GCP VM Lab

Small Terraform lab that creates a Google Cloud VPC, subnet, firewall rule, static public IP address, and Compute Engine VM.

What It Creates

• Custom VPC with automatic subnet creation disabled.
• Regional subnet for the VM.
• Firewall rule for the configured TCP/UDP ports and ICMP.
• Reserved regional external IP address.
• Ubuntu Compute Engine VM attached to the subnet and static IP.

Repository Layout

File	Purpose
provider.tf	Terraform and Google provider configuration.
variables.tf	Input variables for project, network, firewall, and VM settings.
network.tf	VPC and subnet resources.
firewall.tf	Firewall rule controlled by ports and my_range.
vm.tf	Compute Engine VM and static public IP address.
output.tf	Terraform output values, such as the VM public IP.
terraform.tfvars.example	Public-safe example values. Copy this to terraform.tfvars.

Prerequisites

• Terraform installed locally.
• Google Cloud CLI installed locally.
• Existing Google Cloud project with billing enabled.
• Google Cloud authentication configured, for example with Application Default Credentials.
• Compute Engine API enabled in the target project.

Existing GCP Project Setup

This lab does not create the Google Cloud project, billing setup, or IAM permissions. It assumes you already have a project where you are allowed to create Compute Engine resources.

Create local Application Default Credentials for Terraform:

gcloud auth application-default login

Enable the Compute Engine API in the existing project:

gcloud services enable compute.googleapis.com --project YOUR_PROJECT_ID

Terraform can also use a service account JSON key through GOOGLE_APPLICATION_CREDENTIALS, but for a local lab Application Default Credentials are simpler. Do not commit service account keys.

Use the same project ID in terraform.tfvars.

Terraform Workflow

Copy the example variables file:

cp terraform.tfvars.example terraform.tfvars

Edit terraform.tfvars for your environment:

• project_id: your Google Cloud project ID.
• region: region for the subnet and static IP.
• zone: VM zone in the selected region.
• my_range: trusted source CIDR for firewall access, for example 203.0.113.10/32.
• vm_type: Compute Engine machine type.

Run the Terraform workflow:

terraform init
terraform fmt -recursive
terraform validate
terraform plan -out=tfplan

Apply the saved plan when you are ready to create the resources:

terraform apply tfplan

Destroy the lab when finished:

terraform destroy

Public Repository Safety

Do not commit local Terraform values, state files, plans, provider downloads, or service account keys. This repository ignores local terraform.tfvars, .terraform/, state, lock-info, and plan files by default.

The .terraform.lock.hcl file is safe and useful to commit because it pins provider dependency selections.