README.md

July 21, 2026 · View on GitHub

Description

This module configures private service access for the VPC specified by the network_id variable. It can be used by the Cloud SQL Federation module or to connect Google Cloud NetApp Volumes.

It will automatically perform the following steps, as described in the Private Service Access creation page:

Create an IP Allocation with the prefix_length specified by the ip_alloc_prefix_length variable. Let Google pick the base address automatically, or specify it by using the address variable.
Create a private connection that establishes a VPC Network Peering connection between your VPC network and the service producer's network.
When connecting to Google Cloud NetApp Volumes, it imports and exports custom routes.

Some services like CloudSQL or NetApp Volumes delete some internal backend resources lazily. This may take up to a few hours. Deleting the PSA peering while the backend resources still exist will fail. Set deletion_policy = "ABANDON" to enable error-free deletion for such PSA connections. See deletion_policy.

Example

Connecting services which use a service networking PSA connection:

  - source: modules/network/vpc
    id: network

  # Private Service Access (PSA) requires the compute.networkAdmin role which is
  # included in the Owner role, but not Editor.
  # https://cloud.google.com/vpc/docs/configure-private-services-access#permissions
  - source: modules/network/private-service-access
    id: ps_connect
    use: [network]

Connecting Google Cloud NetApp Volumes for using it as a shared filesystem:

  - source: modules/network/vpc
    id: network

  - source: modules/network/private-service-access
    id: ps_connect
    use: [network]
    settings:
      prefix_length: 24
      service_name: "netapp.servicenetworking.goog"
      deletion_policy: "ABANDON"

License

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

 http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Requirements

Name	Version
terraform	>= 1.12.2
google	>= 6.40

Providers

Name	Version
google	>= 6.40

Modules

No modules.

Resources

Name	Type
google_compute_global_address.private_ip_alloc	resource
google_compute_network_peering_routes_config.private_vpc_peering_routes_gcnv	resource
google_service_networking_connection.private_vpc_connection	resource

Inputs

Name	Description	Type	Default	Required
address	The IP address or beginning of the address range allocated for the Private Service Access.	`string`	`null`	no
deletion_policy	The policy to apply when deleting the Private Service Access. Leave empty or use ABANDON.	`string`	`null`	no
labels	Labels to add to supporting resources. Key-value pairs.	`map(string)`	n/a	yes
name	Name of the global address allocation for Private Service Access. If null, defaults to deterministic naming based on network name. Note: Changing this on an existing deployment will force resource recreation.	`string`	`null`	no
network_id	The ID of the GCE VPC network to configure Private Service Access: `projects/<project_id>/global/networks/<network_name>`"	`string`	n/a	yes
prefix_length	The prefix length of the IP range allocated for the Private Service Access.	`number`	`16`	no
project_id	ID of project in which Private Service Access will be created.	`string`	n/a	yes
service_name	The name of the service to connect. Defaults to 'servicenetworking.googleapis.com'.	`string`	`"servicenetworking.googleapis.com"`	no

Outputs

Name	Description
cidr_range	CIDR range of the created google_compute_global_address
connect_mode	Services that use Private Service Access typically specify connect_mode "PRIVATE_SERVICE_ACCESS". This output value sets connect_mode and additionally blocks terraform actions until the VPC connection has been created.
private_vpc_connection_peering	The name of the VPC Network peering connection that was created by the service provider.
reserved_ip_range	Named IP range to be used by services connected with Private Service Access.