01. プロバイダと認証

最小構成

terraform {
  required_version = ">= 1.6"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 6.0"
    }
  }
}

provider "google" {
  project = "myapp-prd"
  region  = "asia-northeast1"   # 東京リージョン
  zone    = "asia-northeast1-a"
}

# ここから resource を書ける
resource "google_storage_bucket" "data" {
  name     = "myapp-prd-data"
  location = "ASIA-NORTHEAST1"
}

google vs google-beta

GCP には 2 つの Terraform プロバイダ があります:

terraform {
  required_providers {
    google      = { source = "hashicorp/google",      version = "~> 6.0" }
    google-beta = { source = "hashicorp/google-beta", version = "~> 6.0" }
  }
}

provider "google"      { project = "myapp-prd", region = "asia-northeast1" }
provider "google-beta" { project = "myapp-prd", region = "asia-northeast1" }

# Beta 機能を使いたいリソースだけ provider を指定
resource "google_compute_instance" "x" {
  provider = google-beta   # ← これ
  # ...
}

認証方法（4 通り）

1. Application Default Credentials (ADC): gcloud auth application-default login でローカル開発。2026 年の標準
2. Service Account Key (JSON): 旧来。鍵ファイルがあれば認証可能。非推奨（鍵漏洩リスク）
3. Workload Identity Federation: GitHub Actions / EKS / 他クラウドからキーレス認証。CI 推奨
4. Service Account Impersonation: 自分の権限から SA に「なりすまし」

Application Default Credentials

ローカル開発で最も簡単。Terraform は何も書かなくても自動で ADC を使う。

# ログイン（ブラウザが開く）
gcloud auth application-default login

# project と quota project（請求先）を設定
gcloud config set project myapp-prd
gcloud auth application-default set-quota-project myapp-prd

# Terraform 実行
terraform plan

Workload Identity Federation（GitHub Actions × GCP）

GitHub Actions から GCP にキーレス認証する標準パターン。SA Key の保管が不要。

# GCP 側: Workload Identity Pool と Provider
resource "google_iam_workload_identity_pool" "github" {
  workload_identity_pool_id = "github-pool"
  display_name              = "GitHub Actions Pool"
}

resource "google_iam_workload_identity_pool_provider" "github" {
  workload_identity_pool_id          = google_iam_workload_identity_pool.github.workload_identity_pool_id
  workload_identity_pool_provider_id = "github-provider"
  display_name                       = "GitHub Actions"

  attribute_condition = "assertion.repository_owner == 'your-org'"
  attribute_mapping = {
    "google.subject"       = "assertion.sub"
    "attribute.actor"      = "assertion.actor"
    "attribute.repository" = "assertion.repository"
  }

  oidc {
    issuer_uri = "https://token.actions.githubusercontent.com"
  }
}

# CI 用 Service Account
resource "google_service_account" "ci" {
  account_id   = "ci-terraform"
  display_name = "CI Terraform Deployer"
}

# 特定リポジトリだけ impersonation を許可
resource "google_service_account_iam_member" "ci_wif" {
  service_account_id = google_service_account.ci.name
  role               = "roles/iam.workloadIdentityUser"
  member = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github.name}/attribute.repository/your-org/your-repo"
}

# GitHub Actions 側
permissions:
  id-token: write
  contents: read

jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: projects/123/locations/global/workloadIdentityPools/github-pool/providers/github-provider
          service_account: ci-terraform@myapp-prd.iam.gserviceaccount.com
      - uses: hashicorp/setup-terraform@v3
      - run: terraform plan

impersonate_service_account

「自分の人間アカウントから本番 SA に切り替えて Terraform を動かす」パターン。本番資格を直接持たない運用に。

provider "google" {
  project                     = "myapp-prd"
  region                      = "asia-northeast1"
  impersonate_service_account = "tf-deploy@myapp-prd.iam.gserviceaccount.com"
}

事前に自分のアカウントに roles/iam.serviceAccountTokenCreator を SA で付与しておく必要があります。