GCP Private Service Connect Terraform module

Open in ChatGPTOpen in Claude

Terraform simplifies the way we deploy our infrastructure and allows us to maintain it as code.

Use this Terraform module to provision consumer-side Google Cloud Private Service Connect (PSC) resources for private connectivity from GCP to Coralogix.

Traffic stays on Google's backbone network and does not cross the public internet.

This module is open source and available on GitHub and in the Terraform Registry.

Installation

This module provisions the PSC subnet, internal IP addresses, forwarding rules, and optional private Domain Name System (DNS) resources required for private connectivity to Coralogix.

It creates connectivity infrastructure only. It does not configure API keys, the GCP Logs integration, OpenTelemetry exporters, or other telemetry pipelines.

Use existing_psc_subnet_self_link to reuse an existing PSC subnet and existing_private_dns_zone_name to reuse an existing private DNS zone.

To use the module, first add the provider configuration to your Terraform project:

terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = ">= 4.31.0, < 6.0.0"
    }
  }
}

provider "google" {
  project = "your-project-id"
  region  = "us-central1"
}

Then add the module declaration:

module "private_service_connect" {
  source = "coralogix/google/coralogix//modules/v2/private-service-connect"

  gcp_region        = "us-central1"
  network_self_link = "projects/your-project/global/networks/your-vpc"
  psc_subnet_cidr   = "10.100.16.0/28"
}

Important variables to change

• gcp_region - The GCP region for the PSC resources.
• network_self_link - The existing Virtual Private Cloud (VPC) network self link, such as projects/<project>/global/networks/<name>.
• psc_subnet_cidr - The /28 CIDR range to use when the module creates a new PSC subnet.
• existing_psc_subnet_self_link - The existing PSC subnet self link to reuse instead of creating a new subnet.
• private_dns_zone_name and existing_private_dns_zone_name - Create a private DNS zone, reuse an existing private DNS zone, or set both to null to manage Domain Name System (DNS) resources outside the module.
• coralogix_domain, ingress_service_attachment, and api_service_attachment - Override these together for non-us3 deployments.
• allow_psc_global_access - Turn this on only when workloads in other GCP regions need to use the PSC endpoints.

Additional resources

Module README	Private Service Connect module README
Example: create a subnet	private-service-connect example
Example: reuse an existing private zone	private-service-connect-existing-zone example
Manual setup	Private Service Connect for GCP
GCP log ingestion	GCP Logs
GCS archive bucket	Connect a GCS archive bucket