Terraform Google Compute Engine VM Instance Provisioning Deep Dive

Terraform is an infrastructure as code tool that lets you provision and manage Google Cloud infrastructure with declarative configuration files. The Terraform provider for Google Cloud, the Google Cloud provider, lets you provision and manage Google Cloud resources, including Compute Engine. This article covers the end-to-end workflow for creating a Compute Engine VM instance with Terraform, the core google_compute_instance resource, and the Terraform Google Modules for creating instances from templates and instance templates.

Quickstart workflow for a VM instance

The official quickstart for creating a VM instance using Terraform walks through the complete lifecycle from project selection to connection and cleanup. The workflow starts in Cloud Shell, where an online terminal with the gcloud CLI and Terraform is already set up.

Roles required to select or create a project are documented in the quickstart. Selecting a project doesn't require a specific IAM role, you can select any project that you've been granted a role on. Create a project requires the Project Creator role, roles/resourcemanager.projectCreator, which contains the resourcemanager.projects.create permission. Project creation uses the command:

gcloud projects create PROJECT_ID

Replace PROJECT_ID with a name for the Google Cloud project you are creating.

The configuration file that defines the Google Cloud resources you want to create is main.tf. This file describes the google_compute_instance resource, which is the Terraform resource for the Compute Engine VM instance.

Verify Terraform is available:

terraform

The output should be similar to:

Usage: terraform [global options] <subcommand> [args] The available commands for execution are listed below. The primary workflow commands are given first, followed by less common or more advanced commands. Main commands: init Prepare your working directory for other commands validate Check whether the configuration is valid plan Show changes required by the current configuration apply Create or update infrastructure destroy Destroy previously-created infrastructure

Initialize Terraform:

terraform init

The output should be similar to:

Initializing the backend... Initializing provider plugins... - Finding latest version of hashicorp/google..

Initialize prepares your workspace so Terraform can apply your configuration.

Verify syntax and preview changes:

terraform plan

This command takes the following actions:

• Verifies that the syntax of main.tf is correct
• Shows a preview of the resources that will be created

The output should be similar to:

Plan: 1 to add, 0 to change, 0 to destroy. Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform apply" now.

Apply the configuration:

terraform apply

When prompted, enter yes. Terraform calls Google Cloud APIs to create the VM instance defined in the main.tf file. The output should be similar to:

Apply complete! Resources: 1 added, 0 changed, 0 destroyed

Connect to the VM instance:

gcloud compute ssh --zone=us-central1-a my-vm

Clean up:

terraform destroy

When prompted, enter yes. The output should be similar to:

Destroy complete! Resources: 1 destroyed.

To avoid incurring charges to your Google Cloud account for the resources used, delete the Google Cloud project with the resources.

Core googlecomputeinstance resource definition

Terraform has a declarative and configuration-oriented syntax, which you can use to describe the infrastructure that you want to provision in your Google Cloud project. After you author this configuration in one or more Terraform configuration files, you can use the Terraform CLI to apply this configuration to your Compute Engine resources.

The steps Terraform works through are:

• You describe the infrastructure you want to provision in a Terraform configuration file. You don't need to write code describing how to provision the infrastructure. Terraform provisions the infrastructure for you.
• You run the terraform plan command, which evaluates your configuration and generates an execution plan. You can review the plan and make changes as needed.

The quickstart example configures google_compute_instance with the following properties:

• name is set to my-vm
• machine_type is set to n1-standard-1
• zone is set to us-central1-a
• boot_disk sets the boot disk for the instance
• network_interface is set to use the default network in your Google Cloud project

The resource definition in main.tf is the authoritative description of the VM. The file defines the Google Cloud resources that you want to create.

The configuration pattern can be expressed as:

```hcl
resource "googlecomputeinstance" "vm" {
name = "my-vm"
machine_type = "n1-standard-1"
zone = "us-central1-a"

boot_disk {
# boot disk configuration
}

network_interface {
# default network
}
}
```

Resource property reference

Terraform Google Modules for compute instances

HashiCorp Terraform is an infrastructure-as-code tool that lets you provision and manage cloud infrastructure. Terraform provides plugins called providers that let you interact with cloud providers and other APIs. You can use the Terraform provider for Google Cloud to provision and manage Google Cloud resources, including Compute Engine.

This page introduces you to using Terraform with Compute Engine, including an introduction to how Terraform works and some resources to help you get started using Terraform with Google Cloud. You'll also find links to Terraform reference docs for Compute Engine, code examples, and guides for using Terraform to provision Compute Engine resources.

Module for compute instances from template

This module is used to create compute instances, and only compute instances, using google_compute_instance_from_template, with no instance groups.

Name, description, type, default and required values for key inputs are documented.

The module accepts an instance template self_link to create compute instances from that template. Access configurations control IPs via which the VM instance can be accessed via the Internet. Deletion protection defaults to false and must be disabled before removal to allow instance deletion. Hostname suffix addition defaults to true with separator "-".

Instance template submodule

This submodule allows you to create a google_compute_instance_template resource, which is used as the basis for the other instance, managed, and unmanaged instance groups submodules.

Name, description, type, default and required values for key inputs are documented.

The instance template defaults are significant for provisioning. The source image family defaults to rocky-linux-9-optimized-gcp. The source image project defaults to rocky-linux-cloud. If neither source_image nor source_image_family is specified, defaults to the latest public Rocky Linux 9 optimized for GCP image.

Spot provisioning defaults to false. Additional disks, additional networks, and alias IP ranges can be specified to customize the template. Service account attachment is optional and can be configured with project roles.

Configuration lifecycle and operational notes

Working with Terraform and Compute Engine follows a repeatable cycle. You author the configuration, run terraform plan to validate syntax and preview changes, then terraform apply to create or update infrastructure. The provider calls Google Cloud APIs to realize the declared state.

The quickstart demonstrates connecting after creation with gcloud compute ssh --zone=us-central1-a my-vm. Cleanup uses terraform destroy to remove previously-created infrastructure.

When using the instance template module, modifying the list will cause the instance to recreate. Currently a max of 1 resource policy is supported. Deletion protection must be disabled before removal, otherwise the instance cannot be deleted and the Terraform run will not complete successfully.

The module for compute instances from template has no instance groups, which simplifies single-instance provisioning. For fleet scenarios, the instance template submodule provides the basis for managed and unmanaged instance groups.

Conclusion

Terraform provisioning of Google Compute Engine VM instances combines declarative configuration with provider-driven API calls to deliver repeatable infrastructure. The quickstart pattern of creating main.tf with a google_compute_instance resource, initializing with terraform init, planning with terraform plan, and applying with terraform apply provides a complete lifecycle. The example configuration uses my-vm with n1-standard-1 machine type in us-central1-a, with boot disk and default network interface.

Module-based workflows offer additional abstraction. The compute instance from template module centralizes inputs such as access_config, add_hostname_suffix, deletion_protection, hostname, hostname_suffix_separator, and instance_template, enabling reuse across environments. The instance template submodule governs the template definition with defaults for Rocky Linux 9 optimized for GCP images, source image family rocky-linux-9-optimized-gcp, source image project rocky-linux-cloud, and optional spot provisioning.

Operational best practices include verifying Terraform availability, reviewing plans before apply, and using terraform destroy for cleanup to avoid charges. The combination of direct resource definitions and modular templates gives teams both fine-grained control and reusable patterns for Compute Engine VM provisioning with Terraform.

Sources

1. https://docs.cloud.google.com/docs/terraform/create-vm-instance
2. https://github.com/terraform-google-modules/terraform-google-vm/blob/master/modules/compute_instance/README.md
3. https://github.com/terraform-google-modules/terraform-google-vm/blob/master/modules/instance_template/README.md
4. https://docs.cloud.google.com/compute/docs/terraform