Terraform on GCP

Welcome

A practical, first-principles guide to Terraform — what each concept does, how the pieces fit together, when to reach for them, and where the failure modes are. The concepts are universal; Google Cloud is the provider the examples are built on, and the parts that make GCP its own — projects and APIs, IAM, Shared VPC, federation — get the depth they deserve.

≈14.5 hours to complete Knowledge check on every topic For all levels

About This Course

Terraform has a reputation for being easy to start and hard to run well. Writing a few resources and running apply takes an afternoon. Running it across an organization — many projects, real IAM, shared networking, a state file the whole team depends on — is where most of the real learning lives, and where most tutorials stop.

This course covers both ends. It explains Terraform from first principles, in the order that makes the pieces click on Google Cloud: what Infrastructure as Code actually buys you, the Google provider and the project-plus-API bootstrap nothing works without, then the core workflow, the state file on GCS, the language, modules, and a full chapter on IAM — before the parts of running Terraform in production that bite you: real networking, organizing many projects, CI/CD, testing, and operations.

Every topic follows a consistent structure: what it is, how it works, when to use it, when not to, the common mistakes that cost people real outages and money, and the best practices. Where two approaches compete — count versus for_each, workspaces versus projects, an additive IAM member versus an authoritative binding — the course compares them and says when each one fits rather than leaving that work to you.

Who This Is For

Engineers who build or operate cloud infrastructure, and those preparing to. A beginner can read it in order to build a mental model from zero. An experienced engineer — including one who already knows AWS and wants the GCP differences spelled out — can jump to a chapter to fill a gap or settle a decision. It assumes you are comfortable on the command line and have used a cloud console, but it does not assume any prior Terraform.

A Note on Terraform, OpenTofu, and Google Cloud

The course teaches HashiCorp Terraform 1.x. In 2023 HashiCorp changed Terraform's license, and the community forked the last open-source version as OpenTofu, now under the Linux Foundation. The two are almost entirely compatible; where they diverge on a feature, the course says so. Everything you learn about the language, state, and workflow applies to both.

Terraform is provider-agnostic — it manages Google Cloud, AWS, Kubernetes, GitHub, and hundreds more through the same language. But every code example has to target something concrete, so this course uses the google provider throughout. The concepts transfer to any provider; GCP is the vehicle that makes the examples real instead of abstract — and the GCP-specific surface, which is genuinely different from other clouds, is treated as a first-class subject rather than glossed over.

What You Should Already Know

  • Command-line comfort — running commands, environment variables, editing files in a shell
  • A basic feel for a cloud provider — what a virtual machine, a network, and a storage bucket are
  • Version control with Git at a basic level — commits, branches, and pull requests
  • What an API and a JSON document are, at the level of what they do
  • No prior Terraform or Infrastructure-as-Code experience required

How the Course Is Built

The thirteen chapters are ordered so the early ones teach the core and the later ones build on it. Foundations come first, then — unusually, and deliberately — the Google provider, projects, and authentication, because on GCP you cannot create anything until a project exists, its APIs are enabled, and you have credentials. After that come the core workflow, state on GCS, the language, modules, and a dedicated chapter on identity and access, before the chapters on real infrastructure, organizing many projects, collaboration, testing, and production operations.

A running example threads through the whole book: a fictional analytics company called Hatch, which starts as a single serverless data pipeline and grows into a multi-project organization. The early chapters build the pipeline; the later ones build the org around it. A few principles run through every chapter, and they explain why the course is shaped the way it is.

Understand before you apply
Terraform rewards a mental model over memorized syntax. Every concept is explained from the problem it solves before how to write it.
The project and the hierarchy are the model
On GCP almost everything — billing, quota, IAM, APIs — keys off the project and the organization tree above it. The course teaches against that hierarchy, because it is the thing that makes GCP GCP.
The trade-offs are the point
A feature that is right for one situation is wrong for another. The course says so, and explains when not to reach for something.
Production is operations
Infrastructure you can trust differs from a demo in the unglamorous work: locking, drift, propagation races, testing, upgrades, and blast radius. That work gets its own chapters.

Chapter Map

Chapter 1
Foundations
What Infrastructure as Code is and the idea Terraform rests on. How it compares to other IaC tools and to GCP's own — Deployment Manager, Config Connector, Infrastructure Manager — installing the CLI and gcloud, providers and the Registry, your first apply, and the shape of HCL.
Chapter 2
The Google Provider, Projects & APIs
The GCP bootstrap nothing works without: the google and google-beta providers, the project / region / zone model, enabling APIs, and authentication done right — Application Default Credentials, service account impersonation, and keyless Workload Identity Federation.
Chapter 3
The Core Workflow
The refresh / plan / apply cycle you run all day. Resources and how they are addressed, data sources, implicit and explicit dependencies, the dependency graph, and the lifecycle meta-arguments that override default behavior.
Chapter 4
State on GCS
The file that maps your config to real resources. Why it exists, what it stores, the GCS backend with its native locking — no separate lock table — workspaces, importing existing infrastructure, refactoring with moved blocks, and the secrets problem.
Chapter 5
The Language — Variables, Outputs, Expressions
Parameterizing a configuration: input variables and validation, outputs as a module's return values, local values, the expression language and its operators, the built-in function library, and dynamic blocks.
Chapter 6
Iteration and Conditionals
Creating many resources from one block. count and for_each and the consequential choice between them, for expressions for reshaping data, conditional expressions, and splat expressions.
Chapter 7
Modules
The unit of reuse. What a module is, its input/output interface, calling and sourcing modules, the Cloud Foundation Toolkit modules Google publishes, versioning, composition without deep nesting, and designing a module others adopt happily.
Chapter 8
Identity & Access on GCP
The GCP-native heart of the book: the resource hierarchy and IAM inheritance, the three kinds of role, the member-versus-binding-versus-policy trap that locks people out, service accounts and impersonation, IAM conditions, org policies, and the three different tag systems.
Chapter 9
Building Real GCP Infrastructure
The language grounded in real GCP resources: the global VPC and regional subnets, Shared VPC, firewall rules and network tags, private connectivity, Compute Engine and managed instance groups, a managed service end to end, Secret Manager, and provisioners as a last resort.
Chapter 10
Structuring Projects & Environments at Scale
Structure at scale: project and repository layout, the project factory pattern, environments as workspaces or directories — and why a project per environment usually wins — DRY patterns and their limits, and when Terragrunt earns its place.
Chapter 11
Collaboration and Automation on GCP
Terraform as a team sport: shared GCS backends, running it in Cloud Build, keyless CI from GitHub Actions through Workload Identity Federation, Google's managed Infrastructure Manager, drift detection, and cost estimation in the pull request.
Chapter 12
Testing, Policy & Validation
Quality gates for infrastructure code: fmt and validate, static analysis and security scanning, the native test framework, policy as code across three layers including GCP Org Policy, and contract testing for shared modules.
Chapter 13
Production Operations & Advanced GCP
Operating Terraform over time: state surgery, upgrading providers and versions, zero-downtime replacement, disaster recovery for state, debugging GCP's asynchronous propagation failures, and standing up a whole organization with Cloud Foundation Fabric / FAST.

Disclaimer

This course is an independent educational project created and maintained by Sergey Okinchuk. It is provided for learning and reference purposes only.

No affiliation. This course is not affiliated with, sponsored by, endorsed by, or officially connected to HashiCorp (an IBM company), the OpenTofu project, the Linux Foundation, Google LLC, or any other company or project mentioned. All opinions, interpretations, and recommendations expressed are those of the author.

Trademarks. "Terraform" and "HashiCorp" are trademarks of HashiCorp, an IBM company. "OpenTofu" is a trademark of the Linux Foundation. "Google Cloud", "Google Cloud Platform", and "GCP" are trademarks of Google LLC. All other product names, logos, and brands are the property of their respective owners. Use of these names and marks is for identification and educational purposes only and does not imply any endorsement.

Accuracy and currency. Terraform and the Google provider evolve quickly — the provider ships releases most weeks, and language features, defaults, and command-line flags drift between versions. Facts in this course reflect the author's understanding at the time of writing and may not be current. Always consult the official Terraform documentation and Google provider documentation as the authoritative sources before making operational decisions.

No warranty. This material is provided "as is" without warranty of any kind. Configuration and commands are illustrative, not production-ready, and may incur cost if applied to a real cloud account. The author accepts no liability for any loss or damage arising from reliance on the content.