Terraform for Apigee API Platform and Hybrid

Apigee and Terraform together move API gateway configuration out of manual console clicks and into versioned code. Terraform is an Infrastructure as Code tool that you can use to provision and configure Apigee using code. When you use Terraform with Apigee, you create Terraform files that describe your desired configuration for provisioning or a feature. When you apply the configuration, Terraform creates an execution plan and performs the operations needed to configure Apigee.

The integration applies to Apigee X on Google Cloud Platform, Apigee hybrid deployments on AWS, GCP, and Azure, and API Hub provisioning. The workflow starts when Terraform calls Google’s Apigee API using authorized credentials from your identity provider. Each resource — proxy bundles, environments, key-value maps — is defined in HCL and pushed through service accounts mapped to your IAM roles. The result is a fully auditable pipeline where infrastructure and gateways evolve together through code reviews instead of ad hoc changes.

Getting started with Apigee Terraform

Before you begin with Apigee Terraform, prepare your development environment, either Cloud Shell or a local shell.

Cloud Shell
To use an online terminal with the gcloud CLI and Terraform already set up, activate Cloud Shell. At the bottom of this page, a Cloud Shell session starts and displays a command-line prompt.

The same preparation step is documented for API Hub provisioning. Terraform is an infrastructure-as-code tool that enables you to predictably create, change, and improve your cloud infrastructure by using code. For more information about using Terraform to provision infrastructure on Google Cloud, see Terraform on Google Cloud documentation. If you prefer to provision API hub using Google Cloud console, see Provision API hub in the Cloud console.

A production-grade stack approach is offered for Apigee X. The terraform-apigee-enterprise-stack project provides a production-grade Terraform stack tailored for Apigee X on Google Cloud Platform. It is designed to be enterprise-ready, secure by default, and opinionated for easy use.

Getting started steps follow a standard Terraform adoption pattern.

Ensure System Requirements:
Visit Release Page:
Head over to the Releases page to find the latest version of the software.
Download the Software:
Download the available .zip or .tar.gz files. The files contain everything you need to start using the Terraform stack.
Extract the Files:
After downloading, extract the contents of the file. You can use tools like WinRAR or unzip on Windows, or double-click the file on Mac.
Open a Terminal:
For Windows, open Command Prompt. For Mac, launch Terminal from your Applications.
Navigate to the Directory:
Use the cd command to change to the directory where you extracted the files. For example:

cd path/to/terraform-apigee-enterprise-stack

Initialize Terraform:
Run the following command to initialize Terraform. This prepares your environment:

terraform init

Apply the Configuration:
Once initialized, apply the configuration by running:

terraform apply

Terraform will show you what changes it intends to make. Confirm by typing yes.

Core Apigee Terraform capabilities

Apigee Terraform lets you define and deploy Apigee API gateway configurations using Terraform code. It automates proxy creation, environments, and policies through the same infrastructure-as-code workflow used for cloud resources, improving version control and reproducibility while preventing manual misconfigurations.

Key benefits of managing Apigee with Terraform:

One source of truth for all API configuration.
Automated security enforcement through IAM and RBAC.
Quicker rollback and recovery using stored state.
Full CI/CD integration with GitOps pipelines.
Cleaner auditing for SOC 2 or ISO 27001 compliance.

Developer velocity perks are immediate. Teams stop bouncing between Apigee’s console and CLI. Changes flow through one Git review instead of five Slack threads. Faster onboarding. Fewer manual approvals. Debugging gets easier because what’s deployed always matches what’s defined.

Apigee manages API traffic, policies, and analytics. Terraform codifies infrastructure so it can be versioned, verified, and redeployed safely. When you integrate the two, every API configuration becomes as repeatable as your production stack. No mystery proxies. No configuration drift hiding in the dark.

The connection workflow starts when Terraform calls Google’s Apigee API using authorized credentials from your identity provider. Each resource — proxy bundles, environments, key-value maps — is defined in HCL and pushed through service accounts mapped to your IAM roles.

Treat this integration the same way you treat any secure system. Use least-privilege IAM roles. Rotate secrets through HashiCorp Vault or Google Secret Manager. Keep Terraform state in a locked bucket with versioning enabled. Developers get clarity, not friction. Every commit tells everyone exactly what changed.

Cloud Foundation Fabric Apigee module

This page documents the modules/apigee Terraform module, which manages the full lifecycle of Apigee resources: organization creation or reuse, environment groups, environments, runtime instances, NAT addresses, endpoint attachments for PSC southbound patterns, add-ons configuration, and DNS zone peering.

For details on the broader modules library conventions, including IAM patterns and factory inputs, see Terraform Modules.

The module manages the following Apigee resource hierarchy within a single GCP project:

The organization variable controls whether a new Apigee organization is created. If set to null, the module assumes an organization already exists in the project and derives local.orgid and local.orgname from var.project_id.

All other resources reference local.orgid or local.orgname, so the rest of the module is independent of whether an organization was created by this module or pre-existed.

Resource hierarchy and key inputs are documented in the module.

Field	Type	Default	Notes
analytics_region	string	—	GCP region for analytics data modules/apigee/main.tf24
authorized_network	string	—	VPC network ID for peering modules/apigee/main.tf26
billing_type	string	—	e.g

The organization variable controls creation or reuse and the module derives identifiers when an existing organization is present.

Apigee API Hub provisioning with Terraform

This page applies to Apigee and Apigee hybrid. This page explains how to provision API hub using Terraform for Google Cloud in Cloud Shell.

Terraform is an infrastructure-as-code tool that enables you to predictably create, change, and improve your cloud infrastructure by using code. For more information about using Terraform to provision infrastructure on Google Cloud, see Terraform on Google Cloud.

Before you begin:
Prepare your development environment, either Cloud Shell or a local shell:
Cloud Shell
To use an online terminal with the gcloud CLI and Terraform already set up, activate Cloud Shell.
At the bottom of this page, a Cloud Shell session starts and displays a command-line prompt.

Apigee Hybrid deployment with Terraform

Apigee Hybrid deployment complexity is reduced significantly by Terraform automation. This is where the Terraform code really simplifies the process. It automates the installation of the Apigee Hybrid operator, which is a Kubernetes controller that manages the Apigee components. It also deploys the various Apigee services, such as Mart, Watcher, and Synchronizer, and configures them to connect to your Apigee control plane in Google cloud.

The Terraform modules handle the creation of the necessary Kubernetes secrets and custom resources that define the Apigee configuration, which is a major pain point when doing this manually. The code also automates the setup of TLS certificates and service accounts, ensuring a secure and functional deployment.

A few points worth noting:
- Apigee hybrid multi-region and upgrade of Apigee hybrid are not supported with this tool.
- While the tool is primarily for installing both the kubernetes cluster and the hybrid components, the tool can also be used to deploy Apigee hybrid where a cluster is already available in which case the Apigee hybrid components will be installed on the designated kubernetes cluster.

In conclusion, the Terraform repository provides a robust and repeatable solution for deploying Apigee Hybrid on AWS, GCP, and Azure. By automating the entire process from cluster creation to the installation of all Apigee components, it drastically reduces the complexity and time required for setup.

Operational discipline is required. Keep Terraform state in a locked bucket with versioning enabled. Developers get clarity, not friction. Every commit tells everyone exactly what changed.

Platforms that enforce identity-aware access turn those access rules into guardrails that enforce policy automatically. When your identity-aware proxy knows who’s calling and what they’re approved to do, Terraform’s declarations remain secure across environments.

Conclusion

Terraform for Apigee unifies API gateway lifecycle with infrastructure lifecycle. The Apigee API Platform get-started guidance shows how Terraform files describe desired configuration for provisioning or a feature and how apply creates an execution plan and performs the operations needed to configure Apigee.

The enterprise stack offers a production-grade Terraform stack tailored for Apigee X on Google Cloud Platform, designed to be enterprise-ready, secure by default, and opinionated for easy use. The workflow from download to extract to cd to terraform init to terraform apply provides a repeatable onboarding path.

The Cloud Foundation Fabric modules/apigee module manages the full lifecycle of Apigee resources: organization creation or reuse, environment groups, environments, runtime instances, NAT addresses, endpoint attachments for PSC southbound patterns, add-ons configuration, and DNS zone peering. The organization variable controls creation and reuse, with local.orgid and local.orgname derived from var.project_id when existing.

API Hub provisioning is covered for both Apigee and Apigee hybrid, with Cloud Shell as the recommended development environment and Terraform as the infrastructure-as-code driver.

For Apigee Hybrid, Terraform automates the installation of the Apigee Hybrid operator, deployment of Mart, Watcher, and Synchronizer, connection to the Apigee control plane in Google Cloud, creation of Kubernetes secrets and custom resources, and automation of TLS certificates and service accounts. The tool supports fresh cluster creation and existing cluster adoption, with the explicit constraints that Apigee hybrid multi-region and upgrade of Apigee hybrid are not supported with this tool.

Across all patterns, the benefits converge: one source of truth for all API configuration, automated security enforcement through IAM and RBAC, quicker rollback and recovery using stored state, full CI/CD integration with GitOps pipelines, and cleaner auditing for SOC 2 or ISO 27001 compliance. Teams stop bouncing between console and CLI, changes flow through Git review, and debugging improves because deployed state matches defined state.

The durable practice is to keep Terraform state in a locked bucket with versioning enabled, use least-privilege IAM roles, rotate secrets through HashiCorp Vault or Google Secret Manager, and treat the integration as a secure system where every commit tells everyone exactly what changed.