TerraformでGCPのVPCとCompute EngineインスタンスをIaC管理する方法｜google providerの設定とリソース設計の実践手順

この記事のポイント

・google providerの認証はService Accountキーファイルで行う
・VPCはAWSと違いリージョンを持たず、サブネットがリージョン単位になる
・Compute Engineはゾーン指定が必須でrequired_providers設定と一緒に確認する
・APIの有効化忘れと権限不足が最頻出エラーの2大原因

# gcloudへのログインとプロジェクト設定
gcloud auth login
gcloud config set project [プロジェクトID]

# 設定確認
gcloud config get-value project

# Compute Engine APIを有効化（必須）
gcloud services enable compute.googleapis.com \
  --project=[プロジェクトID]

# サービスアカウントの作成
gcloud iam service-accounts create terraform-sa \
  --display-name="Terraform Service Account" \
  --project=[プロジェクトID]

# Compute管理者ロールを付与
gcloud projects add-iam-policy-binding [プロジェクトID] \
  --member="serviceAccount:terraform-sa@[プロジェクトID].iam.gserviceaccount.com" \
  --role="roles/compute.admin"

# サービスアカウントを使った操作に必要なロールも付与
gcloud projects add-iam-policy-binding [プロジェクトID] \
  --member="serviceAccount:terraform-sa@[プロジェクトID].iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountUser"

# JSONキーの発行
gcloud iam service-accounts keys create terraform-key.json \
  --iam-account=terraform-sa@[プロジェクトID].iam.gserviceaccount.com

# versions.tf
terraform {
  required_version = ">= 1.5"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
  }
}

# provider.tf
provider "google" {
  credentials = file("terraform-key.json")
  project     = var.project_id
  region      = var.region
}

# variables.tf
variable "project_id" {
  type        = string
  description = "GCPプロジェクトID"
}

variable "region" {
  type    = string
  default = "asia-northeast1"
}

variable "zone" {
  type    = string
  default = "asia-northeast1-b"
}

$ terraform init

Initializing the backend...
Initializing provider plugins...
- Finding hashicorp/google versions matching "~> 5.0"...
- Installing hashicorp/google v5.40.0...

Terraform has been successfully initialized!

# network.tf
resource "google_compute_network" "main" {
  name                    = "terraform-vpc"
  auto_create_subnetworks = false   # カスタムサブネットモードを使う
  project                 = var.project_id
}

resource "google_compute_subnetwork" "main" {
  name          = "terraform-subnet"
  network       = google_compute_network.main.id
  region        = var.region
  ip_cidr_range = "10.0.1.0/24"
  project       = var.project_id

  # 外部IPなしのインスタンスからGCPマネージドサービスへのアクセスを許可
  private_ip_google_access = true
}

resource "google_compute_firewall" "allow_ssh" {
  name    = "allow-ssh"
  network = google_compute_network.main.name
  project = var.project_id

  allow {
    protocol = "tcp"
    ports    = ["22"]
  }

  source_ranges = ["0.0.0.0/0"]  # 本番では管理IPに限定すること
  target_tags   = ["allow-ssh"]  # このタグを持つインスタンスにのみ適用
}

# compute.tf
resource "google_compute_instance" "web" {
  name         = "terraform-web"
  machine_type = "e2-medium"   # vCPU 2 / メモリ4GB
  zone         = var.zone
  project      = var.project_id

  # ファイアウォールのtarget_tagsと一致させる
  tags = ["allow-ssh"]

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
      size  = 20   # ディスクサイズ(GB)
      type  = "pd-standard"
    }
  }

  network_interface {
    network    = google_compute_network.main.id
    subnetwork = google_compute_subnetwork.main.id

    access_config {
      # このブロックを空にすることで外部IPが自動割り当てされる
    }
  }
}

resource "google_compute_instance" "web" {
  # ...前述の設定...

  metadata_startup_script = <<-EOF
    #!/bin/bash
    apt-get update -y
    apt-get install -y nginx
    systemctl enable nginx
    systemctl start nginx
  EOF
}

metadata_startup_script = file("scripts/startup.sh")

# terraform.tfvars
project_id = "my-gcp-project-123456"

# planで差分確認
$ terraform plan

Terraform will perform the following actions:

  # google_compute_firewall.allow_ssh will be created
  + resource "google_compute_firewall" "allow_ssh" {
      + name    = "allow-ssh"
      + network = "terraform-vpc"
      ...
    }

  # google_compute_instance.web will be created
  + resource "google_compute_instance" "web" {
      + machine_type = "e2-medium"
      + name         = "terraform-web"
      + zone         = "asia-northeast1-b"
      ...
    }

  # google_compute_network.main will be created
  # google_compute_subnetwork.main will be created

Plan: 4 to add, 0 to change, 0 to destroy.

# applyで実際にリソースを作成
$ terraform apply -auto-approve

google_compute_network.main: Creating...
google_compute_network.main: Still creating... [10s elapsed]
google_compute_network.main: Creation complete after 16s
google_compute_subnetwork.main: Creating...
google_compute_subnetwork.main: Creation complete after 14s
google_compute_firewall.allow_ssh: Creating...
google_compute_instance.web: Creating...
google_compute_firewall.allow_ssh: Creation complete after 8s
google_compute_instance.web: Creation complete after 22s

Apply complete! Resources: 4 added, 0 changed, 0 destroyed.

# gcloudでSSH接続
$ gcloud compute ssh terraform-web \
    --zone=asia-northeast1-b \
    --project=my-gcp-project-123456

# 不要になったら全リソースを削除
$ terraform destroy -auto-approve

Destroy complete! Resources: 4 destroyed.

Error: Error creating Network: googleapi: Error 403: Compute Engine API has not been
used in project [PROJECT_ID] before or it is disabled. Enable it by visiting
https://console.developers.google.com/apis/api/compute.googleapis.com/overview

gcloud services enable compute.googleapis.com --project=[プロジェクトID]

Error: Error creating Instance: googleapi: Error 403: Required 'compute.instances.create'
permission for 'projects/[PROJECT_ID]/zones/asia-northeast1-b', forbidden

# 現在の権限を確認
gcloud projects get-iam-policy [プロジェクトID] \
  --filter="bindings.members:terraform-sa@[プロジェクトID].iam.gserviceaccount.com" \
  --format="json"

# roles/compute.admin を付与
gcloud projects add-iam-policy-binding [プロジェクトID] \
  --member="serviceAccount:terraform-sa@[プロジェクトID].iam.gserviceaccount.com" \
  --role="roles/compute.admin"

Error: Invalid value for field 'resource.zone': 'asia-northeast1'.
Zones must be in the format: 'zone-name' (e.g., 'us-central1-a')