README.md

Description

This module creates a new VPC network with 1 or more subnetworks and a Cloud Router for every region with a subnetwork. By default, it will create:

• A Cloud NAT to enable outbound access to the public internet for VMs without public IP addresses; VMs with public IP addresses bypass the NAT to directly access the public internet
• A firewall rule that enables inbound SSH access from Identity-Aware Proxy
• A firewall rule that enables all traffic internal to the network

This behavior is optional and can be configured as described below. This module is based on networking support in the Cloud Foundation Toolkit. We recommend following the documentation for the network module and submodules for more details. In particular, the detailed structure of input variables can be found for:

• var.firewall_rules
• var.secondary_ranges

Additionally, Google Private Access is enabled by default on all subnetworks unless it is explicitly disabled. This setting ensures that all VMs can use Google services such as Cloud Storage even if they do not have public IP addresses or Cloud NAT is disabled.

Example

This creates a new VPC network named cluster-net.

  - id: network1
    source: modules/network/vpc
    settings:
      network_name: cluster-net

Deprecation warning

The variables listed below have been deprecated and will be removed in a future release. Until they are removed,You may continue to use them in Toolkit blueprints with the same functionality as documented in the Toolkit 1.0 release.

• Deprecated variables
  • var.primary_subnetwork
  • var.additional_subnetworks
  • var.subnetwork_size

The following variables have been added to support explicit IP ranges for subnetworks while retaining existing functionality. We advise adopting them even if not using explicit IP ranges . The Toolkit does not support mixing deprecated variables with the new replacements. The new functionality is described in more detail below.

• New variables to adopt
  • var.subnetworks
    • A value for this can be generated by merging var.primary_subnetwork and var.additional_subnetworks into a single list
  • var.default_primary_subnetwork_size
    • This variable has been renamed for clarity; its value can be directly copied from an explicit setting for var.subnetwork_size; if your blueprint does not have an explicit setting, the default values are the same

Subnetworks

This module will always provision at least 1 "primary" subnetwork in which most resources are expected to be provisioned. This primary subnetwork is determined by

1. The first element of var.subnetworks if it is not the empty list
2. A default subnetwork automatically calculated from
   • var.subnetwork_name
   • var.region
   • var.network_address_range
   • var.default_primary_subnetwork_size
   • var.subnetwork_stack_type
   • var.subnetwork_ipv6_access_type

If var.subnetworks is provided then the primary subnetwork name is taken explicitly from it and var.subnetwork_name is ignored.

var.subnetworks behaves identically to the Cloud Foundation Toolkit subnets module with the lone exception that one can provide one of the following settings for each subnetwork:

• new_bits
• subnet_ip

If each subnetwork defines subnet_ip then these are taken to be their explicit CIDR IP ranges. If each subnetwork defines new_bits, then these are taken to be the size of the CIDR subnetwork (in bits). IP ranges for each subnetwork are calculated using var.network_address_range as the base IP, producing the most compact set of subnetworks possible.

NOTE: we do not presently support the modification of individual subnetworks when using this module to provision more than 1 subnetwork using automatically calculated IP ranges based upon new_bits. Doing so will cause IP ranges to be recalculated for each subnetwork. We advise appending new subnetworks to the end of var.subnetworks.

SSH Access

By default a firewall rule is created to allow inbound SSH access from Identity-Aware Proxy. A user must have the IAP-Secured Tunnel User (roles/iap.tunnelResourceAccessor) IAM role to be able to SSH over IAP.

To allow regular SSH access from a known IP address you can add the following firewall_rules setting to the vpc module:

  - id: network1
    source: modules/network/vpc
    settings:
      firewall_rules:
      - name: ssh-my-machine
        direction: INGRESS
        ranges: [<your-ip-address>/32]
        allow:
        - protocol: tcp
          ports: [22]

Note: You must populate the above example with the source IP address from which you plan to SSH from. You can use a service like whatismyip.com to determine your IP address.

License

Copyright 2026 Google LLC

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

 http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Requirements

Providers

Modules

Resources

Inputs

list(object({
    subnetwork_name = string,
    ranges = list(object({
      range_name    = string,
      ip_cidr_range = string
    }))
  }))

Outputs