u6237\u7ec4\u6743\u9650\uff0c\u8fd8\u53ef\u4ee5\u521b\u5efa\u7b2c\u4e00\u5c42\u6587\u4ef6\u5939\u3002<\/p>\n<div><img decoding=\"async\" class=\"post-images\" title=\"\" src=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d8742913a08637a6bf572\/53-0.png\" alt=\"\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8 2021-03-21 23.42.29.png\" \/><\/div>\n<p>\u7531\u4e8e\u4ee5\u524d\u7684\u7ec4\u7ec7\u548c\u5171\u4eabVPC\u7684\u624b\u52a8\u521b\u5efa\u4e2d\uff0c\u6ca1\u6709\u8fdb\u884c\u4ee5\u4e0b\u7ba1\u7406\u7528\u6237\u7ec4\u3001\u7ec4\u7ec7\u7b56\u7565\u548c\u6587\u4ef6\u5939\u7ba1\u7406\uff0c\u56e0\u6b64\u5728\u8fd9\u91cc\u8bb0\u5f55\u4e0b\u5176\u5185\u5bb9\u3002<\/p>\n<h4>\u7ba1\u7406\u7528\u6237\u7ec4<\/h4>\n<p>\u7ba1\u7406\u7684\u7fa4\u7d44\u53c3\u8003\u4f01\u696d\u5c08\u7528\u6307\u5357<br \/>\n\u7531\u65bc\u6211\u53ea\u9700\u8981\u81ea\u5df1\u5275\u5efa\u4e26\u9032\u884c\u6e2c\u8a66\uff0c\u56e0\u6b64\u6b64\u6b21\u53ea\u9700\u9078\u53d6\u90e8\u5206\u4e26\u5728\u5169\u500b\u7fa4\u7d44\u4e2d\u9032\u884c\u8a2d\u7f6e\uff08\u670d\u52d9\u5c08\u6848\u5c07\u5728\u53e6\u4e00\u500b\u7fa4\u7d44\u4e2d\u5275\u5efa\uff09<br \/>\nCloudIdentity \u7684\u8a2d\u5b9a\u4e26\u672a\u7d0d\u5165\u6b64\u6b21\u7684 Terraform \u5c0d\u8c61\uff0c\u56e0\u6b64\u9700\u8981\u4e8b\u5148\u5275\u5efa\u7fa4\u7d44\u3002<\/p>\n<div>\n<div class=\"post-table\">\u30b0\u30eb\u30fc\u30d7\u5185\u5bb9gcp-organization-admins\u7d44\u7e54\u306e\u8a2d\u5b9a\u3092\u7ba1\u7406\u3059\u308bgcp-network-admins\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3092\u7ba1\u7406\u3059\u308b\u3002\u5171\u6709 VPC \u306a\u3069\u7ba1\u7406\u3059\u308b<\/div>\n<\/div>\n<p>\u7531\u4e8e\u9700\u8981\u5bf9Terraform\u670d\u52a1\u8d26\u6237\u8fdb\u884c\u76f8\u540c\u7684\u64cd\u4f5c\uff0c\u56e0\u6b64\u9700\u8981\u6388\u4e88\u76f8\u540c\u7684\u6743\u9650\u3002<\/p>\n<p>\u6b64\u5916\uff0c\u6211\u4eec\u4e5f\u7ed9\u4e88\u4e86\u7ec4\u7ec7\u548c\u6587\u4ef6\u5939\u7684\u6d4f\u89c8\u6743\u9650\u4e8e\u6574\u4e2a\u57df\u4e2d\uff08\u5305\u62ec\u6587\u4ef6\u5939\u67b6\u6784\uff0c\u4f7f\u5f97\u57df\u7528\u6237\u90fd\u53ef\u4ee5\u770b\u5230\uff09\u3002<\/p>\n<h4>\u7ec4\u7ec7\u653f\u7b56<\/h4>\n<p>\u4ee5\u524d\u7684\u6642\u5019\u4e26\u672a\u8a2d\u5b9a\uff0c\u7136\u800c\u5728\u5275\u5efa\u670d\u52d9\u5c08\u6848\u7b49\u7b49\u6642\uff0c\u70ba\u4e86\u4e0d\u9810\u8a2d\u5275\u5efa\u9664\u4e86\u5171\u4eab VPC \u4ee5\u5916\u7684\u7db2\u8def\uff0c\u8a2d\u5b9a\u4e00\u500b\u4e0d\u5728\u9805\u76ee\u5275\u5efa\u6642\u9810\u8a2d\u5275\u5efa\u7db2\u8def\u7684\u7b56\u7565\u3002<\/p>\n<p>\u542f\u7528compute.skipDefaultNetworkCreation\uff08\u4ee5\u4e0b\u662f\u5728Web\u63a7\u5236\u53f0\u4e0a\u67e5\u770b\u7684\u76f8\u5173\u7b56\u7565\uff09\u3002<\/p>\n<div><img decoding=\"async\" class=\"post-images\" title=\"\" src=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d8742913a08637a6bf572\/63-0.png\" alt=\"\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8 2021-03-21 23.36.58.png\" \/><\/div>\n<h4>\u6587\u4ef6\u5939<\/h4>\n<p>\u5728\u4e2d\u6587\u4e2d\uff0c\u4e3a\u8d1f\u8d23\u4e3b\u673a\u9879\u76ee\u7684\u90e8\u95e8\u521b\u5efa\u4e00\u4e2a\u540d\u4e3a&#8221;\u57fa\u7840\u8bbe\u65bd&#8221;\u7684\u6587\u4ef6\u5939\uff0c\u4e3a\u8d1f\u8d23\u670d\u52a1\u9879\u76ee\u7684\u90e8\u95e8\u521b\u5efa\u4e00\u4e2a\u540d\u4e3a&#8221;\u670d\u52a1&#8221;\u7684\u6587\u4ef6\u5939\u3002<\/p>\n<h4>\u7ec4\u7ec7\u3002<\/h4>\n<p>\u53d8\u91cf\u4f7f\u7528\u4ee5\u4e0b\u5185\u5bb9<br \/>\n* \u4e3a\u4e86\u65b9\u4fbf\u540e\u7eed\u6dfb\u52a0\uff0c\u5c06\u7c7b\u578b\u8bbe\u7f6e\u4e3aobject\uff0c\u4f46\u8fd9\u6837\u884c\u6570\u589e\u52a0\u4e86&#8230;<br \/>\n\u5728xxx\u5904\u6dfb\u52a0\u63a9\u7801\uff0c\u7c7b\u4f3c\u4e8e2.\u901a\u8fc7terraform\u7ba1\u7406\u9879\u76ee\u7684\u521b\u5efa\uff08prestage\/\uff09\uff0c\u586b\u5199\u4e0e\u5b9e\u65bd\u73af\u5883\u76f8\u5339\u914d\u7684\u5185\u5bb9<br \/>\nterraform-service-accounts\u653e\u7f6e\u4e862.\u901a\u8fc7terraform\u7ba1\u7406\u9879\u76ee\u7684\u521b\u5efa\uff08prestage\/\uff09\u6700\u540e\u8f93\u51fa\u7684\u8d26\u6237<br \/>\n\u5728\u521b\u5efa\u8d44\u6e90\u65f6\uff0c\u586b\u5199\u9ed8\u8ba4\u4f7f\u7528\u7684\u533a\u57df\/\u533a\u57df\uff08\u8fd9\u91cc\u8bbe\u7f6e\u4e3aus-west1\uff0c\u4ee5\u4fbf\u66f4\u5bb9\u6613\u9002\u7528\u514d\u8d39\u8d44\u6e90\u914d\u989d\uff09<\/p>\n<pre class=\"post-pre\"><code><span class=\"k\">variable<\/span> <span class=\"s2\">\"gcp_common\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">type<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">object<\/span><span class=\"p\">({<\/span>\r\n    <span class=\"nx\">org_name<\/span>        <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n    <span class=\"nx\">org_id<\/span>          <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n    <span class=\"nx\">billing_account<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n    <span class=\"nx\">region<\/span>          <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n    <span class=\"nx\">zone<\/span>            <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n  <span class=\"p\">})<\/span>\r\n  <span class=\"nx\">default<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">org_name<\/span>        <span class=\"p\">=<\/span> <span class=\"s2\">\"xxxxxx\"<\/span>\r\n    <span class=\"nx\">org_id<\/span>          <span class=\"p\">=<\/span> <span class=\"s2\">\"xxxxxxxxxxxx\"<\/span>\r\n    <span class=\"nx\">billing_account<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"xxxxxx-xxxxxx-xxxxxx\"<\/span>\r\n    <span class=\"nx\">region<\/span>          <span class=\"p\">=<\/span> <span class=\"s2\">\"us-west1\"<\/span>\r\n    <span class=\"nx\">zone<\/span>            <span class=\"p\">=<\/span> <span class=\"s2\">\"us-west1-b\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n\r\n  <span class=\"nx\">validation<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">condition<\/span>     <span class=\"p\">=<\/span> <span class=\"p\">(<\/span><span class=\"nx\">length<\/span><span class=\"p\">(<\/span><span class=\"nx\">regexall<\/span><span class=\"p\">(<\/span><span class=\"kd\">var<\/span><span class=\"p\">.<\/span><span class=\"nx\">gcp_common<\/span><span class=\"p\">.<\/span><span class=\"nx\">region<\/span><span class=\"p\">,<\/span> <span class=\"kd\">var<\/span><span class=\"p\">.<\/span><span class=\"nx\">gcp_common<\/span><span class=\"p\">.<\/span><span class=\"nx\">zone<\/span><span class=\"p\">))<\/span> <span class=\"err\">&gt;<\/span> <span class=\"mi\">0<\/span><span class=\"p\">)<\/span>\r\n    <span class=\"nx\">error_message<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"Zone must be in region.\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">variable<\/span> <span class=\"s2\">\"terraform-service-accounts\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">type<\/span>    <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n  <span class=\"nx\">default<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"terraform@[terraform\u7ba1\u7406\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u540d].iam.gserviceaccount.com\"<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">variable<\/span> <span class=\"s2\">\"organization_admin_group\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">type<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">object<\/span><span class=\"p\">({<\/span>\r\n    <span class=\"nx\">email<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n  <span class=\"p\">})<\/span>\r\n  <span class=\"nx\">default<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">email<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"gcp-organization-admin@[xxx.xxx:\u30c9\u30e1\u30a4\u30f3\u540d]\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">variable<\/span> <span class=\"s2\">\"network_admin_group\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">type<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">object<\/span><span class=\"p\">({<\/span>\r\n    <span class=\"nx\">email<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n  <span class=\"p\">})<\/span>\r\n  <span class=\"nx\">default<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">email<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"gcp-network-admin@[xxx.xxx:\u30c9\u30e1\u30a4\u30f3\u540d]\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">variable<\/span> <span class=\"s2\">\"domain\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">type<\/span>    <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n  <span class=\"nx\">default<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"[xxx.xxx:\u30c9\u30e1\u30a4\u30f3\u540d]\"<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<p>\u4e3b\u8981\u4ee3\u7801\u5982\u4e0b\u6240\u793a\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c1\">## \u7d44\u7e54\u30dd\u30ea\u30b7\u30fc<\/span>\r\n<span class=\"c1\">### \u30c7\u30d5\u30a9\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u4f5c\u6210\u306e\u7121\u52b9\u5316<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"google_organization_policy\"<\/span> <span class=\"s2\">\"skipDefaultNetworkCreation\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">org_id<\/span>     <span class=\"p\">=<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">gcp_common<\/span><span class=\"err\">.<\/span><span class=\"nx\">org_id<\/span>\r\n  <span class=\"nx\">constraint<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"compute.skipDefaultNetworkCreation\"<\/span>\r\n\r\n  <span class=\"nx\">boolean_policy<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">enforced<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">true<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\"># \u30c9\u30e1\u30a4\u30f3\u30e6\u30fc\u30b6\u306b\u7d44\u7e54\u30fb\u30d5\u30a9\u30eb\u30c0\u69cb\u6210\u306e\u95b2\u89a7\u6a29\u9650\u4ed8\u4e0e<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"google_organization_iam_binding\"<\/span> <span class=\"s2\">\"organization_domain_viewer\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">org_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">gcp_common<\/span><span class=\"err\">.<\/span><span class=\"nx\">org_id<\/span>\r\n  <span class=\"nx\">for_each<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">toset<\/span><span class=\"err\">(<\/span><span class=\"p\">[<\/span>\r\n    <span class=\"s2\">\"roles\/resourcemanager.organizationViewer\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"roles\/resourcemanager.folderViewer\"<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n  <span class=\"nx\">role<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">each<\/span><span class=\"err\">.<\/span><span class=\"nx\">value<\/span>\r\n\r\n  <span class=\"nx\">members<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\":\"<\/span><span class=\"p\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"domain\"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">domain<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\"># \u7d44\u7e54\u7ba1\u7406\u8005\u3078\u306e\u7ba1\u7406\u6a29\u9650\u4ed8\u4e0e<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"google_organization_iam_binding\"<\/span> <span class=\"s2\">\"organization_org_admin\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">org_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">gcp_common<\/span><span class=\"err\">.<\/span><span class=\"nx\">org_id<\/span>\r\n  <span class=\"nx\">for_each<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">toset<\/span><span class=\"err\">(<\/span><span class=\"p\">[<\/span>\r\n    <span class=\"s2\">\"roles\/resourcemanager.organizationAdmin\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"roles\/billing.admin\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"roles\/resourcemanager.folderAdmin\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"roles\/resourcemanager.projectCreator\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"roles\/iam.organizationRoleAdmin\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"roles\/orgpolicy.policyAdmin\"<\/span><span class=\"p\">,<\/span>            <span class=\"c1\"># \u7d44\u7e54\u30dd\u30ea\u30b7\u30fc\u7ba1\u7406\u8005<\/span>\r\n    <span class=\"s2\">\"roles\/accesscontextmanager.policyAdmin\"<\/span><span class=\"p\">,<\/span> <span class=\"c1\"># VPC SC \u6642\u306b\u5fc5\u8981<\/span>\r\n  <span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n  <span class=\"nx\">role<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">each<\/span><span class=\"err\">.<\/span><span class=\"nx\">value<\/span>\r\n\r\n  <span class=\"nx\">members<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\":\"<\/span><span class=\"p\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"group\"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">organization_admin_group<\/span><span class=\"err\">.<\/span><span class=\"nx\">email<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\":\"<\/span><span class=\"p\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"serviceAccount\"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">-<\/span><span class=\"nx\">service<\/span><span class=\"err\">-<\/span><span class=\"nx\">accounts<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n\r\n  <span class=\"c1\"># \u524a\u9664\u3059\u308b\u3068\u7ba1\u7406\u8005\u304c\u524a\u9664\u3055\u308c\u3066\u3057\u307e\u3046\u306e\u3067\u5076\u767a\u7684\u306a\u7834\u58ca\u3092\u9632\u3050<\/span>\r\n  <span class=\"c1\"># \u5168\u4f53\u3092\u524a\u9664\u3059\u308b\u5834\u5408\u306f\u3001\u7ba1\u7406\u7cfb\u3092\u624b\u52d5\u3067\u9003\u3057\u3066\u3042\u3052\u308b\u5fc5\u8981\u304c\u3042\u308b<\/span>\r\n  <span class=\"nx\">lifecycle<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">prevent_destroy<\/span> <span class=\"p\">=<\/span> <span class=\"kc\">true<\/span>\r\n    <span class=\"c1\"># ignore_changes = all<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\"># \u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u7ba1\u7406\u8005\u3078\u306e\u5171\u6709VPC\u7b49\u306e\u6a29\u9650\u4ed8\u4e0e<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"google_organization_iam_binding\"<\/span> <span class=\"s2\">\"organization_network_admin\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">org_id<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">gcp_common<\/span><span class=\"err\">.<\/span><span class=\"nx\">org_id<\/span>\r\n  <span class=\"nx\">for_each<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">toset<\/span><span class=\"err\">(<\/span><span class=\"p\">[<\/span>\r\n    <span class=\"s2\">\"roles\/compute.networkAdmin\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"roles\/compute.xpnAdmin\"<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"s2\">\"roles\/compute.securityAdmin\"<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n  <span class=\"nx\">role<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">each<\/span><span class=\"err\">.<\/span><span class=\"nx\">value<\/span>\r\n\r\n  <span class=\"nx\">members<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\":\"<\/span><span class=\"p\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"group\"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">network_admin_group<\/span><span class=\"err\">.<\/span><span class=\"nx\">email<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\":\"<\/span><span class=\"p\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"serviceAccount\"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">terraform<\/span><span class=\"err\">-<\/span><span class=\"nx\">service<\/span><span class=\"err\">-<\/span><span class=\"nx\">accounts<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\"># \u30a4\u30f3\u30d5\u30e9\u5411\u3051\u30d5\u30a9\u30eb\u30c0<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"google_folder\"<\/span> <span class=\"s2\">\"organization_infrastructure_folder\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">display_name<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"infrastructure\"<\/span>\r\n  <span class=\"nx\">parent<\/span>       <span class=\"p\">=<\/span> <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\"\/\"<\/span><span class=\"err\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"organizations\"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">gcp_common<\/span><span class=\"err\">.<\/span><span class=\"nx\">org_id<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_organization_policy<\/span><span class=\"err\">.<\/span><span class=\"nx\">skipDefaultNetworkCreation<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\"># \u30b5\u30fc\u30d3\u30b9\u5411\u3051\u30d5\u30a9\u30eb\u30c0<\/span>\r\n<span class=\"nx\">resource<\/span> <span class=\"s2\">\"google_folder\"<\/span> <span class=\"s2\">\"organization_service_folder\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">display_name<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"service\"<\/span>\r\n  <span class=\"nx\">parent<\/span>       <span class=\"p\">=<\/span> <span class=\"nx\">join<\/span><span class=\"err\">(<\/span><span class=\"s2\">\"\/\"<\/span><span class=\"err\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"organizations\"<\/span><span class=\"p\">,<\/span> <span class=\"nx\">var<\/span><span class=\"err\">.<\/span><span class=\"nx\">gcp_common<\/span><span class=\"err\">.<\/span><span class=\"nx\">org_id<\/span><span class=\"p\">]<\/span><span class=\"err\">)<\/span>\r\n\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_organization_policy<\/span><span class=\"err\">.<\/span><span class=\"nx\">skipDefaultNetworkCreation<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<\/code><\/pre>\n<p>\u7531\u4e8e\u4ee3\u7801\u8fc7\u957f\uff0c\u7f16\u5199\u6240\u6709\u4ee3\u7801\u4f1a\u663e\u5f97\u5197\u957f\u3002\u56e0\u6b64\uff0c\u8bf7\u53ea\u5217\u51fa\u7279\u522b\u6307\u5b9a\u7684\u4ee3\u7801\uff0c\u5e76\u5728\u5176\u4ed6\u5730\u65b9\u53c2\u8003GitHub\uff08\u6bcf\u4e2a\u7ae0\u8282\u63d0\u4f9b\u4ee3\u7801\u53c2\u8003\u94fe\u63a5\uff09\u3002<\/p>\n<h3>4. \u521b\u5efa\u4e3b\u673a\u9879\u76ee\uff08host.tf\uff09<\/h3>\n<p>\u6b63\u5728\u521b\u5efa\u4e3b\u673a\u9879\u76ee\u548c\u8fdb\u884cAPI\u548cIAM\u8bbe\u7f6e\u3002<br \/>\n\u5c06\u4e3b\u673a\u9879\u76ee\u7684\u7ba1\u7406\u7ec4\u5730\u5740\u653e\u5165variables.tf\u6587\u4ef6\u7684host_project_admin_group\u7684\u7535\u5b50\u90ae\u4ef6\u5b57\u6bb5\u4e2d\u3002<br \/>\n\u4f7f\u7528google_compute_shared_vpc_host_project\u6765\u542f\u7528\u5171\u4eabVPC\u7684\u4e3b\u673a\u529f\u80fd\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"k\">resource<\/span> <span class=\"s2\">\"google_compute_shared_vpc_host_project\"<\/span> <span class=\"s2\">\"host\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">project<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">host_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">host_project<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">google_project_service<\/span><span class=\"p\">.<\/span><span class=\"nx\">host_api_enable<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h3>5. \u521b\u5efa\u670d\u52a1\u9879\u76ee\uff08service1.tf\uff09<\/h3>\n<p>\u521b\u5efa\u670d\u52a1\u9879\u76ee\u3001\u8fdb\u884cAPI\u548cIAM\u8bbe\u7f6e<br \/>\n\u5c06service1_project_admin_group\u7684email\u5730\u5740\u8bbe\u7f6e\u4e3a\u670d\u52a1\u9879\u76ee\u7ba1\u7406\u7ec4\u7684\u5730\u5740<br \/>\n\u4f7f\u7528google_compute_shared_vpc_service_project\u5c06\u670d\u52a1\u9879\u76ee\u8fde\u63a5\u5230host_project<br \/>\n\u6b64\u5916\uff0c\u8fd8\u521b\u5efa\u4e86\u4e24\u4e2a\u670d\u52a1\u8d26\u53f7\uff0c\u4e00\u4e2a\u7528\u4e8e\u516c\u5171\u7528\u9014\uff0c\u4e00\u4e2a\u7528\u4e8e\u79c1\u6709\u7528\u9014\uff0c\u4f8b\u5982GCE<br \/>\n\u8fd9\u6837\u505a\u662f\u4e3a\u4e86\u5728\u9632\u706b\u5899\u4e2d\u8fdb\u884c\u533a\u5206<\/p>\n<pre class=\"post-pre\"><code><span class=\"c1\"># \u30b5\u30fc\u30d3\u30b9\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u8a2d\u5b9a<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"google_compute_shared_vpc_service_project\"<\/span> <span class=\"s2\">\"service1\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">host_project<\/span>    <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">host_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n  <span class=\"nx\">service_project<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_project_service<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1_api_enable<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">google_compute_shared_vpc_host_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">host<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"c1\"># \u30b5\u30fc\u30d3\u30b9\u30a2\u30ab\u30a6\u30f3\u30c8<\/span>\r\n<span class=\"c1\">## Public \u5411\u3051<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"google_service_account\"<\/span> <span class=\"s2\">\"service1_public_account\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">account_id<\/span>   <span class=\"p\">=<\/span> <span class=\"s2\">\"service1-public-account-id\"<\/span>\r\n  <span class=\"nx\">display_name<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"Service1 Public Account\"<\/span>\r\n  <span class=\"nx\">project<\/span>      <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n<span class=\"p\">}<\/span>\r\n<span class=\"c1\">## Private \u5411\u3051<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"google_service_account\"<\/span> <span class=\"s2\">\"service1_private_account\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">account_id<\/span>   <span class=\"p\">=<\/span> <span class=\"s2\">\"service1-private-account-id\"<\/span>\r\n  <span class=\"nx\">display_name<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"Service1 Private Account\"<\/span>\r\n  <span class=\"nx\">project<\/span>      <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h3>6. \u521b\u5efa\u5b50\u7f51 (subnet.tf)<\/h3>\n<p>\u4f7f\u7528 `google_compute_subnetwork` \u547d\u4ee4\u6765\u521b\u5efa\u5b50\u7f51\u3002<br \/>\n\u5c06\u5730\u5740\u8bbe\u7f6e\u4e3a\u793a\u4f8b\u4e2d\u7684172.18.0.0\/24\uff08\u53ef\u4ee5\u6839\u636e\u8fd0\u7ef4\u9700\u6c42\u5c06\u5176\u914d\u7f6e\u5230 variables.tf \u6216 tfvars \u6587\u4ef6\u4e2d\uff09\u3002<\/p>\n<p>\u4e3a\u4e86\u5728\u670d\u52a1\u9879\u76ee\u4e2d\u53ef\u4ee5\u4f7f\u7528\u5171\u4eab VPC \u7684\u5b50\u7f51\uff0c\u4f7f\u7528 google_compute_subnetwork_iam_binding \u4e3a\u670d\u52a1\u9879\u76ee\u7528\u6237\u7ec4\u6388\u4e88\u7f51\u7edc\u7528\u6237\u6743\u9650<br \/>\n\u203b\u867d\u7136\u4e5f\u53ef\u4ee5\u5728\u4e3b\u673a\u9879\u76ee\u4e2d\u6388\u4e88\u6574\u4e2a\u5b50\u7f51\u7684\u6743\u9650\uff0c\u4f46\u5728\u8fd9\u91cc\u9009\u62e9\u4e86\u6309\u5b50\u7f51\u8fdb\u884c\u6743\u9650\u7ba1\u7406\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"k\">resource<\/span> <span class=\"s2\">\"google_compute_subnetwork_iam_binding\"<\/span> <span class=\"s2\">\"service1-gce-subnets\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">project<\/span>    <span class=\"p\">=<\/span> <span class=\"nx\">google_compute_subnetwork<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1<\/span><span class=\"err\">-<\/span><span class=\"nx\">gce<\/span><span class=\"err\">-<\/span><span class=\"nx\">subnets<\/span><span class=\"p\">.<\/span><span class=\"nx\">project<\/span>\r\n  <span class=\"nx\">region<\/span>     <span class=\"p\">=<\/span> <span class=\"nx\">google_compute_subnetwork<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1<\/span><span class=\"err\">-<\/span><span class=\"nx\">gce<\/span><span class=\"err\">-<\/span><span class=\"nx\">subnets<\/span><span class=\"p\">.<\/span><span class=\"nx\">region<\/span>\r\n  <span class=\"nx\">subnetwork<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">google_compute_subnetwork<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1<\/span><span class=\"err\">-<\/span><span class=\"nx\">gce<\/span><span class=\"err\">-<\/span><span class=\"nx\">subnets<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n  <span class=\"nx\">role<\/span>       <span class=\"p\">=<\/span> <span class=\"s2\">\"roles\/compute.networkUser\"<\/span>\r\n  <span class=\"nx\">members<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">join<\/span><span class=\"p\">(<\/span><span class=\"s2\">\":\"<\/span><span class=\"p\">,<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"group\"<\/span><span class=\"p\">,<\/span> <span class=\"kd\">var<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1_project_admin_group<\/span><span class=\"p\">.<\/span><span class=\"nx\">email<\/span><span class=\"p\">]),<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h3>7. \u9632\u706b\u5899\u7684\u8bbe\u5b9a (firewall.tf) de<\/h3>\n<p>\u672c\u6b21\u4ee3\u7801\u4e2d\u5305\u542b\u4e86\u4ee5\u4e0b\u4e24\u4e2a\u9632\u706b\u5899\u89c4\u5219\uff0c\u7528\u4ee5\u6267\u884c\u9632\u706b\u5899\u914d\u7f6e\u3002<\/p>\n<div>\n<div class=\"post-table\">name\u5185\u5bb9\u9001\u4fe1\u5143\u9001\u4fe1\u5148private-private-001Private\u30a2\u30c9\u30ec\u30b9\u5185\u306e\u30a2\u30af\u30bb\u30b9\u8a31\u53ef.\u3086\u308b\u3044\u8a2d\u5b9a\u306a\u306e\u3067\u74b0\u5883\u306b\u3088\u3063\u3066\u8981\u4fee\u6b63192.168.0.0\/16, 172.16.0.0\/12, 10.0.0.0\/8\u30b5\u30fc\u30d3\u30b91\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u5411\u3051 Private\/Public \u30b5\u30fc\u30d3\u30b9\u30a2\u30ab\u30a6\u30f3\u30c8internet-public-001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u304b\u3089 INGRESS \u3067\u8a31\u53ef\u3059\u308b IP \u8a2d\u5b9a<br \/>\n\u3053\u3053\u3067\u306f\u4f8b\u3068\u3057\u3066\u3001\u5916\u90e8\u30c6\u30b6\u30ea\u30f3\u30b0\u74b0\u5883\u306a\u3069\u3067\u30ed\u30b0\u30a4\u30f3\u3059\u308b\u969b\u306b\u30bd\u30d5\u30c8\u30d0\u30f3\u30af\u643a\u5e2f\u306e\u30a2\u30c9\u30ec\u30b9\u3068\u3057\u3066\u516c\u958b\u3055\u308c\u3066\u3044\u308b<a href=\"https:\/\/www.support.softbankmobile.co.jp\/partner\/home_tech1\/index.cfm\" target=\"_blank\" rel=\"nofollow noopener\">\u30b5\u30a4\u30c8<\/a> <a href=\"https:\/\/www.support.softbankmobile.co.jp\/partner_st\/home_tech1\/ios\/index.cfm\" target=\"_blank\" rel=\"nofollow noopener\">iphone\/ipad\u306f\u3053\u3061\u3089\u3067\u3057\u305f(\u8ffd\u8a18)<\/a> \u304b\u3089\u629c\u7c8b\u3057\u305f\u30a2\u30c9\u30ec\u30b9\u3092\u8a31\u53ef\u3057\u3066\u3044\u308b\u8a31\u53ef\u3059\u308b\u30b0\u30ed\u30fc\u30d0\u30eb\u30a2\u30c9\u30ec\u30b9\u30ea\u30b9\u30c8(<a href=\"https:\/\/www.support.softbankmobile.co.jp\/partner\/home_tech1\/index.cfm\" target=\"_blank\" rel=\"nofollow noopener\">\u53c2\u7167<\/a>) <a href=\"https:\/\/www.support.softbankmobile.co.jp\/partner_st\/home_tech1\/ios\/index.cfm\" target=\"_blank\" rel=\"nofollow noopener\">iphone\/ipad\u306f\u3053\u3061\u3089\u3067\u3057\u305f(\u8ffd\u8a18)<\/a>\u30b5\u30fc\u30d3\u30b91\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u5411\u3051 Public \u30b5\u30fc\u30d3\u30b9\u30a2\u30ab\u30a6\u30f3\u30c8<\/div>\n<\/div>\n<div><img decoding=\"async\" class=\"post-images\" title=\"\" src=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d8742913a08637a6bf572\/89-0.png\" alt=\"\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8 2021-03-22 0.15.40.png\" \/><\/div>\n<pre class=\"post-pre\"><code><span class=\"k\">resource<\/span> <span class=\"s2\">\"google_compute_firewall\"<\/span> <span class=\"s2\">\"private-permit\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">name<\/span>        <span class=\"p\">=<\/span> <span class=\"s2\">\"private-private-001\"<\/span>\r\n  <span class=\"nx\">description<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"Private Subnet Permit\"<\/span>\r\n  <span class=\"nx\">network<\/span>     <span class=\"p\">=<\/span> <span class=\"nx\">google_compute_network<\/span><span class=\"p\">.<\/span><span class=\"nx\">host_sharedvpc<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n  <span class=\"nx\">priority<\/span>    <span class=\"p\">=<\/span> <span class=\"mi\">1000<\/span>\r\n  <span class=\"nx\">direction<\/span>   <span class=\"p\">=<\/span> <span class=\"s2\">\"INGRESS\"<\/span>\r\n  <span class=\"nx\">project<\/span>     <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">host_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n\r\n  <span class=\"nx\">source_ranges<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"192.168.0.0\/16\"<\/span><span class=\"p\">,<\/span> <span class=\"s2\">\"172.16.0.0\/12\"<\/span><span class=\"p\">,<\/span> <span class=\"s2\">\"10.0.0.0\/8\"<\/span><span class=\"p\">]<\/span>\r\n  <span class=\"nx\">target_service_accounts<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_service_account<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1_public_account<\/span><span class=\"p\">.<\/span><span class=\"nx\">email<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">google_service_account<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1_private_account<\/span><span class=\"p\">.<\/span><span class=\"nx\">email<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n\r\n\r\n  <span class=\"nx\">allow<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">protocol<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"icmp\"<\/span>\r\n  <span class=\"p\">}<\/span>\r\n\r\n  <span class=\"nx\">allow<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">protocol<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"tcp\"<\/span>\r\n    <span class=\"nx\">ports<\/span>    <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"22\"<\/span><span class=\"p\">]<\/span>\r\n  <span class=\"p\">}<\/span>\r\n\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_compute_network<\/span><span class=\"p\">.<\/span><span class=\"nx\">host_sharedvpc<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">google_project_service<\/span><span class=\"p\">.<\/span><span class=\"nx\">host_api_enable<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">google_service_account<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1_public_account<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">google_service_account<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1_private_account<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"google_compute_firewall\"<\/span> <span class=\"s2\">\"softbank-mobile\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">name<\/span>        <span class=\"p\">=<\/span> <span class=\"s2\">\"internet-public-001\"<\/span>\r\n  <span class=\"nx\">description<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"Softbank Moible Global Address Permit\"<\/span>\r\n  <span class=\"nx\">network<\/span>     <span class=\"p\">=<\/span> <span class=\"nx\">google_compute_network<\/span><span class=\"p\">.<\/span><span class=\"nx\">host_sharedvpc<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n  <span class=\"nx\">priority<\/span>    <span class=\"p\">=<\/span> <span class=\"mi\">1000<\/span>\r\n  <span class=\"nx\">direction<\/span>   <span class=\"p\">=<\/span> <span class=\"s2\">\"INGRESS\"<\/span>\r\n  <span class=\"nx\">project<\/span>     <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">host_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n  <span class=\"c1\"># https:\/\/www.support.softbankmobile.co.jp\/partner\/home_tech1\/index.cfm<\/span>\r\n  <span class=\"c1\"># 2021.03.20 \u6642\u70b9<\/span>\r\n  <span class=\"nx\">source_ranges<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"s2\">\"123.108.237.128\/28\"<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"c1\">#...(\u7701\u7565)...<\/span>\r\n  <span class=\"p\">]<\/span>\r\n  <span class=\"nx\">target_service_accounts<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_service_account<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1_public_account<\/span><span class=\"p\">.<\/span><span class=\"nx\">email<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n\r\n  <span class=\"nx\">allow<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">protocol<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"tcp\"<\/span>\r\n    <span class=\"nx\">ports<\/span>    <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"22\"<\/span><span class=\"p\">]<\/span>\r\n  <span class=\"p\">}<\/span>\r\n\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_compute_network<\/span><span class=\"p\">.<\/span><span class=\"nx\">host_sharedvpc<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">google_project_service<\/span><span class=\"p\">.<\/span><span class=\"nx\">host_api_enable<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">google_service_account<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1_public_account<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">google_service_account<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1_private_account<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h3>8. DNS\u914d\u7f6e\uff08\u4ec5\u9650Google\u8bbf\u95ee\uff09\uff08dns.tf\uff09<\/h3>\n<p>\u4e3a\u9650\u5b9a\u516c\u5f00\u7684Google\u8bbf\u95ee\u8bbe\u7f6eDNS\u3002<br \/>\n\u8bbe\u7f6e\u5185\u5bb9\u57fa\u672c\u4e0a\u9075\u5faa\u6587\u6863\u3002<br \/>\n\u53e6\u5916(\u6587\u6863\u4e2d\u8fd8\u6709\u989d\u5916\u8bf4\u660e)\uff0c\u4e5f\u540c\u65f6\u8fdb\u884c\u4e86\u5bf9gcr.io\u7684\u914d\u7f6e\u3002<br \/>\n\u6b64\u5916\uff0c\u7531\u4e8ecloudbillingAPI\u4e0d\u652f\u6301\u9650\u5236\u8bbf\u95ee\uff0c\u6240\u4ee5\u8fdb\u884c\u4e86\u79c1\u6709\u8bbf\u95ee\u7684\u8bbe\u7f6e\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c1\"># cloudbilling \u3078\u306e\u30a2\u30af\u30bb\u30b9\u304crestricted \u306b\u672a\u5bfe\u5fdc\u306e\u305f\u3081<\/span>\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"google_dns_record_set\"<\/span> <span class=\"s2\">\"googleapis_cname2\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">name<\/span>         <span class=\"p\">=<\/span> <span class=\"s2\">\"cloudbilling.googleapis.com.\"<\/span>\r\n  <span class=\"nx\">managed_zone<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">google_dns_managed_zone<\/span><span class=\"p\">.<\/span><span class=\"nx\">googleapis<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n  <span class=\"nx\">type<\/span>         <span class=\"p\">=<\/span> <span class=\"s2\">\"CNAME\"<\/span>\r\n  <span class=\"nx\">ttl<\/span>          <span class=\"p\">=<\/span> <span class=\"mi\">300<\/span>\r\n  <span class=\"nx\">rrdatas<\/span>      <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"private.googleapis.com.\"<\/span><span class=\"p\">]<\/span>\r\n  <span class=\"nx\">project<\/span>      <span class=\"p\">=<\/span> <span class=\"nx\">google_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">host_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span>\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_dns_managed_zone<\/span><span class=\"p\">.<\/span><span class=\"nx\">googleapis<\/span><span class=\"p\">,<\/span>\r\n    <span class=\"nx\">google_dns_record_set<\/span><span class=\"p\">.<\/span><span class=\"nx\">googleapis_cname<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h3>9. \u521b\u5efaHA VPN\uff08vpn.tf\uff09\u3002<\/h3>\n<p>\u4f7f\u7528\u51e0\u4e4e\u4e0e\u4e0b\u9762\u63cf\u8ff0\u76f8\u540c\u7684\u7ed3\u6784\u548c\u53c2\u6570\u521b\u5efa\uff08\u8be6\u7ec6\u8bf7\u53c2\u89c1\u4e0b\u9762\uff09\u3002<\/p>\n<p>\u8f93\u51fa\uff1a\u901a\u8fc7\u53cd\u6620HA VPN\u7684\u5168\u7403IP\u7b49\u4fe1\u606f\uff0c\u6211\u4eec\u4f7fEdgeRouter\u914d\u7f6e\u793a\u4f8b\u4e0e\u5728\u4e0a\u8ff0qiita\u4e0a\u6240\u5199\u7684\u76f8\u540c\u3002<\/p>\n<p>\u6839\u636e\u73af\u5883\u7684\u4e0d\u540c\uff0c\u66f4\u65b0\u53d8\u91cf\u65f6\u8bf7\u4f7f\u7528\u4ee5\u4e0b\u5185\u5bb9\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"k\">variable<\/span> <span class=\"s2\">\"vpn\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">type<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">object<\/span><span class=\"p\">({<\/span>\r\n    <span class=\"nx\">peer_global_ip_address<\/span>  <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n    <span class=\"nx\">peer_private_ip_address<\/span> <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n    <span class=\"nx\">shared_secret<\/span>           <span class=\"p\">=<\/span> <span class=\"nx\">string<\/span>\r\n    <span class=\"nx\">peer_asn<\/span>                <span class=\"p\">=<\/span> <span class=\"nx\">number<\/span>\r\n    <span class=\"nx\">asn<\/span>                     <span class=\"p\">=<\/span> <span class=\"nx\">number<\/span>\r\n  <span class=\"p\">})<\/span>\r\n  <span class=\"nx\">default<\/span> <span class=\"p\">=<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">peer_global_ip_address<\/span>  <span class=\"p\">=<\/span> <span class=\"s2\">\"\u81ea\u5b85\u30e9\u30dc\u5074\u30b0\u30ed\u30fc\u30d0\u30ebIP\"<\/span>\r\n    <span class=\"nx\">peer_private_ip_address<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"\u81ea\u5b85\u30e9\u30dc\u5074\u30eb\u30fc\u30bf \u30d7\u30e9\u30a4\u30d9\u30fc\u30c8IP\"<\/span>\r\n    <span class=\"nx\">shared_secret<\/span>           <span class=\"p\">=<\/span> <span class=\"s2\">\"\u30b7\u30fc\u30af\u30ec\u30c3\u30c8(\u53f3\u30b3\u30e1\u30f3\u30c8\u3067\u751f\u6210)\"<\/span> <span class=\"c1\"># openssl rand -base64 24<\/span>\r\n    <span class=\"nx\">peer_asn<\/span>                <span class=\"p\">=<\/span> <span class=\"mi\">65001<\/span>\r\n    <span class=\"nx\">asn<\/span>                     <span class=\"p\">=<\/span> <span class=\"mi\">65101<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<h3>10. \u4e92\u8054\u7f51 NAT \u8bbe\u7f6e\uff08cloudnat.tf\uff09<\/h3>\n<p>\u8bbe\u7f6e\u4e86CloudNAT\uff0c\u4f7f\u79c1\u6709IP\u5b9e\u4f8b\u80fd\u591f\u4e0e\u4e92\u8054\u7f51\u8fdb\u884c\u901a\u4fe1\u3002<\/p>\n<h3>11. \u521b\u5efa VPC \u670d\u52a1\u63a7\u5236 (vpc_service_controls.tf)<\/h3>\n<p>\u6211\u5df2\u7ecf\u603b\u7ed3\u4e86\u6709\u5173VPC\u670d\u52a1\u63a7\u5236\u7684\u5185\u5bb9\u3002<\/p>\n<p>\u4f5c\u4e3a\u8bd5\u9a8c\uff0c\u6211\u4eec\u5c06storage.googleapis.com\u6258\u7ba1\u7684\u670d\u52a1\u9879\u76ee\u4fdd\u62a4\u5728\u8fb9\u754c\u4e4b\u5185\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"k\">resource<\/span> <span class=\"s2\">\"google_access_context_manager_access_policy\"<\/span> <span class=\"s2\">\"access-policy\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">parent<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"organizations\/<\/span><span class=\"k\">${<\/span><span class=\"kd\">var<\/span><span class=\"p\">.<\/span><span class=\"nx\">gcp_common<\/span><span class=\"p\">.<\/span><span class=\"nx\">org_id<\/span><span class=\"k\">}<\/span><span class=\"s2\">\"<\/span>\r\n  <span class=\"nx\">title<\/span>  <span class=\"p\">=<\/span> <span class=\"s2\">\"my policy\"<\/span>\r\n\r\n  <span class=\"nx\">depends_on<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n    <span class=\"nx\">google_organization_iam_binding<\/span><span class=\"p\">.<\/span><span class=\"nx\">organization_org_admin<\/span><span class=\"p\">,<\/span>\r\n  <span class=\"p\">]<\/span>\r\n<span class=\"p\">}<\/span>\r\n\r\n<span class=\"k\">resource<\/span> <span class=\"s2\">\"google_access_context_manager_service_perimeters\"<\/span> <span class=\"s2\">\"service-perimeter\"<\/span> <span class=\"p\">{<\/span>\r\n  <span class=\"nx\">parent<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"accessPolicies\/<\/span><span class=\"k\">${<\/span><span class=\"nx\">google_access_context_manager_access_policy<\/span><span class=\"p\">.<\/span><span class=\"nx\">access-policy<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span><span class=\"k\">}<\/span><span class=\"s2\">\"<\/span>\r\n\r\n  <span class=\"nx\">service_perimeters<\/span> <span class=\"p\">{<\/span>\r\n    <span class=\"nx\">name<\/span>           <span class=\"p\">=<\/span> <span class=\"s2\">\"accessPolicies\/<\/span><span class=\"k\">${<\/span><span class=\"nx\">google_access_context_manager_access_policy<\/span><span class=\"p\">.<\/span><span class=\"nx\">access-policy<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span><span class=\"k\">}<\/span><span class=\"s2\">\/servicePerimeters\/Perimeter1\"<\/span>\r\n    <span class=\"nx\">title<\/span>          <span class=\"p\">=<\/span> <span class=\"s2\">\"Service Production Perimeter1\"<\/span>\r\n    <span class=\"nx\">perimeter_type<\/span> <span class=\"p\">=<\/span> <span class=\"s2\">\"PERIMETER_TYPE_REGULAR\"<\/span>\r\n    <span class=\"nx\">status<\/span> <span class=\"p\">{<\/span>\r\n      <span class=\"nx\">restricted_services<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span><span class=\"s2\">\"storage.googleapis.com\"<\/span><span class=\"p\">]<\/span>\r\n      <span class=\"nx\">resources<\/span> <span class=\"p\">=<\/span> <span class=\"p\">[<\/span>\r\n        <span class=\"s2\">\"projects\/<\/span><span class=\"k\">${<\/span><span class=\"nx\">google_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">host_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">number<\/span><span class=\"k\">}<\/span><span class=\"s2\">\"<\/span><span class=\"p\">,<\/span>\r\n        <span class=\"s2\">\"projects\/<\/span><span class=\"k\">${<\/span><span class=\"nx\">google_project<\/span><span class=\"p\">.<\/span><span class=\"nx\">service1<\/span><span class=\"p\">.<\/span><span class=\"nx\">number<\/span><span class=\"k\">}<\/span><span class=\"s2\">\"<\/span><span class=\"p\">,<\/span>\r\n      <span class=\"p\">]<\/span>\r\n    <span class=\"p\">}<\/span>\r\n  <span class=\"p\">}<\/span>\r\n<span class=\"p\">}<\/span>\r\n<\/code><\/pre>\n<p>\u672c\u6b21\u51c6\u5907\u7684\u4ee3\u7801\u8bf4\u660e\u5230\u6b64\u4e3a\u6b62\u3002<\/p>\n<p>\u5982\u679c\u73af\u5883\u662f\u5f00\u53d1\u73af\u5883\uff0c\u5219\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u6267\u884c\u3002<\/p>\n<pre class=\"post-pre\"><code>terraform workspace new dev\r\nterraform apply\r\n<\/code><\/pre>\n<h2>\u6700\u540e<\/h2>\n<p>\u53ef\u4ee5\u4f7f\u7528Terraform\u5c06\u4ee5\u524d\u624b\u52a8\u8fdb\u884c\u7684GCP\u6784\u5efa\u8f6c\u5316\u4e3a\u57fa\u7840\u8bbe\u65bd\u5373\u4ee3\u7801\uff08IaC\uff09\u3002<br \/>\n\u203b\u7531\u4e8e\u65f6\u95f4\u4e0d\u8db3\uff0c\u4e2d\u9014\u8bb0\u5f55\u6709\u4e9b\u51cc\u4e71\uff0c\u7a0d\u540e\u60f3\u8981\u6574\u7406\u4e00\u4e0b&#8230;<\/p>\n<p>\u7531\u4e8eTerraform \u7684\u6587\u6863\u6574\u7406\u5f97\u5f88\u597d\uff0c\u4e14\u63d0\u4f9b\u4e86\u6613\u4e8e\u7406\u89e3\u7684\u793a\u4f8b\uff0c\u6240\u4ee5\u57fa\u672c\u4e0a\u53ea\u9700\u9605\u8bfb\u6587\u6863\u5c31\u80fd\u5927\u81f4\u4e86\u89e3\u5982\u4f55\u4f7f\u7528\u3002<br \/>\n(\u6587\u6863\u63d0\u4f9b\u8005 google \u7684\u90e8\u5206\uff1ahttps:\/\/registry.terraform.io\/providers\/hashicorp\/google\/latest\/docs)<\/p>\n<p>\u5982\u679c\u4e86\u89e3Terraform\u7684\u521d\u5b66\u8005\uff0c\u5e0c\u671b\u53ef\u4ee5\u4e86\u89e3\u826f\u597d\u7684\u7f16\u5199\u65b9\u6cd5\u548c\u826f\u597d\u7684\u76ee\u5f55\u7ed3\u6784\uff0c\u7136\u540e\u8fdb\u884c\u4fee\u6b63\u3002<\/p>\n<p>\u7531\u4e8eGoogle Cloud\u63d0\u4f9b\u4e86Terraform\u6a21\u5757\uff0c\u6211\u5e0c\u671b\u8003\u8651\u5229\u7528\u5b83\u4eec\u3002[Google Cloud\u7684Terraform\u6a21\u5757\u94fe\u63a5\uff1ahttps:\/\/github.com\/terraform-google-modules] [\u5728Terraform\u5b98\u65b9\u7f51\u7ad9\u4e5f\u6709\u4ecb\u7ecd\uff1ahttps:\/\/registry.terraform.io\/providers\/hashicorp\/google\/latest]<\/p>\n<p>\u4e0b\u9762\u5206\u4eab\u6211\u4e2a\u4eba\u5728\u5b9e\u65bd\u8fc7\u7a0b\u4e2d\u9047\u5230\u7684\u56f0\u96be\u70b9\u3002<\/p>\n<h3>\u8ba9\u60a8\u70e6\u607c\u7684\u5b9e\u8df5\u5efa\u8bae<\/h3>\n<h4>IAM\u72b6\u6001\u7684\u53cd\u6620<\/h4>\n<div><img decoding=\"async\" class=\"post-images\" title=\"\" src=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d8742913a08637a6bf572\/122-0.png\" alt=\"\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8 2021-02-22 22.27.03.png\" \/><\/div>\n<p>\u5728 Terraform \u4e2d\u8bbe\u7f6e\u89d2\u8272\u7684\u914d\u7f6e\u662f\u4e3a\u4e86\u4fdd\u6301\u5177\u6709\u89d2\u8272\u6743\u9650\u7684\u7528\u6237\u7684\u8bb0\u5f55\u72b6\u6001\uff0c\u5982\u679c\u5b58\u5728\u672a\u8bb0\u5f55\u7684\u73b0\u6709\u7528\u6237\u914d\u7f6e\uff0c\u5219\u4f1a\u5c06\u5176\u5220\u9664\u3002<br \/>\n\u56e0\u6b64\uff0c\u4f8b\u5982\uff0c\u5728 Terraform \u4e2d\u8bbe\u7f6e\u7ec4\u7ec7\u7ba1\u7406\u5458\u540e\uff0c\u6267\u884c terraform destroy \u4e0d\u4f1a\u5c06\u914d\u7f6e\u6062\u590d\u4e3a\u9ed8\u8ba4\u72b6\u6001\uff0c\u800c\u662f\u5220\u9664\u89d2\u8272\u6240\u5c5e\u7528\u6237\u7684\u914d\u7f6e\uff0c\u8fd9\u9700\u8981\u6ce8\u610f\u3002<br \/>\n\u867d\u7136\u5728\u4fee\u6539\u73b0\u6709\u89d2\u8272\u65f6\u9700\u8981\u6ce8\u610f\uff0c\u4f46\u65b0\u5efa\u7684\u89d2\u8272\u4e5f\u4f1a\u9ed8\u8ba4\u521b\u5efa\uff0c\u7b2c\u4e8c\u6b21\u4fee\u6539\u65f6\u53ea\u9700\u4fee\u6539\u8bb0\u5f55\u7684\u5185\u5bb9\uff0c\u56e0\u6b64\u4ecd\u7136\u9700\u8981\u6ce8\u610f\u3002<\/p>\n<h4>\u9879\u76eeAPI<\/h4>\n<p>\u5c1d\u8bd5\u5728\u53e6\u4e00\u4e2a Terraform \u4e2d\u521b\u5efa\u9879\u76eegoogle_project\u548c\u8bbe\u7f6eAPIgoogle_project_service\u65f6\uff0c\u53d1\u73b0\u4ec5\u6709google_project\u65f6\uff0c\u9879\u76ee\u7684API\u5904\u4e8e\u96f6\u72b6\u6001\uff0c\u5bfc\u81f4\u65e0\u6cd5\u901a\u8fc7terraform\u542f\u7528google_project_service\u6240\u9700\u7684API\u7684\u72b6\u6001\u3002<br \/>\n\u5fc5\u987b\u5728\u540c\u4e00\u4e2aTerraform\u4e2d\u6267\u884cgoogle_project\u548cgoogle_project_service\u3002<\/p>\n<h2>\u8bf7\u53c2\u8003<\/h2>\n<p>\u4f7f\u7528Terraform\u521b\u5efaGoogle Cloud\u9879\u76ee<br \/>\nhttps:\/\/cloud.google.com\/community\/tutorials\/managing-gcp-projects-with-terraform<\/p>\n<p>\u8eab\u4efd\u548c\u8bbf\u95ee\u7ba1\u7406 &gt; \u6587\u6863 &gt; \u6982\u8ff0 &gt; \u8d44\u6e90\u5c42\u7ea7<br \/>\nhttps:\/\/cloud.google.com\/iam\/docs\/overview?hl=ja#resource-hierarchy<\/p>\n<p>\u4f01\u4e1a\u7ec4\u7ec7\u7684\u6700\u4f73\u5b9e\u8df5<br \/>\nhttps:\/\/cloud.google.com\/docs\/enterprise\/best-practices-for-enterprise-organizations<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u8bf7\u5c06\u4ee5\u4e0b\u5185\u5bb9\u7528\u4e2d\u6587\u8fdb\u884c\u91ca\u4e49\u3002 \u56e0\u4e3a\u7528 Terraform \u5de5\u5177\u5c06\u4ee5\u524d\u624b\u52a8\u6784\u5efa\u7684 GCP\uff08Google Clou [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-48852","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v21.5 (Yoast SEO v21.5) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>\u4f7f\u7528 Terraform \u5728GCP\u4e0a\u5efa\u7acb\u7ec4\u7ec7\u8bbe\u7f6e\u3001\u5171\u4eabVPC\u548cVPN - Blog - Silicon Cloud<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.silicloud.com\/zh\/blog\/\u4f7f\u7528-terraform-\u5728gcp\u4e0a\u5efa\u7acb\u7ec4\u7ec7\u8bbe\u7f6e\u3001\u5171\u4eabvpc\u548cvpn\u3002\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u4f7f\u7528 Terraform \u5728GCP\u4e0a\u5efa\u7acb\u7ec4\u7ec7\u8bbe\u7f6e\u3001\u5171\u4eabVPC\u548cVPN\" \/>\n<meta property=\"og:description\" content=\"\u8bf7\u5c06\u4ee5\u4e0b\u5185\u5bb9\u7528\u4e2d\u6587\u8fdb\u884c\u91ca\u4e49\u3002 \u56e0\u4e3a\u7528 Terraform \u5de5\u5177\u5c06\u4ee5\u524d\u624b\u52a8\u6784\u5efa\u7684 GCP\uff08Google Clou [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.silicloud.com\/zh\/blog\/\u4f7f\u7528-terraform-\u5728gcp\u4e0a\u5efa\u7acb\u7ec4\u7ec7\u8bbe\u7f6e\u3001\u5171\u4eabvpc\u548cvpn\u3002\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog - Silicon Cloud\" \/>\n<meta property=\"article:published_time\" content=\"2022-11-26T12:33:07+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-05-03T22:42:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d8742913a08637a6bf572\/12-0.png\" \/>\n<meta name=\"author\" content=\"\u6587, \u7fd4\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u6587, \u7fd4\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8-terraform-%e5%9c%a8gcp%e4%b8%8a%e5%bb%ba%e7%ab%8b%e7%bb%84%e7%bb%87%e8%ae%be%e7%bd%ae%e3%80%81%e5%85%b1%e4%ba%abvpc%e5%92%8cvpn%e3%80%82\/\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8-terraform-%e5%9c%a8gcp%e4%b8%8a%e5%bb%ba%e7%ab%8b%e7%bb%84%e7%bb%87%e8%ae%be%e7%bd%ae%e3%80%81%e5%85%b1%e4%ba%abvpc%e5%92%8cvpn%e3%80%82\/\",\"name\":\"\u4f7f\u7528 Terraform \u5728GCP\u4e0a\u5efa\u7acb\u7ec4\u7ec7\u8bbe\u7f6e\u3001\u5171\u4eabVPC\u548cVPN - Blog - Silicon Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\"},\"datePublished\":\"2022-11-26T12:33:07+00:00\",\"dateModified\":\"2024-05-03T22:42:48+00:00\",\"author\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/64d5cc7727fffbff2f9a2a8da1de3e5c\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8-terraform-%e5%9c%a8gcp%e4%b8%8a%e5%bb%ba%e7%ab%8b%e7%bb%84%e7%bb%87%e8%ae%be%e7%bd%ae%e3%80%81%e5%85%b1%e4%ba%abvpc%e5%92%8cvpn%e3%80%82\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8-terraform-%e5%9c%a8gcp%e4%b8%8a%e5%bb%ba%e7%ab%8b%e7%bb%84%e7%bb%87%e8%ae%be%e7%bd%ae%e3%80%81%e5%85%b1%e4%ba%abvpc%e5%92%8cvpn%e3%80%82\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8-terraform-%e5%9c%a8gcp%e4%b8%8a%e5%bb%ba%e7%ab%8b%e7%bb%84%e7%bb%87%e8%ae%be%e7%bd%ae%e3%80%81%e5%85%b1%e4%ba%abvpc%e5%92%8cvpn%e3%80%82\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.silicloud.com\/zh\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u4f7f\u7528 Terraform \u5728GCP\u4e0a\u5efa\u7acb\u7ec4\u7ec7\u8bbe\u7f6e\u3001\u5171\u4eabVPC\u548cVPN\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/\",\"name\":\"Blog - Silicon Cloud\",\"description\":\"\",\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/64d5cc7727fffbff2f9a2a8da1de3e5c\",\"name\":\"\u6587, \u7fd4\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/920c3d673e0bccacc98e5e6b7149bb3c22edd8d39cb753e5d7d7e471498118a1?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/920c3d673e0bccacc98e5e6b7149bb3c22edd8d39cb753e5d7d7e471498118a1?s=96&d=mm&r=g\",\"caption\":\"\u6587, \u7fd4\"},\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/author\/wenxiang\/\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8-terraform-%e5%9c%a8gcp%e4%b8%8a%e5%bb%ba%e7%ab%8b%e7%bb%84%e7%bb%87%e8%ae%be%e7%bd%ae%e3%80%81%e5%85%b1%e4%ba%abvpc%e5%92%8cvpn%e3%80%82\/#local-main-organization-logo\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"Blog - Silicon Cloud\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u4f7f\u7528 Terraform \u5728GCP\u4e0a\u5efa\u7acb\u7ec4\u7ec7\u8bbe\u7f6e\u3001\u5171\u4eabVPC\u548cVPN - Blog - Silicon Cloud","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.silicloud.com\/zh\/blog\/\u4f7f\u7528-terraform-\u5728gcp\u4e0a\u5efa\u7acb\u7ec4\u7ec7\u8bbe\u7f6e\u3001\u5171\u4eabvpc\u548cvpn\u3002\/","og_locale":"zh_CN","og_type":"article","og_title":"\u4f7f\u7528 Terraform \u5728GCP\u4e0a\u5efa\u7acb\u7ec4\u7ec7\u8bbe\u7f6e\u3001\u5171\u4eabVPC\u548cVPN","og_description":"\u8bf7\u5c06\u4ee5\u4e0b\u5185\u5bb9\u7528\u4e2d\u6587\u8fdb\u884c\u91ca\u4e49\u3002 \u56e0\u4e3a\u7528 Terraform \u5de5\u5177\u5c06\u4ee5\u524d\u624b\u52a8\u6784\u5efa\u7684 GCP\uff08Google Clou [&hellip;]","og_url":"https:\/\/www.silicloud.com\/zh\/blog\/\u4f7f\u7528-terraform-\u5728gcp\u4e0a\u5efa\u7acb\u7ec4\u7ec7\u8bbe\u7f6e\u3001\u5171\u4eabvpc\u548cvpn\u3002\/","og_site_name":"Blog - Silicon Cloud","article_published_time":"2022-11-26T12:33:07+00:00","article_modified_time":"2024-05-03T22:42:48+00:00","og_image":[{"url":"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d8742913a08637a6bf572\/12-0.png"}],"author":"\u6587, \u7fd4","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"\u6587, \u7fd4","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"10 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8-terraform-%e5%9c%a8gcp%e4%b8%8a%e5%bb%ba%e7%ab%8b%e7%bb%84%e7%bb%87%e8%ae%be%e7%bd%ae%e3%80%81%e5%85%b1%e4%ba%abvpc%e5%92%8cvpn%e3%80%82\/","url":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8-terraform-%e5%9c%a8gcp%e4%b8%8a%e5%bb%ba%e7%ab%8b%e7%bb%84%e7%bb%87%e8%ae%be%e7%bd%ae%e3%80%81%e5%85%b1%e4%ba%abvpc%e5%92%8cvpn%e3%80%82\/","name":"\u4f7f\u7528 Terraform \u5728GCP\u4e0a\u5efa\u7acb\u7ec4\u7ec7\u8bbe\u7f6e\u3001\u5171\u4eabVPC\u548cVPN - Blog - Silicon Cloud","isPartOf":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website"},"datePublished":"2022-11-26T12:33:07+00:00","dateModified":"2024-05-03T22:42:48+00:00","author":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/64d5cc7727fffbff2f9a2a8da1de3e5c"},"breadcrumb":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8-terraform-%e5%9c%a8gcp%e4%b8%8a%e5%bb%ba%e7%ab%8b%e7%bb%84%e7%bb%87%e8%ae%be%e7%bd%ae%e3%80%81%e5%85%b1%e4%ba%abvpc%e5%92%8cvpn%e3%80%82\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8-terraform-%e5%9c%a8gcp%e4%b8%8a%e5%bb%ba%e7%ab%8b%e7%bb%84%e7%bb%87%e8%ae%be%e7%bd%ae%e3%80%81%e5%85%b1%e4%ba%abvpc%e5%92%8cvpn%e3%80%82\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8-terraform-%e5%9c%a8gcp%e4%b8%8a%e5%bb%ba%e7%ab%8b%e7%bb%84%e7%bb%87%e8%ae%be%e7%bd%ae%e3%80%81%e5%85%b1%e4%ba%abvpc%e5%92%8cvpn%e3%80%82\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.silicloud.com\/zh\/blog\/"},{"@type":"ListItem","position":2,"name":"\u4f7f\u7528 Terraform \u5728GCP\u4e0a\u5efa\u7acb\u7ec4\u7ec7\u8bbe\u7f6e\u3001\u5171\u4eabVPC\u548cVPN"}]},{"@type":"WebSite","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website","url":"https:\/\/www.silicloud.com\/zh\/blog\/","name":"Blog - Silicon Cloud","description":"","inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/64d5cc7727fffbff2f9a2a8da1de3e5c","name":"\u6587, \u7fd4","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/920c3d673e0bccacc98e5e6b7149bb3c22edd8d39cb753e5d7d7e471498118a1?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/920c3d673e0bccacc98e5e6b7149bb3c22edd8d39cb753e5d7d7e471498118a1?s=96&d=mm&r=g","caption":"\u6587, \u7fd4"},"url":"https:\/\/www.silicloud.com\/zh\/blog\/author\/wenxiang\/"},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8-terraform-%e5%9c%a8gcp%e4%b8%8a%e5%bb%ba%e7%ab%8b%e7%bb%84%e7%bb%87%e8%ae%be%e7%bd%ae%e3%80%81%e5%85%b1%e4%ba%abvpc%e5%92%8cvpn%e3%80%82\/#local-main-organization-logo","url":"","contentUrl":"","caption":"Blog - Silicon Cloud"}]}},"_links":{"self":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/48852","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/comments?post=48852"}],"version-history":[{"count":2,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/48852\/revisions"}],"predecessor-version":[{"id":96738,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/48852\/revisions\/96738"}],"wp:attachment":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/media?parent=48852"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/categories?post=48852"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/tags?post=48852"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}