terradart_google

Ships 1332 curated resource factories + 461 data sources (1793 catalog entries)

The GA hashicorp/google catalog is filled. google-beta is coming soon. The full factory table with example pointers is on Coverage. Discover factories programmatically via package:terradart_google/catalog.dart (terradartCatalog).

How resources are built

Factory wrappers under lib/src/<service>/ are emitted by terradart wrap from curated overrides in terradart_codegen. They are committed so consumers depend on terradart_google without running codegen.

CI verifies determinism via terradart wrap --check. For google-beta types, open an issue to request curation.

Runtime primitives (Stack, TfArg, writeTo) live in terradart_core.

Installation

dependencies:
  terradart_core: ^0.25.x
  terradart_google: ^0.25.x

Usage example

import 'package:terradart_core/terradart_core.dart';
import 'package:terradart_google/provider.dart';
import 'package:terradart_google/storage.dart';

final class AssetsStack extends Stack {
  AssetsStack({required String projectId})
      : super(providers: [
          GoogleProvider(project: projectId, region: 'asia-northeast1'),
        ]) {
    add(GoogleStorageBucket(
      localName: 'assets',
      name: TfArg.literal('my-app-assets-prod'),
      storageClass: TfArg.literal(BucketStorageClass.standard),
    ));
  }
}

See examples/ and the pubsub quickstart for AppExport / boundary patterns.

Libraries

access_context_manager: Access Context Manager: VPC Service Controls access policies, levels, access-level conditions, service perimeters, dry-run perimeter resources, authorized-orgs descriptors, bulk levels/perimeters, live/dry-run ingress and egress attachments, GCP user access bindings, and access-policy IAM members.
active_directory: Managed Service for Microsoft Active Directory — domains bill hourly while they exist (never_apply for apply-smoke).
agent: Agent Identity / Agent Registry — auth providers (API key / OAuth) plus registered agent/MCP services and auth-provider bindings. Requires Agent Identity scaffolding; ships debt-only (not applyable on terradart-validate).
alloydb: AlloyDB — Postgres-compatible managed database clusters and instances.
apigee: Apigee: organizations, runtime instances, environments, env groups, add-ons, data collectors, analytics datastores, NAT addresses, endpoint attachments, DNS zones, spaces, sync authorization, target servers, developers, developer apps, API products, app groups, env keystores/references, KVMs, keystore aliases (self-signed / key+cert / PKCS12), API proxies, shared flows + deployments, flow hooks, environment debug masks, proxy deployments, control-plane access, and Advanced API Security profiles / feedback / monitoring conditions. Org/instance/env bill while provisioned (never_apply for apply-smoke).
apihub: Apigee API Hub — host registration, project-singleton instance, runtime attachments, curations, and catalog plugins. Host/instance are never_apply (MM exclude_delete); siblings ship debt-only.
apikeys: API Keys: restrict Google Cloud API access by key.
app: App Engine — application registration, standard/flexible versions, firewall rules, URL dispatch, domain mapping, and service traffic/network settings.
apphub: App Hub — applications that group services and workloads for end-to-end business functionality, plus host/service-project attachment.
artifact_registry: Artifact Registry: container / package repository, per-repository IAM, and repository download rules.
assured_workloads: Assured Workloads — compliance-regime folders (IL4 / CJIS / HITRUST / EU Regions / …). Creating a workload mutates the organization folder tree; apply-excluded leftover factory.
backup_dr: Backup and DR Service — vaults, plans, associations, management server, service config, and restore workloads.
beyondcorp: BeyondCorp Enterprise / Chrome Enterprise Premium — App Gateways, connectors, connections, and Security Gateways. Requires CEP entitlement (never_apply for apply-smoke).
biglake: BigLake Metastore — Hive-compatible catalogs, databases, and tables. Nested hive_options config is passed as a structured map.
bigquery: BigQuery datasets, tables, jobs, routines, transfers, reservations, capacity commitments, external connections, and per-resource IAM bindings.
bigtable: Cloud Bigtable — instances, tables, app profiles, GC policies, views.
billing: Cloud Billing — account IAM plus leftover budget / project-info / subaccount factories (billing-account scoped; apply-excluded).
binary_authorization: Binary Authorization: project policy, attestors, and attestor IAM members.
blockchain: Blockchain Node Engine — managed blockchain nodes (Ethereum Full/Archive hours while provisioned; never_apply for apply-smoke).
catalog: Static catalog of all curated terradart_google factories.
certificate_manager: Certificate Manager — DNS authorization, managed/self-managed certificates, and certificate maps for HTTPS load balancers.
ces: Customer Engagement Suite (Conversational Agents): apps, agents, root-agent association, app versions, guardrails, tools, toolsets, few-shot examples, and deployments. Session SKUs fire only on chat/voice traffic — creating design-time config or a channel binding does not send sessions.
chronicle: Chronicle (Google SecOps): detections, playbooks, custom lists, dashboards, and environments (enterprise ingestion / never_apply).
cloud_asset: Cloud Asset Inventory — project feeds that publish asset updates to Pub/Sub. Creating a feed does not scan or export existing assets; messages fire only when matching resources change.
cloud_build: Cloud Build CI/CD: trigger, private worker pool, v2 SCM connection + repository.
cloud_functions: Cloud Functions Gen 2 — serverless function execution with build + deploy from source.
cloud_ids: Cloud IDS — managed intrusion detection endpoints attached to VPC networks (endpoint hours while provisioned; never_apply for apply-smoke).
cloud_quotas: Cloud Quotas — project-singleton adjuster settings and quota preferences. Both are never_apply (MM exclude_delete); debt-only.
cloud_run: Cloud Run v2 services + jobs, plus the legacy v1 service (google_cloud_run_service). Prefer v2 for new stacks.
cloud_scheduler: Cloud Scheduler cron jobs.
cloud_security_compliance: Compliance Manager — cloud controls, frameworks, and framework deployments. Org/folder scoped; apply-excluded leftover factories.
cloud_sql: Cloud SQL — managed relational databases (MySQL / PostgreSQL / SQL Server).
cloud_support: Cloud Support — organization-scoped support event subscriptions (Pub/Sub notifications for support-case events). Org-only; debt-only on terradart-validate.
cloud_tasks: Cloud Tasks queues + per-queue IAM bindings.
clouddeploy: Cloud Deploy — continuous-delivery pipelines, targets, custom target types, automations, and deploy policies. Nested config blocks (serial pipeline stages, deployment targets, custom actions, automation rules, policy selectors) are passed as structured maps.
clouddomains: Cloud Domains — domain registration metadata. Registration is existence-billed; apply-excluded leftover factory (do not apply).
cloudfunctions: Cloud Functions (1st gen) IAM — grant roles on legacy google_cloudfunctions_function resources.
colab: Colab Enterprise — runtimes, runtime templates, template IAM, paused notebook execution schedules, and one-shot notebook executions (Vertex AI notebook runtimes; runtime/execution compute is never_apply).
composer: Cloud Composer — managed Apache Airflow environments plus user workloads ConfigMaps and Secrets. Environments bill an hourly fee while they exist.
compute: Compute Engine resources: instances, addresses, firewalls, networks, subnetworks, hierarchical firewall policies with rules, organization Cloud Armor policies, BYOIP advertised/delegated prefixes (apply- excluded), Hyperdisk Storage Pools (pool capacity is never_apply), Cross-Site / wire groups (Partner Cross-Cloud Interconnect $17+/h is never_apply), and packet mirroring (mirrored GiBy is never_apply).
config: Infrastructure Manager (Config API): Terraform blueprint deployments.
contact: Contact Center AI Insights and related contact APIs.
container: Google Kubernetes Engine (GKE) — clusters, node pools, and GKE Hub (membership, scope, namespace, rollout sequence, hub features).
container_analysis: Container Analysis — notes and occurrences for image metadata and attestations (often paired with Binary Authorization).
container_attached: GKE attached clusters — register an existing conformant Kubernetes cluster with a Fleet. GKE Enterprise management fees; needs a real external cluster — not applyable on terradart-validate.
container_aws: GKE on AWS (multi-cloud) — clusters and node pools on Amazon Web Services. GKE Enterprise Multicloud fees plus AWS EC2; needs a real AWS account — not applyable on terradart-validate.
container_azure: GKE on Azure (multi-cloud) — Azure client, clusters, and node pools. GKE Enterprise Multicloud fees plus Azure VMs; needs a real Azure tenant — not applyable on terradart-validate.
data: Read-only data sources (no terraform apply side effects).
data_catalog: Google Cloud Data Catalog — entry groups, tag templates, and tags (legacy Data Catalog API; prefer Dataplex Universal Catalog for new catalogs).
data_fusion: Cloud Data Fusion — managed CDAP data integration instances.
database_migration: Database Migration Service — connection profiles, private connections, and migration jobs. Apply-excluded leftover factories (needs a reachable source database).
dataflow: Cloud Dataflow — managed batch/streaming pipeline jobs (worker vCPU hours while running; never_apply for apply-smoke) plus the leftover Data Pipeline factory (apply-excluded).
dataform: Dataform — folder and team-folder metadata for organizing SQL workflow repositories. Folder objects do not compile or run workflows (those SKUs fire on repository compilation).
dataplex: Dataplex: governed data products, Universal Catalog metadata (entry groups / entry types / aspect types), Data Lineage project config, and their IAM adjuncts.
dataproc: Dataproc: classic/GKE clusters, classic jobs, autoscaling policies, workflow templates, Metastore, GDC service instances / application environments, and Serverless session templates. Cluster / job / GDC / Interactive session paths are never_apply for apply-smoke. Workflow templates are reusable DAG metadata — create does not start a cluster.
datastream: Datastream — CDC connection profiles, private connections, and streams. Apply-excluded leftover factories (needs a reachable source database).
deployment_manager: Deployment Manager — legacy Google Cloud deployment configs. Apply-excluded leftover factory.
developer_connect: Developer Connect — account connectors that start an OAuth flow for a system provider (GitHub / GitLab / …). Creating a connector does not complete OAuth or clone a repository.
dialogflow: Dialogflow ES / CX: SIP trunk, ES conversation-profile metadata, Agent Assist summarization generators, location CMEK encryption spec (apply-excluded), ES agent plus intent / entity type / fulfillment / version / environment, and full CX agent surfaces (all CX factories are never_apply — agent / flow / intent / page / playbook / webhook / generative settings / security settings / generator / tool / entity type / environment / version / tool version / test case).
discovery_engine: Vertex AI Search (Discovery Engine): data stores, search engines, IAM, schema / serving controls, location CMEK config and third-party data connectors (apply-excluded), and Gemini Enterprise license configs (never_apply — seat subscriptions).
dlp: Sensitive Data Protection (DLP) — inspect / de-identify templates, stored info types, and job triggers.
dns: Cloud DNS managed zones (public, private, peering, forwarding).
document_ai: Document AI — document processors (OCR / form parser / etc.) for extracting structured data from documents.
edgecontainer: Google Distributed Cloud Edge — Kubernetes clusters on edge hardware (requires physical GDCE machines; not applyable on a standalone project).
edgenetwork: Google Distributed Cloud Edge Network — L3 networks, subnets, and interconnect attachments on physical GDCE zones (not applyable on a standalone project).
endpoints: Cloud Endpoints — OpenAPI/gRPC service-config metadata (google_endpoints_service) plus managed API service IAM for an Endpoints service and its consumer projects (google_endpoints_service*_iam_*).
essential_contacts: Essential Contacts — register people/teams to receive Google Cloud notifications (technical, security, billing, …) for a project, folder, or organization.
eventarc: Eventarc — channels, triggers, pipelines, message buses, and API sources for routing CloudEvents to Cloud Run, Cloud Functions, Workflows, GKE, and HTTP endpoints.
filestore: Cloud Filestore — managed NFS instances, backups, and snapshots.
firebase_app_check: Firebase App Check — request attestation for Firebase services (reCAPTCHA Enterprise / Play Integrity / App Attest / Device Check providers + service-level enforcement + debug tokens + resource policies).
firebase_app_hosting: Firebase App Hosting — Cloud Run-backed successor to classic Firebase Hosting. Backends, build artifacts, custom domains, traffic split.
firebase_data_connect: Firebase Data Connect — serverless GraphQL backend backed by Cloud SQL.
firebase_remote_config: Firebase Remote Config — project-level dynamic configuration templates (parameters + parameter groups + conditions).
firebaserules: Firebase Security Rules — immutable rulesets for Firestore / Storage plus the leftover google_firebaserules_release factory that activates a ruleset (apply-excluded; serving live rules).
firestore: Cloud Firestore — Native and Datastore mode databases + composite index management.
folder: Resource Manager folders — folder create, folder IAM, leftover access-approval settings, IAM audit config, and the legacy folder organization-policy factory (apply-excluded).
gemini: Gemini for Google Cloud (Gemini Code Assist) — project/location settings (enablement, logging, release channel, data-sharing) plus Code Assist repository index / code tools (subscription seats; never_apply).
gke_backup: GKE Backup — backup/restore plans, channels, and plan-scoped IAM.
gkeonprem: GKE on-prem (Google Distributed Cloud) — bare metal and VMware admin clusters, user clusters, and node pools. Requires physical / vSphere hardware plus GDC platform fees; never_apply for apply-smoke.
google_beta: hashicorp/google-beta utilities — service-agent minting used when the GA provider has no equivalent resource.
healthcare: Cloud Healthcare — datasets and modality stores (DICOM, consent) plus the dataset *_iam_member adjunct.
hypercomputecluster: Cluster Director (Hypercompute Cluster) — HPC clusters combining compute, storage, network, and an orchestrator. Provisions billable capacity; not applyable on a standalone smoke project.
iam: IAM service accounts, Workload Identity Federation pools (including trust-domain namespaces and managed identities), Workload Identity service-agent minting, Workforce Identity Federation pools / providers / keys / SCIM (apply-excluded; org parent), Workforce OAuth clients, OS Login SSH public keys, project deny policies, and per-resource IAM members live alongside their owning service barrel (e.g. pubsub.dart exports GooglePubsubTopicIamMember).
iap: Identity-Aware Proxy (IAP) — settings, tunnel destination groups, plus IAM for App Engine and external HTTPS load balancer backend services.
identity: Identity Platform — project Auth config, multi-tenant realms, project and tenant OIDC IdP metadata, leftover default-supported / SAML IdP configs, and Cloud Identity groups / memberships (apply-excluded).
integration_connectors: Integration Connectors — managed connection nodes to SaaS / Google apps (node hours while provisioned; never_apply for apply-smoke).
integrations: Application Integration — provision a regional client (google_integrations_client) and auth-config credential metadata (google_integrations_auth_config).
kms: Cloud KMS key rings and crypto keys.
license_manager: License Manager: third-party software license configurations for Compute Engine.
logging: Cloud Logging: log-based metrics and sinks routed to BigQuery / Pub/Sub / Storage / Logging-bucket destinations, plus leftover folder / organization / billing-account buckets, exclusions, sinks, and settings (apply-excluded).
looker: Looker (Google Cloud core) — managed BI instances (platform fee while provisioned).
lustre: Managed Lustre — high-performance parallel file system instances.
managed: Managed Service for Apache Kafka — clusters, topics, ACLs, Connect clusters, and connectors. Clusters bill Data Compute Units hourly.
memcache: Memorystore for Memcached — managed Memcached instances.
memorystore: Memorystore for Valkey — instances and user-created PSC endpoints.
migration: Migration Center: sources, discovery clients, import jobs, groups, preference sets, and reports.
model_armor: Model Armor — templates that configure RAI / SDP / jailbreak / URI filters for screening LLM prompts and responses.
monitoring: Cloud Monitoring: alert policies, notification channels, uptime probes, dashboards, custom metric descriptors, and SLO service objects.
netapp: Google Cloud NetApp Volumes — storage pools, volumes, snapshots, backups, replication, AD/CMEK/host/quota adjuncts. Pools bill capacity while they exist (never_apply for apply-smoke).
network: Network Connectivity Center (hub / group / spoke / internal range / regional endpoint / policy-based route; gateway advertised route and service connection policy are debt-only), transports / multicloud data-transfer (Partner Cross-Cloud Interconnect managed transport is never_apply — $17+/h), Network Security ULL mirroring, OOB intercept / mirroring deployments + endpoints (Deployment Uptime $0.025/h is never_apply), address groups, URL lists, client/server TLS policies, gateway security policies, Cloud NGFW firewall endpoints (Enterprise Endpoint Uptime is never_apply — $1.75/h), VPC Flow Logs configs, Network Services Mesh, Service Extensions (Authz / LB traffic / route / edge — debt-only: schema required forwarding_rules bill Cloud LB Forwarding Rule Minimum $0.025/h), Wasm plugin metadata (apply-excluded — needs an uploaded plugin image), and Network Services gateways (Secure Web Gateway is never_apply — $1.25/h).
notebooks: Vertex AI Workbench (Notebooks) — environments, user-managed instances, managed runtimes, and IAM members.
observability: Cloud Observability — trace scopes that group projects' trace data for unified querying.
oracle: Oracle Database@Google Cloud — Autonomous Database, Base DB, Exadata (incl. Exascale storage config; BMS capacity is never_apply), ODB, GoldenGate.
organization: Resource Manager organization IAM plus leftover access-approval settings, custom roles, IAM audit config, legacy organization policy, and Org Policy v2 custom constraints / policies (apply-excluded).
os_config: OS Config: VM Manager OS policy assignments, patch deployments, and v2 policy orchestrators.
parallelstore: Parallelstore — high-performance managed parallel file system instances.
parameter_manager: Parameter Manager — store and version application configuration parameters (global and regional), the non-secret sibling of Secret Manager.
privateca: Private CA (Certificate Authority Service) — CA pools for managed certificate issuance via Certificate Manager.
privileged_access_manager: Privileged Access Manager — project-scoped entitlements that define who may request time-bound IAM roles. Creating an entitlement does not grant access until someone requests a grant.
project: Project services (enabling individual GCP APIs on a project).
provider: Provider block factory and version constants for hashicorp/google.
public_ca: Public CA — ACME external account binding (EAB) keys for Google Trust Services certificates via Certificate Manager Public CA.
pubsub: Pub/Sub topics, subscriptions, schemas, and per-resource IAM bindings.
pubsub_lite: Pub/Sub Lite — reserved throughput capacity, topics, and subscriptions. Reservations bill while they exist (never_apply for apply-smoke).
recaptcha: reCAPTCHA Enterprise keys for web, Android, and iOS clients.
redis: Memorystore for Redis — instances, Cluster, and user-created PSC connections.
scc: Security Command Center (SCC) v1 / v2 / Management — sources, notification configs, mute configs, custom modules, BigQuery exports, and source IAM. Org/folder factories are apply-excluded.
secret_manager: Secret Manager secrets, versions, and per-secret IAM bindings.
secure: Secure Source Manager — regional Git instances, repositories, IAM, webhook hooks, and branch rules. Instances are never_apply ($1000/mo).
securityposture: Security Posture — organization postures and deployments. Apply-excluded leftover factories.
service_directory: Service Directory — managed service registry: namespaces, services, endpoints, and the *_iam_member adjuncts for namespace/service access.
service_networking: Service Networking — VPC peering between user networks and Google service VPCs, plus Serverless VPC Access connectors for Cloud Run / Functions / App Engine egress into a consumer VPC.
site_verification: Site Verification — Search Console ownership tokens and verified web resources. Apply-excluded leftover factories (needs a real domain / file token).
sourcerepo: Cloud Source Repositories — Git repositories and per-repo IAM.
spanner: Cloud Spanner — horizontally scalable relational databases and user-managed instance configurations.
storage: Cloud Storage buckets, bucket objects, Pub/Sub object-change notifications, inventory reports, Storage Transfer jobs, and fine-grained ACLs.
storage_control: Cloud Storage Control — project / folder / organization Storage Intelligence config (edition / filters for inventory and insights). Folder and organization configs are apply-excluded.
tags: Resource Manager Tags — tag keys, tag values, resource bindings, and the *_iam_member adjuncts that grant access on individual tag keys/values.
terradart_google: terradart_google — curated GCP factory wrappers for terradart.
time: hashicorp/time utilities — propagation waits used by Apis.enable.
transcoder: Transcoder API — reusable job templates (JobConfig metadata). Creating a template does not transcode media; jobs that run a template bill output-minute SKUs and are not curated here.
vector: Vector Search 2.0 — collections (typed data + vector schema) and ANN indexes over a collection field (ScaNN / dedicated infrastructure).
vertex_ai: Vertex AI — Feature Store (legacy featurestore / entity type / feature) plus feature groups (BigQuery-backed), managed datasets, experiment Tensorboards (with experiments and runs), pipeline schedules, GenAI cache config, online prediction endpoints, shared deployment resource pools, and Vector Search indexes / index endpoints (plus deployed indexes). Nested config blocks (e.g. encryption_spec) are passed as structured maps.
vmwareengine: Google Cloud VMware Engine — private clouds, networks, clusters, subnets, datastores, and external access (VMware SDDC on Google infrastructure). Existence-billed node hours on private clouds / clusters; not applyable on a standalone smoke project.
workbench: Vertex AI Workbench instances (current notebook VM API) and IAM members.
workflows: Workflows — serverless orchestration: define a Workflows workflow from inline YAML/JSON source.
workstations: Cloud Workstations — clusters, configs, workstations, and resource-level *_iam_member grants. Clusters bill a control-plane fee hourly while they exist.

terradart_google

How resources are built

Installation

Usage example

Libraries

terradart_google package